AI, health care and employers – the Swedish Authority for Privacy Protection focus areas for supervision 2025

The Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten, “IMY”) has published its direction for supervision and guidance priorities for 2025. In this publication, the IMY sets out areas where it will focus its supervision activities for the coming years. The focus areas set by the IMY are the following:

• Employers processing of employee data – in particular regarding assessments, monitoring and background checks
  Due to the current security and societal developments in Sweden, the IMY has noticed an increasing preference from employers to, by varying means, monitor their employees. Given that employers do have a legitimate interest, in many situations, to follow up on work performance and increase the efficiency within the organisation, the IMY deems that this increased monitoring will have to be carried out with respect for the employee’s integrity.
  The monitoring requests by employers also cover the much-debated possibility to conduct background searches on employees and potential employees, an area which the IMY deems is in need of further guidance, specifically with focus on businesses that offer background searches as a service.
• Use of AI
  AI is undoubtedly becoming a natural and increasingly intertwined part of everyday life, both in work- and private life. Since many AI-systems rely on the processing of personal data, in both training and use of the AI-system, it is important to review on how AI-systems can be used with respect for the individual´s integrity. The IMY will both aim to provide further guidance and conduct supervision in this area
• Health- and social care
  Health- and social care require extensive processing of personal data, and it is important that such processing is carried out by safe and reliable tools with respect for each individual’s integrity. This area of focus is closely related to the IMY´s aim to provide guidance for the use of AI.
• Camera surveillance
  The requirements for authorisation for camera surveillance will end during spring of 2025. This means that those who do use camera surveillance will have to perform their own legitimate interest assessments as well as keep records of all surveillance activities. Due to these assessments being somewhat complicated, the IMY aims to provide guidance and consequently supervise the compliance.
• Children and youth in digital environments
  The IMY will provide further guidance to children, youth and caregivers in order to increase awareness of the risks associated with the use of digital tools, e.g. social media, online gaming and digital platforms that are governed by algorithms to provide personalised content for users.

We note these areas of focus have been part of the discussions in the data protection area for some time. It is therefore not surprising that the IMY has decided on these focus areas for the coming year.

Setterwalls will continue to monitor any further guidance and supervision initiatives by the IMY.