In the Swedish constitutional tradition, the idea that omnipresent fundamental rights should take precedence over national legislation and decisions of public bodies has been controversial. Indeed there is a slow transition from a system where the citizens’ rights were considered to be ensured ex officio by a public administration monitored by Ombudsman offices, to a system based on fundamental rights that can be invoked against the public administration in courts. Although Swedish authorities and courts have since 1980 had a duty to assess the validity of domestic sources of law under the ECHR it is manifested in the Instrument of Government that all public power shall be exercised under the law in terms of legislation enacted by the Parliament. Efforts were made to maintain a dualistic approach to the ECHR by incorporation of its provisions in Swedish law. In general, fundamental rights are largely particularised in domestic legislation and explained by the legislator in the travaux préparatoires. Nonetheless, the discrepancies between the Constitutional rights and the Convention rights have sometimes proved to be untenable as the legislator is inclined to give the national system precedence. Hence, the courts have shouldered a more active role to ensure compliance with European standards, and this became even more necessary pursuant to the Country’s accession to the EU in 1995. According to Chapter 10, section 6 of the Instrument of Government, the national Parliament is authorised to transfer powers to the Union as long as the Country’s form of government and the fundamental rights in the Instrument of Government and the ECHR are left unaffected. As a result Act (1994:1500) was adopted to provide a conduit pipe for EU law into the domestic legal system.

Gradually the supremacy of EU law and the effects of legislative acts transposing the rights and freedoms enshrined in the provisions of the EU Charter into Swedish law, is transforming the domestic legal system. In case secondary legislation is not given the intended effect, provisions in the EU Charter may take upon direct effect independently in the national legal systems in parity with provisions in the ECHR. Particularly the direct effect of the right to a fair trial under both Article 47 of the EU Charter and Article 6 of the ECHR has been palpable in Swedish law. Also the ne bis in idem requirements under the two regimes have greatly influenced the domestic legal system. Indeed, the rights and freedoms in the ECHR and the EU Charter are to a great extent approximated. However in case of a norm conflict the primacy of one system over the other depends on what supranational court decides the case. Having said that, it follows from Chapter 10, section 6 of the Instrument of Government that the ECHR sets the limits in the Swedish legal system. As the Parliament has no competence to transfer powers to the EU in conflict with the Instrument of Government or the ECHR such a Union measure would be ultra vires. At the end of the day, Swedish constitutional law prevails over EU law. In contrast, there is no constitutional limitation of the obligation to give effect to the rights and freedoms of the Convention system.

In the EU, software classified as artificial intelligence (AI) is considered to categorically pose a high risk to human health, safety and fundamental rights if it is applied in relation to products covered by the system for public surveillance and enforcement known as the “new legal framework”, and when implemented in certain areas beyond the general product safety regime. Whereas private parties carry the enforcement costs regarding low- or no-risk AI, the EU Member States must, according to the AI Act, have a dialogue with those who provide and apply high-risk AI professionally to ensure compliance prior to marketing and as long as the system is in use. Since the AI system learns and adapts, Article 14 of the AI Act provides that a natural person shall be designated by the professional user to oversee the high-risk AI system continuously. However, the AI Act does not define the rights and interests that it is intended to safeguard. A case in point is the right to data protection, which is mainly particularised in the General Data Protection Regulation (GDPR). Measures typically need to be taken ex ante to ensure that data processing by a high-risk AI system complies with the data subject’s right under Article 22 of the GDPR “not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”. In that context, the relationship between the system for impact assessment established primarily by Article 35 of the GDPR and the compliance regime introduced by the AI Act is explored.

Data transfers and enforcement of EU privacy rightsSeminarium den 25 januari 2022, kl. 12:00

At the seminar, three main aspects of the enforcement of EU privacy rights in the light of the Schrems rulings regarding the EU-US “Safe Harbour” and “Privacy Shield” will be addressed. 

Much has been said about the annulment of the two adequacy decisions issued by the European Commission on the US system for data protection and overseas legal remedies for EU data subjects. However, the discussion that is centred on concerns with a perceived overreach of EU data protection standards has often been somewhat siloed and artificially abstracted from its legal context. At the seminar, three main aspects of the enforcement of EU privacy rights in the light of the preliminary rulings regarding the EU-US “Safe Harbour” and “Privacy Shield” will be addressed. First of all, why should a data protection authority in an EU Member State assess the validity of an adequacy decision when an EU data subject lodges a complaint against an EU establishment? Secondly, what competence does the Commission have to take measures to prevent onward transfers and unwarranted interceptions of data for primarily national security purposes? Thirdly, can an EU data subject rely on her or his procedural rights as a consumer in the Member State in which he or she is domiciled instead of filing a complaint with one or more data protection authorities in the Member State(s) where the controller or processor has an establishment?

Claes Granmar is associate professor in European Law at Stockholm University and the talk is based on his article ‘A reality check of the Schrems saga’ that was published 2021-12-30 in the Nordic Journal of European Law (Vol. 4 No. 2, 2021). It forms part of the project ‘Global e-commerce and EU privacy safeguards’ that he commenced as a research fellow at the IECL, Oxford University.