Is Google Analytics restricted in Sweden?

The IMY found that standard use of Google Analytics breached the GDPR because of data transfers to the United States and ordered companies to stop using it or apply strong supplementary measures.

Which authority enforces data protection in Sweden?

The IMY, the Swedish Authority for Privacy Protection, supervises the GDPR. Cookie rules sit in the Electronic Communications Act.

欧盟

Cookie 同意: Sverige

Sverige的同意与隐私法

简要说明

Sweden's authority, the IMY, supervises the GDPR while cookie rules sit in the Electronic Communications Act. Sweden has drawn particular attention for IMY decisions on the use of Google Analytics, where the authority found that transfers of analytics data to the United States breached the GDPR and ordered companies to stop using the tool or add strong supplementary measures. This makes Sweden a cautious jurisdiction for analytics that send data abroad. The IMY requires opt-in consent for non-essential cookies and expects clear information in Swedish. It also stresses that consent must be as easy to withdraw as to give.

监管机构

Integritetsskyddsmyndigheten (IMY)

生效状态

GDPR applies since 25 May 2018, with national supplementary data protection law

主要法律

GDPR

语言

Svenska

适用对象

Any organization that offers goods or services to people in the EU or monitors their behavior, wherever the organization is based.

处罚

Up to 20 million euros or 4 percent of global annual turnover, whichever is higher

主要义务

Obtain prior, opt-in consent before non-essential cookies
Make refusing as easy as accepting
Keep records that prove consent
Honor withdrawal at any time
Respect data subject rights (access, erasure, portability)

本地指引

Reassess analytics tools that transfer data outside the EU
Obtain opt-in consent for non-essential cookies under the Electronic Communications Act
Make withdrawal of consent as easy as giving it
Provide clear information in Swedish