Field Notes

synthesis

Swedish public-record privacy

StatusWorkingReviewdue UpdatedStands on7 sourcesSupportsnotes

Sweden combines unusually accessible official records, a state-supported population-data distribution system, a practically permanent cross-sector identifier, and a constitutional publication regime that people-search services have used to resist ordinary data rights.

The result is not one privacy rule but a composition failure. Each component has a defensible institutional purpose. Together they make it cheap to turn scattered facts into an address-linked, relationship-linked, financial, property, and legal profile of a named person. The person usually cannot obtain a general opt-out.

The system is cumulative

flowchart TD
  A[Authority records] --> B[Public access requests]
  A --> C[Population and SPAR distribution]
  B --> D[Private acquisition]
  C --> D
  E[Other lawful copies] --> D
  D --> F[Join on personnummer]
  F --> G[Searchable personal dossier]
  H[Publication certificate] --> G
  I[GDPR and secrecy limits] --> B
  I --> G
%% note-link A Offentlighetsprincipen and personal privacy
%% note-link F Swedish personal identity number
%% note-link H Utgivningsbevis and people-search services
%% note-link I EU and Swedish data removal rights

The layers are legally distinct:

Layer Legitimate purpose Privacy failure mode
Offentlighetsprincipen and personal privacy Scrutiny of authorities and equal access to official documents Personal attributes in separate records can be obtained without a general purpose test.
Population registration and SPAR Accurate administration, address updating, research, and defined commercial selection A broad, current identity-and-address backbone is available for reuse and enrichment.
Swedish personal identity number Reliable matching of people across records A stable, visible join key collapses contextual separation between sectors and databases.
Utgivningsbevis and people-search services Freedom of expression, editorial responsibility, and protection of journalism A non-traditional database can claim media protection while offering person-centred search with little editorial transformation.
Digital aggregation Fast research and convenient verification Search, alerts, maps, and bulk correlation remove the friction that once limited practical exposure.

The combined architecture makes residents broadly observable even though each layer has a narrower institutional purpose.

Public access supplies records, but not an unlimited data feed

The principle of public access applies to official documents held by authorities after they have been received or drawn up. Secrecy law protects interests including national security, law enforcement, and individuals’ personal and economic circumstances. Authorities must apply those rules to a request.1

The requester is normally entitled to anonymity. An authority may investigate identity and purpose only when needed for the secrecy assessment. That is a safeguard against retaliation and an important condition for investigative journalism. It also means a broad rule of “release only to benign requesters” would conflict with a central feature of the transparency system.

The better distinction is between access to a document and industrial reuse of personal data. A journalist reading judgments to report on court practice, a litigant obtaining their file, and a service indexing every named person for public lookup all touch public documents, but their scale, purpose, and effect differ.

The population register is a distribution backbone

Skatteverket’s population database contains more than a number and address. Depending on the record and legal conditions, it includes names, birth details, citizenship, civil status, spouse, children, parents, guardianship, adoption, immigration or deregistration, address, property, apartment, and other registration facts.2

Authorities, municipalities, regions, and the Church of Sweden receive regular population updates. The state personal address register, SPAR, exists for defined purposes including updating customer registers, selection for direct marketing, and some research. Its services can combine population data with income totals and property-assessment information under applicable access rules and fees.3

SPAR is not an unrestricted anonymous raw download. Applications, purpose rules, and service conditions matter. But it demonstrates that dissemination is not limited to one-off constitutional document requests. Sweden maintains infrastructure for propagating authoritative identity and address data into other organizations’ systems.

The personnummer turns exposure into linkage

The personnummer usually remains with a person for life, with narrow exceptions for corrected birth date, change of legal sex, or a fictitious identity in exceptional danger.4 These exceptions do not provide an ordinary privacy remedy. The first corrects a proven registry error, the third requires a threat serious enough that lesser protection is inadequate, and the second is a legal-sex procedure rather than a general right to reset an exposed identifier. Most people therefore have no available route to replace a widely disclosed but otherwise correct personnummer. Its date-based structure is predictable, and directories or public documents may reveal the complete value.

The main risk is not that an attacker can solve a checksum. It is that one long-lived key is reused across government, finance, healthcare, telecommunications, housing, commerce, and credit. Once obtained, it makes record linkage deterministic where name, address, or birth date alone might be ambiguous.

Knowledge of a personnummer should not authenticate anyone. Vem där shows why identity retrieval and identity proof are separate tasks. Strong workflows require an identity document, electronic identification, or another robust check. Weak workflows turn public biographical data into answers to security questions and create an avoidable identity-fraud channel.

The privacy defect remains even when authentication is strong. A universal public identifier lets observers correlate contexts that were collected for different reasons. Administrative accuracy and personal unlinkability are being purchased with the same design choice.

Publication certificates changed the scale of republication

An utgivningsbevis gives an eligible database constitutional publication protection under YGL and assigns responsibility to an editor. What it confers is protection for publishing, never a key to the archive: the certificate holder acquires documents on the same terms as anyone else.

The 2024 inquiry Personuppgifter och mediegrundlagarna SOU 2024-75 found 61 large personal-data search services among 1,391 inspected certificate-bearing databases. At roughly 4 percent, they were a small minority of certificate holders but a large-scale privacy surface.

The services could expose name, age, personnummer, phone, present and former addresses, apartment and door location, cohabitants, neighbours, vehicles, companies, property values, dogs, income indicators, judgments, and search popularity. Some added paid monitoring alerts when another person’s circumstances changed.

This is where a protection designed around publishing became difficult to reconcile with data protection. If the certificate alone removed GDPR rights, the subject could have less control over a searchable dossier than over the same data in an ordinary commercial database.

Searchable aggregation enables targeted harm

Searchable aggregation reduces the cost of selecting a target, finding their home and relationships, and making a deception or threat credible.

The 2024 inquiry identified about 50 judgments in which one major search service was described as a tool for mapping victims or reinforcing threats. It reported burglary cases where offenders used vehicle information to identify homes whose occupants were away, and fraud cases where older people and their relatives were mapped before impersonation. National police material found search-service extracts listing actual or potential victims during house searches. Brå described how telephone fraudsters collect personal information to establish trust, often targeting people aged 70 to 80.5

The documented cases support treating joined personal-data services as risk multipliers for:

  • targeted fraud and social engineering;
  • burglary and asset selection;
  • stalking, coercive control, and unwanted monitoring;
  • threats against public employees and witnesses;
  • reputational harm from stale or contextless court material;
  • employment, housing, and relationship decisions based on incomplete or inaccurate profiles;
  • chilling effects when officials, sources, or ordinary residents expect instant personal exposure.

Accuracy does not remove these harms. A correct home address can be dangerous; a correct old judgment can be misleading outside its procedural context; and a correct family relationship can strengthen an impersonation attempt. The issue is appropriateness, purpose, and audience as well as truth.

Threat-based protection is not a general privacy right

Protected personal data in Sweden provides three escalating protections: confidentiality marking, protected population registration, and fictitious personal data. They respond to demonstrated threats or serious harm. Skatteverket states that a preference not to appear online or identity theft alone is not sufficient.6

The 2023 study Att leva med skyddade personuppgifter shows the cost of relying on an exceptional remedy. Among 875 respondents, 37 percent said protected information had been disclosed at least once; the figure was 42 percent for those protected because of relationship violence. The sample does not establish a population-wide leak rate, but it documents recurrent disclosures and disruption to healthcare, work, post, and ordinary commercial life.

The system therefore asks threatened people to carry much of the burden of maintaining secrecy across services designed for routine data propagation. It intervenes after risk becomes serious enough to prove, not when a person merely wants to prevent a dossier from forming.

The counter-case for openness is substantial

The strongest opposing explanation is not that privacy does not matter. It is that restricting access and research tools can protect corruption, discriminatory administration, police misconduct, unsafe courts, and conflicts of interest from scrutiny.

Professional research databases are not interchangeable with retail people-search products. The 2024 inquiry found them important for locating sources and investigating organized crime, money laundering, tax fraud, and corruption. Smaller newsrooms may be unable to reproduce those systems. Anonymous access to official documents also protects sources and prevents authorities from deciding who deserves scrutiny.

There are further benefits:

  • the personnummer reduces mistaken identity in administration;
  • authoritative address updates reduce undelivered notices and fraud;
  • researchers can study institutions and population outcomes;
  • public judgments make legal reasoning inspectable;
  • responsible reporting can reveal patterns invisible in one case.

The reform problem is therefore not “privacy versus transparency” as two indivisible blocks. It is how to preserve institutional accountability while limiting purpose-free population surveillance.

The older practical assumption was that YGL protection largely displaced ordinary GDPR rights for a certificate-bearing database. That position has fractured.

HFD held in 2024 that IMY could supervise a search service’s sensitive-data processing. HD held in 2025 that an authority could refuse bulk criminal judgments under secrecy law when the intended processing would violate GDPR. In June 2026, HD restricted a large Qura request for criminal-offence material and allowed a journalistic component to receive documents under a reservation against further searchable distribution.

Those HD rulings concern disclosure by authorities. They do not abolish an utgivningsbevis, make every copy of a judgment secret, or prevent a publisher from obtaining a lawful copy elsewhere.

The 9 July 2026 CJEU judgment Legal Newsdesk Sweden C-199-24 concerns the publisher’s separate processing. It held that Sweden cannot displace GDPR for purposes outside journalism and the other Article 85 expressions, and cannot leave a person only defamation remedies. Under Journalistic purposes under Article 85 GDPR, making criminal judgments available to any paying user is not journalistic unless its purpose and practice satisfy the broad but substantive journalistic criteria.

The national court must now apply the CJEU test. IMY is analyzing it in ongoing investigations into two criminal-record services and two general people-search services.7 The ruling is decisive against a blanket exemption, but it does not automatically settle every directory, data category, or mixed journalistic service.

Dumpen illustrates a harder comparator. It selects subjects and creates original edited reports, video, and commentary, so a journalistic purpose is more plausible than for Lexbase. Under Naming convicted people in Swedish media, editorial court reporting, full-document distribution, and the decision to identify a convicted person must still be assessed separately. That status is not supplied by the certificate alone, and a district court has convicted its responsible publisher of gross defamation over one identifying publication, subject to appeal.

The 2024 inquiry proposed a constitutional exception for searchable compilations posing a special privacy risk. The government declined in November 2025 to proceed with that proposal and indicated that ordinary-law alternatives needed further inquiry.8 As of July 2026, the judicial line is moving faster than the legislative one.

A defensible reform package

The useful objective is to preserve access needed to inspect institutions while making indiscriminate person indexing exceptional. That points to controls at several layers rather than one ban.

Separate document access from data-product reuse

Public access should continue to support case-specific scrutiny, research, litigation, and journalism. Bulk structured release, automated scraping, and person-indexed republication should receive a separate necessity and safeguard analysis. The mode, scale, purpose, and audience of processing matter.

Give GDPR remedies practical effect

A certificate should not by itself defeat access, correction, objection, erasure, restriction, supervision, and judicial review. Derogations should attach to actual journalistic processing, not merely to organizational form. Mixed services may need separate access tiers for newsroom research and unrestricted public search.

Reduce public correlation

Authorities and firms should mask full personnummer values unless the purpose requires them, avoid displaying birth date and address together, and stop using biographical facts for authentication. Longer-term identity infrastructure should use sector-specific or pairwise identifiers and selective attribute proofs.

Make safety preventive rather than exceptional

Residents should have a practical suppression route for retail people-search indexing without first proving a qualifying threat. High-risk data such as precise door location, family links, monitoring alerts, and criminal-history search should receive stronger defaults. Protected people need interoperable controls that do not make ordinary healthcare, banking, education, or delivery unreliable.

Preserve accountable research

Journalists and qualifying researchers need workable access, security duties, audit trails, and protection against source identification. Publication of findings should be distinguished from universal access to the underlying named database. Ethical rules, correction channels, retention limits, and editorial responsibility should be operational requirements rather than labels.

What an individual can do now

EU and Swedish data removal rights describes controller requests, search-engine delisting, and escalation to IMY. These remedies remain service-specific and cannot promise complete disappearance.

Practical defensive measures include:

  • request erasure or suppression from each search service and preserve its response;
  • request name-search delisting from general search engines where the legal criteria are met;
  • enable strong electronic identification and never accept personnummer knowledge as identity proof;
  • use credit-agency blocks and address-change controls after suspected identity misuse;
  • minimize voluntary publication of address, family, vehicle, and travel patterns;
  • seek protected-personal-data guidance when there is a concrete threat rather than ordinary privacy concern.

These steps reduce exposure and fraud risk. They do not repair the structural linkage system.

The system in international comparison

Public-by-default identity in international comparison tests how much of this architecture is peculiarly Swedish. Each component has a close foreign analogue: universal register identifiers are Nordic-normal, tax-data publication is shared with Norway and Finland, address lookup is purchasable in Germany and was fully open in Iceland, and commercial people-search dossiers are an American industry at larger scale. The composition is nonetheless singular: no other examined country combines a misuse-unresettable universal identifier, a state distribution backbone, constitutionally anonymous unlogged access, retail conviction search, and paid subject-monitoring alerts. The comparison also supplies reform templates Sweden has not adopted: Norway’s query logs, Estonia’s subject-visible access logs, Germany’s purpose fencing, Denmark’s confidential identifier and misuse reset, the UK’s expiring convictions, and Japan’s locked identifier with a leak-triggered reset.

Research and policy watch

The Swedish application of C-199/24, IMY’s collective investigations, and the replacement inquiry are tracked in the open question Will Swedish people-search services survive GDPR enforcement. As of July 2026 none of the three has produced an outcome, the inquiry is not due until March 2027, and the individual complaint route to IMY is suspended for the four services people complain about most, so the advice above should be read as describing a period in which the doctrine has moved and the remedies have not.

  • Quantify which public attributes are obtainable from authorities, SPAR, and private sources without conflating their different legal routes.
  • Compare pairwise identity architectures that could coexist with Swedish population administration.

The unsettled court proceedings and reform path keep this synthesis at working status.

  1. Regeringskansliet, “Offentlighetsprincipen — kortfattat om lagstiftningen”, regeringen.se, last updated 13 January 2025. The government’s own summary of the legislation, not the constitutional text it summarizes. ↩

  2. Skatteverket, “Behandling av personuppgifter”, the agency’s own account of what the population register holds and on what basis it discloses it. ↩

  3. Skatteverket, “SPAR — statens personadressregister”. The register operator’s description of permitted uses and fees, so it states what SPAR is licensed to supply rather than what recipients then do with it. ↩

  4. Skatteverket’s personnummer guidance lists correction of birth date and change of legal sex; local copy. Police guidance explains the threshold for fictitious personal data; local copy. ↩

  5. See Personuppgifter och mediegrundlagarna SOU 2024-75. ↩

  6. Skatteverket, “Skyddade personuppgifter”, covering sekretessmarkering, skyddad folkbokföring, and fingerade personuppgifter. The agency states the threshold in its own guidance, so what counts as sufficient is administrative practice rather than statutory text. ↩

  7. IMY suspension of search-service complaints preserves IMY’s consolidated search-service review and its position on individual complaints. ↩

  8. Konstitutionsutskottet, Tryck- och yttrandefrihet, massmediefrågor, betänkande 2025/26:KU18. A parliamentary committee report, which records the government’s position rather than enacting anything. ↩

Built on 7 sources (7 external).

Working out connections…