Search

3 results for “keisatsu”

1. 

   keisatsu @keisatsu

   2026-10-06

   WTF. I went and dug up the proposal for legislation that the court referenced. It covers the adaptation of the swedish data protection laws to GDPR.

   TL;DR:

   1. The praxis at the time was that you could not object to a decision by Datainspektionen (now IMY) to not initiate an investigation into a data protection complaint. All such decisions were final and could not be overturned.

   2. The governement could not tell, after reading through the GDPR, whether or not this praxis would be impacted. After all, while the GDPR clearly states that a subject should have the right to object to a decision regarding a complaint, how can one REALLY tell? Maybe it's up for interpretation?

   3. The government abstains from making a decision on the matter and leaves it to the courts to decide if anything should change regarding praxis.

   4. The courts decide to roll like before and blames the government. So you CAN ask the court to overturn IMYs decisions, but since IMY can decide to do whatever the fuck they want the court won't. It's a pointless waste of time and taxpayer money.

   #gdpr #privacy

   #privacy #gdpr
2. 

   keisatsu @keisatsu

   2026-10-06

   Quote from Förvaltningsrätten (Swedish administrative law court) regarding the GDPR supervisor authority IMY:

   "I samband med anpassningen av svensk rätt till EU:s dataskyddsförordning
   uttalade regeringen, mot bakgrund av vad som framgår av artikel 57.1 f i
   förordningen, att tillsynsmyndigheten inte har någon skyldighet att vidta
   tillsynsåtgärder eller ens att alltid närmare undersöka sakförhållandena, utan
   myndigheten har enligt dataskyddsförordningen tvärtom ett tydligt utrymme att
   själv avgöra vilka tillsynsärenden som ska drivas och på vilket sätt det ska ske
   (prop. 2017/18:105 s. 164 och 165)."

   Rough translation:

   "The government stated while adapting swedish law to the GDPR, in accordance with article 57.1 f, that the supervisor authority do not have any obligation to conduct investigations or even attempt to consider all facts if they do. On the contrary, the supervisor authority can decide on their own if and how an investigation should be conducted."

   Am I weird for thinking that this makes IMY beyond reproach regardless what they do? #gdpr #privacy

   #gdpr #privacy
3. 

   keisatsu @keisatsu

   2026-10-06

   Sigh. One of the swedish postal services PostNord has recently begun using a LLM-based voice agent for answering support calls.

   I wrote to them invoking my GDPR rights asking for details. They cited "*starkt* berättigat intresse" / *very* legitimate interest as their legal basis for processing 🤨

   Apparently they have contracted the firm https://elevenlabs.io who provides the bot.

   Elevenlabs, to their credit, publishes a transparancy page at https://elevenlabs.io/ai-transparency which states that they use american frontier models:

   Google Gemini (Google LLC)
   OpenAI
   Anthropic via Google Vertex AI

   And they write this in their privacy policy:

   "Regardless of your location, all Personal Data will be transferred to the United States for storage."

   So I wrote to PostNord invoking my right to object to the processing and, as they based it on legitimate interest, the right to erasure of my voice data from their processor and subprocessors systems, including any model training data if such should exist. We had a bit of back-and-forth over e-mail. In the end they refused, stating that the system did not permit erasing a singular call as there were no way to tell which one was mine. They also claimed that the contract forbids the processors and subprocessors from using the data for training, but I highly doubt that anyone at the above-mentioned companies give a singular fuck about such a clause, should it exist.

   I then wrote to IMY, the supervisor authority in Sweden, to protest. I argued that the so-called legitimate interest of PostNord in processing the data couldn't outweigh the privacy impact of sending their customers voice data through one processor and three subprocessors, with data transfer to a third country for at least storage of the data.

   They chose to "not take sides" and opted for sending a letter to PostNord informing them about their obligations under GDPR but also clearly stating that it was NOT criticism, just a friendly reminder that the law exists 🤦

   I objected to IMYs decision, which is apparently tried in an administrative law court. They just passed judgement.

   The court more or less said that swedish law states that IMY may choose if they are to investigate a complaint at all and how to go about addressing it if they do. The court can't see any reason to believe that IMY isn't doing what they are supposed to. Case closed 😡

   #gdpr

   #gdpr