Read, shred and forget? New Swedish case law and the manual-processing gap in the GDPR

Background
Wallhamn AB, a port and stevedoring company bound by a collective agreement with union Industrifacket Metall, employed JW as a car mechanic. After he started work, the company asked for a criminal record extract. He then handed his manager a sealed envelope; the manager read the extract, which showed a conviction, made no note, copy or scan, and shredded it. The union claimed SEK 60,000 under Article 82 GDPR for breach of Article 10 and asked for a reference to the CJEU on damages and, alternatively, on whether reviewing such a physical extract falls within the GDPR even if it is destroyed. The employer side argued for nil or, at most, SEK 3,000.
The Swedish Labour Court’s conclusions
The Court accepted that the extract contained personal data and that reading is “processing” under Article 4(2). But under Article 2(1), manual processing is covered only if the data form, or are intended to form, part of a filing system, and the union had not even alleged that the employer intended to register the data. Finding Article 2(1) clear, the Court refused a reference, dismissed the claim and ordered the union to pay SEK 200,000 in costs.
One judge dissented on the reference. She saw the method of having the employee fetch and show an extract during employment, then destroying it, as apparently designed to circumvent the GDPR.
So, what does this mean?
Literal reading versus purposive case law. The majority’s reading of Article 2(1) is orthodox: a single document read and shredded is unstructured data. Yet the CJEU reads scope broadly and with an eye to circumvention. In Jehovan todistajat (C-25/17), paper notes were covered where data could be easily retrieved, whatever the form of the filing system. In Endemol Shine, the CJEU warned against circumventing the GDPR by oral disclosure and looked at whether the disclosed data were contained in a register, not at whether the recipient meant to create one. The Labour Court looked only at the employer’s own handling and did not explain why the factual difference should be decisive. As critics note, it is odd that having a conviction read out by phone from a register would be processing, but reading the same data from an extract would not.
The acte clair problem. As a court of last instance, the Labour Court must refer necessary EU-law questions unless the answer is clear. Given the CJEU case law, the absence of a ruling on extracts handed over by the data subject, and a dissenting judge, the acte clair finding is contestable. Under Swedish case law NJA 2022 s. 1051, an erroneous refusal to refer may in some circumstances ground extraordinary relief (resning), and a general court could refer the question in a later case.
An incoherent landscape. Where record checks are authorised by statute, for example for work with children or under the Swedish Act (2026:43) on work in the homes of elderly or disabled people, safeguards apply: the extract may only be shown, the employer may record only that it was shown, and checks are generally tied to recruitment. Under this new case law, unregulated employers appear to face lighter requirements than regulated ones. Meanwhile, IMY asked the EDPB in September 2026 to clarify what Article 10 covers, as Member State approaches differ.

Recommendation

Practical implications for employers in Sweden
• The safe harbour covers only momentary, manual review of a physical extract. Notes, copies, scans, emails or HR-system entries, even a “passed” tick-box, are likely to bring the processing within the GDPR and Article 10.
• Digital channels, such as portal uploads or screening providers, involve automated processing and fall outside the judgment and in scope of GDPR.
• Checks during employment remain sensitive, and co-determination obligations still apply.
• Until the CJEU rules, compliance programmes should be robust to a contrary outcome.

Article provided by INPLP member: Emily Svedberg-Possfelt (Setterwalls Advokatbyrå, Sweden)