ARTICLE · 18 DECEMBER 2008

Whistleblowing Scheme – A Conflict Between The US SOX And The Swedish Personal Data Act

Delphi & Co.

Explore more from Delphi & Co.

The Swedish Data Inspection Board has, on March 26, 2008, rendered decisions in five cases regarding exceptions from Section 21 in the Swedish Personal Data Act concerning whistleblowing schemes.

SwedenPrivacy

Henrik Bengtsson

Johan Kahn

The Swedish Data Inspection Board has, on March 26, 2008, rendered decisions in five cases regarding exceptions from Section 21 in the Swedish Personal Data Act (Sw. Personuppgiftslagen (1998:204)) concerning whistleblowing schemes. The Swedish Data Inspection Board takes a restrictive view on how a whistleblower scheme may be designed. This means that many US and Swedish companies may come into conflict with either the U.S. Sarbanes Oxley Act (SOX) or the Swedish Personal Data Act.

SOX and whistleblower schemes

SOX was enacted as a result of the Enron and Worldcom scandals. The act regulates how companies listed on the US stock exchanges shall be governed. SOX implies, among other things, that companies should operate a so called whistleblower scheme. By means of a whistleblower scheme, employees are able to anonymously report irregularities, e.g. white collar crime, inflated figures or ethical violations to an audit committee. Thus, the company may, at an early

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far And New Requirements From 1 October

Advokatfirman Vinge KB

Does A Press Certificate Exempt Data Brokers From GDPR?

Cybersäkerhetslagen – senaste nytt efter sommaren

Advokatfirman Cederquist KB

Ny utredning ska se över regelverket för vårdens behandling av personuppgifter

Advokatfirman Cederquist KB

Adekvansbeslutet för dataöverföringar mellan EU och USA utmanas

European UnionPrivacy

Advokatfirman Cederquist KB

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

Does A Press Certificate Exempt Data Brokers From GDPR?

The EU Court of Justice has ruled on whether Swedish press certificates can shield commercial data brokers from GDPR obligations. The landmark decision clarifies that holding a press certificate does not automatically exempt companies from data protection law, and that running a paid database of personal information without genuine editorial processes does not qualify as journalism.

Cybersäkerhetslagen – senaste nytt efter sommaren

Swedish cybersecurity regulations stemming from NIS 2 have transitioned from implementation to practical application during summer 2026. The National Cybersecurity Centre (NCSC) within the Swedish Defence Radio Establishment (FRA) has assumed responsibility for cyber operations, while new incident reporting requirements and security measures are being phased in.

Advokatfirman Cederquist KB

The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far And New Requirements From 1 October

The Swedish Cybersecurity Act has been in force for eight months, with supervisory authorities beginning enforcement activities focused primarily on notification obligations and incident reporting.

Advokatfirman Vinge KB

Adekvansbeslutet för dataöverföringar mellan EU och USA utmanas

The transfer of personal data from the EU to the USA faces renewed scrutiny following a US Supreme Court ruling that grants the President authority to remove Federal Trade Commission members. This development challenges the independence requirements underlying the EU-US Data Privacy Framework and its adequacy decision, potentially jeopardizing the legal basis for transatlantic data transfers that thousands of organizations rely upon.

European UnionPrivacy

Advokatfirman Cederquist KB

The Swedish Data Protection Authority Changes Its Name To The Swedish Authority For Privacy Protection (IMY)

Since 1 January 2021, the Swedish Data Protection Authority, has a new name - the Swedish Authority for Privacy Protection (IMY). IMY is the supervisory authority for matters concerning the...

Foyen Advokatfirma

Ny utredning ska se över regelverket för vårdens behandling av personuppgifter

The Swedish government has initiated an inquiry to review existing regulations on personal data processing in healthcare. The investigation will analyze how current provisions can be updated to meet technological developments while facilitating patient-centered research and maintaining individual privacy protection.

Advokatfirman Cederquist KB

The Territorial Scope Of The GDPR

The territorial scope of the General Data Protection Regulations (the ‘GDPR' or the ‘regulation') is determined within Article 3, adopting two main criteria for this purpose; ‘establishment' and ‘targeting'.

The Klarna Ruling Clarifies The Requirements Surrounding The Obligation To Provide Information According To GDPR

On 11 March 2024, the Stockholm Administrative Court of Appeal handed down a judgement in case 2829-23, establishing that Klarna Bank AB must pay a fine of SEK 7.5 million due to violations...

Europe's Digital Omnibus

In November 2025, the European Commission proposed the Digital Omnibus, which aims to make parts of the EU's digital regulation easier to work with.

Swedish Trading Company Faces Million Euro Fine For Using Meta Pixel

Swedish company in advertently transfers data of up to a million people to Meta. Significant fine imposed. Swedish banking and trading provider, Avanza, was using a so-called Meta pixel on its website and mobile app.