Employee monitoring laws in Sweden
Yes, but in a unionised workplace the employer must negotiate with the union before deciding to introduce monitoring — Sweden's co-determination act makes the negotiation a duty that precedes the decision, not a reaction to it.
Who has to agree before you start
The fact that decides the timeline, and the one that differs most between countries.
The workforce must be consulted first
MBL § 11 obliges an employer bound by a collective agreement to initiate negotiation with the union before deciding on an important change to operations or to an employee's working conditions. Introducing monitoring is such a change. The union does not hold a veto, but the employer may not decide before negotiating.
Representatives must be informed and consulted, or negotiated with, before the decision is taken. They cannot block it, but doing it in the wrong order is itself the breach — and in France skipping it is a criminal offence independent of any data-protection issue.
GDPR with the Swedish supplementary data protection act, alongside the Medbestämmandelagen (MBL), which imposes a primary negotiation duty on important changes, and IMY guidance on monitoring at work.
The law that applies in Sweden
Named so you can check us, and so your own counsel has somewhere to start.
| Instrument | What it requires |
|---|---|
| MBL § 11 | Requires the employer to call the union to negotiation on its own initiative before deciding on important changes to operations or working conditions — a duty to negotiate first, distinct from a duty to obtain agreement. |
| MBL § 19 | Obliges the employer to keep the union informed about how operations are developing, which in practice covers the shape and purpose of a monitoring system before the negotiation opens. |
| GDPR Arts. 6(1)(f), 13 and 35 | IMY treats legitimate interests as the realistic basis for employee monitoring, expects a balancing assessment, and expects a DPIA for systematic monitoring; consent is not regarded as freely given in an employment relationship. |
How a rollout is done here
- Establish whether you are bound by a collective agreement — the MBL § 11 duty follows from that, not from union membership levels.
- Call the union to negotiation before the decision is made, with the purpose, the data categories and the retention period settled enough to discuss.
- Document the legitimate-interests balancing assessment; IMY's enforcement focuses closely on whether one was actually done.
- Inform employees under Arts. 13–14 and keep the information available rather than one-off.
- Run the DPIA for systematic monitoring and revisit it when the configuration changes.
What gets a rollout refused
- Deciding first and negotiating afterwards. The MBL duty is a primary one and the sequence is the substance of it.
- Monitoring that is not anchored to a documented purpose; IMY has consistently criticised balancing assessments that were written to justify a decision already taken.
- Relying on consent.
- Assuming a Swedish subsidiary is covered by a group negotiation elsewhere.
Monitoring staff in Sweden — questions
Can the union block the rollout?
No. MBL § 11 is a duty to negotiate before deciding, not a consent requirement — the employer retains the decision. What it cannot do is take the decision before the negotiation, and a failure to negotiate can result in damages.
Does the duty apply if we have no collective agreement?
The § 11 duty attaches to employers bound by a collective agreement. Without one, the negotiation duty is narrower, but the GDPR obligations — lawful basis, balancing assessment, DPIA, transparency — are unchanged.
What does IMY focus on in monitoring cases?
Whether the employer actually carried out and documented a legitimate-interests balancing assessment, whether the monitoring was proportionate to a stated purpose, and whether employees were genuinely informed. Missing documentation is what turns a defensible measure into an enforcement case.
Sources and scope
Primary source: Sweden regulator and statute references, last read 2026-09-17.
This page is a plain-English summary of published law and regulator guidance, not legal advice, and it is not a substitute for advice on your own facts. Employment and data protection law changes; each page states the date its sources were last read. Before monitoring staff anywhere, take advice from qualified counsel in that country.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.