Swedish Tax Agency Pauses Cloud Rollout After Data Protection Criticism

Sweden’s Tax Agency, Skatteverket, has paused further rollout of cloud services while it conducts a deeper legal analysis. The agency had proceeded with US cloud services despite its own data protection officers advising against the implementation, according to Swedish public broadcaster Ekot, which examined the decision-making process.

The officers said an impact assessment prepared by the IT department did not meet GDPR requirements. They pointed, among other things, to the need to assess the risk that foreign authorities could request access to information. Despite their criticism, the agency’s IT director approved the assessment.

Skatteverket handles both confidential information and sensitive personal data in US cloud services. Caroline Olstedt Carlström, a lawyer and chair of Forum för dataskydd, told Ekot she believes there is a high risk that the handling has violated the law. That is her assessment; the agency has begun a deeper legal analysis and has not announced its result.

While that analysis is pending, Skatteverket has paused the continued rollout. The agency declined to be interviewed about the matter.