Sweden Media Law Guide

Defamation, Privacy and Data Protection


Ulf Isaksson

Ulf Isaksson

Partner - TIME DANOWSKY Advokatbyrå AB


Defamation and Privacy Law in Sweden

Contributor: Ulf Isaksson (Partner, TIME DANOWSKY Advokatbyrå AB)


The law of defamation in Sweden is contained in Chapter 5 of the Penal Code, with corresponding provisions found in the Swedish constitution, namely Chapter 7 of the Freedom of the Press Act and in Chapter 5 of the Fundamental Law on Freedom of Expression.

Both of these acts grant extra protection to speech included in the types of mass media listed therein, e.g. printed materials such as newspapers, and television. It is not possible for anyone to initiate legal actions involving the right to freedom of speech as it is applied in such mass media other than in those cases and in the manner laid down in these two fundamental laws.

Swedish law addresses defamation under two headings, namely insulting behaviour and defamation. Defamation includes statements in permanent form (cf. libel) or in spoken words (cf. slander).

Insulting behaviour

The crime of insulting behaviour[1] arises when a person vilifies another person by use of an insulting epithet or accusation or by other outrageous conduct towards that person. Insult is defined as “an act exclusively meant to insult or to wound another’s personal sense of honour”. The crime is committed when the statement or conduct is addressed directly to the offended party. Contrary to defamation, the crime of insulting conduct cannot be committed against a deceased person. Insulting conduct may be punished by fine or imprisonment for a maximum period of six months.


Defamation[2] is defined as the communication of information to a third party that is designed to expose a person to the disrespect of others. It is not necessary to prove that the defamatory statement had any particular effect. The essence of the offence lies in a statement which is calculated or suggested to bring contempt onto another person.

For the purpose of the Penal Code, the offence of defamation must be committed against a natural person (living or deceased) and not a company, trade union, association or other society or foundation. Defamation against such organisations may, in some cases, be understood to have been directed against one or a few identifiable members thereof, in which case the offence is committed against such individuals. Defamation against public institutions is sometimes punishable as a crime against the state and if defamation (or insulting behaviour) is offensive towards the head of state of a foreign power who is at that time in Sweden or a representative of a foreign power in Sweden, the offence may – subject to certain additional requirements – be prosecuted.

Publication must be made to a third party (unlike insulting behaviour), and to someone who was previously unaware of the offending statement. Thus, if two persons discuss a rumour about another person which was previously known to both, this would not constitute dissemination of a defamatory statement to a third person under Swedish law.

The publication or dissemination of the defamatory information may take place orally or in writing, through the publication of a drawing, photograph or film, or in some situations, even through conduct designed to insinuate a statement. The notion of “giving information designed to expose a person to the disrespect of others” is subject to an interpretation[3].

As regards defences, the Penal Code provides that no punishment shall be imposed for defamation if the person communicating the statement in question was duty bound to express herself or himself or if, considering the circumstances, the communication of information on the matter in question was “defensible” and if the individual concerned can prove that the information was true or that there were reasonable grounds for believing it to be true[4]. One example of a communication being defensible is where it was made in the public interest.

In addition, criminal liability can be excluded in certain situations where punishment would be unreasonable[5].

On the issue of consequences of a finding of liability, defamation is punishable by a fine. In the case of a “grave” instance of defamation a custodial sentence of up to two years may be imposed[6].  In assessing whether the crime is gross, special consideration shall be given to whether the information, because of its content or the scope of its dissemination or otherwise, was calculated to bring about serious damage.

Damages can be awarded too. The plaintiff can choose if she or he wishes to bring the action as a civil law claim or a criminal law claim. The plaintiff may also combine the two types of actions in one single set of proceedings.

Where a defamatory statement is made in print, or on radio or television or by way of any other mass media protected by the Freedom of the Press Act or the Fundamental Law on Freedom of Expression, the parties can have the issue of guilt tried by a jury.


Acts that are criminal offences of privacy are found in Chapter 4 of the Penal Code. Chapter 4 contains rules and provisions that criminalize violations against private liberty and peace. In addition, and following the Swedish membership of the European Union, the EU General Data Protection Regulation, the GDPR applies in Sweden.

It should be noted that the Freedom of the Press Act and the Fundamental Law on Freedom of Expression restrict legal actions based on the GDPR and Chapter 4 of the Penal Code to disseminations in the types of mass media protected by these fundamental laws.

As to the GDPR, the fundamental laws allow for claims to ban the publication of certain categories of data. A ban can be forwarded against the publication of a data that (a) reveal ethnic origin, political opinions, religious or philosophical conviction or membership of a trade union; health, sex life or sexual orientation; genetic or biometric data, and (b) that relate to the nature of the activities and the forms under which the data collection is made available, entails a particular risk of improper violation of individuals’ personal privacy, and (c) that have been arranged in such a way that it is possible to search for or compile personal data[7].

In case of the criminal offences addressed in Chapter 4 of the Penal Code, the fundamental laws have created an offence of unlawful threat of committing any such offence, as stated in Chapter 4, Section 5 (as to which see also below). Some other offences listed in Chapter 4 may not be applied in freedom of speech cases pursuant to the Freedom of the Press Act or the Fundamental Law on Freedom of Expression[8].

Personal data and its processing under the GDPR

The GDPR applies to wholly or partly automated processing of personal data. In addition, the GDPR applies to processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system[9]. Personal data is defined as all forms of information relating, directly or indirectly, to a natural person[10]. The GDPR covers with only few exceptions practically everything that can be done with personal data, irrespective of whether action is taken through a computer or not. For example, collection, storage, registration and compilation of data constitute processing under the GDPR[11].

Personal data shall be processed lawfully, fairly and in a transparent manner. Processing of personal data is lawful if (a) the person to whom data relates has consented to processing for one or more specific purposes, (b) it is necessary to enable the performance of a contract, (c) it is necessary to comply with a legal obligation, (d) it is necessary to perform a task in conjunction with the exercise of official authority or a duty in the public interest, (e) it is necessary to protect the vital interests of the data subject or of another natural person, or (f) if the legitimate interests of a controller of personal data or a third party ought, on the facts of the case, to be given greater weight than the interest the data subject has in the protection of his personal integrity[12].

Requirements on the controller of personal data
General principles apply to the processing of personal data:

  • Personal data may only be collected for specific, explicitly stated and legitimate purposes and may not be further processed in a manner that is incompatible with those purposes.
  • The processing must be adequate, relevant and limited to what is necessary by reference to the purpose of the processing.
  • Personal data shall be accurate and kept up to date and may not be kept for a longer period than necessary.
  • Personal data shall be processed in a manner that ensures appropriate security and protection against e. g. unauthorised processing and accidental loss[13].

Rights of the data subject

A data subject has the right to obtain a confirmation from the controller as to whether personal data concerning him or her are being processed and if so, to access the personal data[14]. Furthermore, a data subject has a right to have personal data concerning him or her erased[15] or, if the personal data is inaccurate, have it rectified[16].

Damages and criminal liability

In the event that a data subject has suffered material or non-material damage as a result of infringement of the GDPR, the data controller or the processor (a natural or legal person that has processed data on behalf of the controller) may be liable to provide compensation. The data subject may bring a claim for compensation before the national courts[17].

A controller or processor that processes personal data in a way that infringes the GDPR can be imposed an administrative fine of up to 20 million euros or, in the case of an undertaking, 4 per cent of the worldwide annual turnover of the preceding financial year, whichever is higher[18]. Violations of the GDPR do not give rise to criminal liability under Swedish national law.

Rules on Privacy in The Penal Code

Chapter 4 of the Penal Code includes rules on a number of acts that are criminal offences against individuals’ rights to private liberty and privacy. The most relevant provisions are briefly listed and described below.

According to Chapter 4, Section 6a of the Penal Code, it may constitute an offence to photograph a person without their knowledge, if the person being photographed is inside a residence, bathroom, fitting room or similar. This rule on unlawful photographing does not apply to photographs taken while carrying out public authority. Punishment includes a fine or imprisonment for up to two years.

Under some circumstances, it can constitute an unlawful threat under Chapter 4, Section 5 of the Penal Code to spread images that are very sensitive in terms of personal privacy and liable to create fear in that person’s safety, property, liberty or peace. An unlawful threat can result in punishment by way of fine or imprisonment for up to one year. It should be observed that this crime is listed as a freedom of speech offence in the Freedom of the Press Act and in the Fundamental Law on Freedom of Expression. Therefore, an unlawful threat made in a newspaper or in a television programme can be challenged according to the procedural rules that apply for these types of actions, inclusive of a jury trial.

Certain disseminations of images or other information about another person’s sex life or state of health and pictures of another person in a very vulnerable situation can constitute unlawful violation of integrity under Chapter 4, Section 6c of the Penal Code. Punishment includes a fine or imprisonment for up to two years. No punishment shall be imposed if the dissemination was defensible.

Under certain circumstances, the reckless use of another person’s personal data can characterise the offence of molestation according to Chapter 4, Section 7 of the Penal Code and can result in punishment in the form of a fine or imprisonment for up to one year.

Under certain circumstances, a person who repeatedly violates someone’s personal integrity by committing any of the above and/or other offences, can be sentenced to imprisonment for nine months up to six years for gross violation of integrity according to Chapter 4, Section 4a of the Penal Code. In some cases, such violations can constitute unlawful persecution according to Chapter 4, Section 4b of the Penal Code and result in imprisonment for up to four years.

Contributor: Ulf Isaksson (Partner)

Birger Jarlsgatan 15
Box 590
SE-114 11 Stockholm, Sweden

The material in this Guide is for general information only and does not constitute legal advice.

[1] Chapter 5, Section 3 of the Penal Code
[2] Chapter 5, Sections 1 and 2 of the Penal Code
[3] See Swedish Supreme Court rulings in NJA 1992 s 594, NJA 1994 s 637, NJA 2014 s. 808, RH 2002:39 (Svea Court of Appeal) and Svea Court of Appeal’s Judgment of 29 September 2017 in case T 4399-16
[4] Chapter 5, Section 1 of the Penal Code
[5] See NJA 2014 s. 808
[6] The offence of “grave defamation” may be committed where the defamatory statement, due to its content or the scope of its dissemination, is calculated to cause considerable damage to the reputation of the aggrieved party, or where the defendant was aware that the offending information was untrue or groundless or was motivated by a wish to harm the aggrieved party. The author is not aware of any rulings that have included custodial sentences after 1945
[7] See Chapter 1, Article 13 of the Freedom of Press Act, and Chapter 1, Article 20 of the Fundamental Law on Freedom of Expression
[8] See Chapter 7, Article 2 of the Freedom of Press Act, and Chapter 5, Article 1 of the Fundamental Law on Freedom of Expression
[9] Article 2(1) of the GDPR
[10] Article 4(1) of the GDPR
[11] Article 4(2) of the GDPR
[12] Article 6 of the GDPR
[13] Article 5 of the GDPR
[14] Article 15 of the GDPR
[15] Article 17 of the GDPR
[16] Article 16 of the GDPR
[17] Article 82 of the GDPR, see also Chapter 7, Section 1 of the Personal Data Security Act (2018:218)
[18] Article 83 of the GDPR

Our Newsletter