Half a step behind – bulk disclosure of confidential data in third-party GenAI solutions under the Swedish Public Access to Information and Secrecy Act

Abstract

Technological progress poses unique challenges for the public sector. New technology should be adopted, but it must always be done within the framework of good administration. It follows laws governing public administration must be continuously adapted. Sweden recently amended its secrecy legislation to facilitate the use of third-party cloud solutions by public authorities. When the amendment was enacted, most public sector organisations had already been using external cloud solutions for a long time. Today, there is as much pressure on authorities to implement AI technology as there ever was to move administration into the cloud. This paper uses traditional legal methodology to investigate if the Swedish secrecy legislation adequately enables the use of cloud-based GenAI solutions. Findings indicate that the recent amendment is likely insufficient and that there are significant practical hurdles for the application of the law, particularly with services from global cloud providers. The paper contributes to the understanding of Swedish law, and of the difficulties that can occur anywhere when policy makers and legislators do not move in tandem.