Swedish court rules on data breach compensation: what counts as harm

The case and the conviction

In 2018, an employee at a Swedish municipality accessed a colleague's confidential files without authorisation.^[1] The files contained mental health records and income information. The employee then disclosed details to others within the organisation.^[1]

The employee was convicted of breach of professional secrecy and ordered to pay damages for the violation of personal integrity.^[1] The question for the Supreme Court was whether the unauthorised disclosure also constituted non-material damage under Article 82 of the GDPR, and if so, what the data subject had to prove to establish harm.^[1]

What the court decided

The Supreme Court held that the disclosure caused non-material damage warranting compensation.^[1] It found that the breach had caused the data subject mental suffering, in the form of worry and distress.^[1]

Crucially, the court stated that a data subject does not need to prove specific consequences, such as changed behaviour, lost opportunities or ongoing psychological effects, to be entitled to compensation.^[1] It is enough that the breach has caused mental suffering that can be regarded as more than trivial.^[1]

The court emphasised that the evidential burden on the data subject is lower when the breach involves highly sensitive data, such as health information.^[1] In such cases, it is often reasonable to assume that the disclosure will cause distress, and the data subject does not have to prove the extent of that distress in detail.^[1]

Why the evidential standard matters

Article 82 of the GDPR gives anyone who has suffered material or non-material damage as a result of an infringement of the regulation the right to compensation.^[2] Non-material damage can include distress, loss of control over personal data and reputational harm.^[2]

The difficulty has always been proof. Mental suffering is not a broken screen or a missed payment. Asking someone to document every hour of worry would set a standard few could meet.

The Swedish court's approach is that the nature of the data shapes what must be shown. When the data disclosed is health information, financial details or other highly sensitive categories under Article 9 of the GDPR, the court can infer that the breach caused distress without requiring the data subject to prove a medical diagnosis or a change in their daily life.^[1]

That matters in two directions. For individuals, it means a claim does not fail simply because the harm is hard to quantify. For organisations, it means that the sensitivity of the data matters as much as the number of people affected.

What this means for you

If your organisation handles health data, income details, trade union membership or other Article 9 categories, consider these questions:

• Who can access what, and how do you track it? Internal breaches are common, and access logs are the first thing asked for. A log its administrator can edit is easy to challenge.
• What would you show if someone claimed unauthorised access? The person affected may not need to prove specific harm, but you will need to show what happened and when.
• Does your breach response plan account for sensitivity, not just scale? A breach affecting three people and involving mental health data can carry more legal weight than a breach affecting three hundred people and involving email addresses.
• Can you demonstrate that your logs are unchanged? Courts and supervisors will ask. Access controls are the foundation. A checkable record is the next step.

How a digital witness fits this case

The question in disputes like this is often what was accessed, by whom and when. A log that the organisation itself keeps can be questioned, particularly when the breach involves someone with administrative rights or when the log is produced months after the event.

Here, the thing to seal is the access log itself, in segments, as it is written.^[3] Say your journal system logs every time someone opens a patient file, a personnel record or a client dossier. Instead of sealing the content, you seal a fingerprint of each log segment at short intervals, for example every few minutes.

The fingerprint is posted to WitniumChain through the REST API, the SDK or the MCP server, and a witness ID is returned. The content stays in your own systems. To check, an auditor, a supervisor or a court calculates the fingerprint again from the log segment you provide and compares it with the sealed one. If they match, the segment is unchanged since it was sealed. Change a single character and it won't match.

Who can check it? Internal audit, the data protection officer, the person affected and, if it comes to it, the court. The sealed fingerprint is a receipt that nobody, not even someone with administrator rights, can rewrite quietly.

What it shows: that the log segment existed at a given time and hasn't changed since.

What it doesn't show: that the log is complete, that every access was lawful, or that the response was adequate. A digital witness is one piece of the evidential picture. It makes the log checkable. It doesn't replace access control, monitoring or a proper breach response.

The first 2,000 witnesses a month are free. Read the documentation at witniumchain.com/docs.

What to watch

The Swedish Data Protection Authority (IMY) has not yet published detailed guidance on evidential standards for non-material damage claims under Article 82, but this judgment will influence how such cases are assessed going forward.^[1]

Across the EU, courts are still working out what counts as compensable harm and what claimants must prove. The European Data Protection Board has not issued unified guidance on Article 82 compensation, so national courts' rulings, like this one, shape the landscape.^[2]

For organisations in sectors where Article 9 data is routine—healthcare, finance, legal services—the judgment is a reminder that sensitivity matters as much as scale, and that the evidential burden falls on both sides. The data subject must show harm. The controller must show what happened.