{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,4]],"date-time":"2025-07-04T05:56:51Z","timestamp":1751608611198,"version":"3.41.0"},"reference-count":51,"publisher":"Association for Computing Machinery (ACM)","issue":"2","funder":[{"name":"Swedish Knowledge Foundation"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digit. Gov.: Res. Pract."],"published-print":{"date-parts":[[2025,6,30]]},"abstract":"<jats:p>Technological progress poses unique challenges for the public sector. New technology should be adopted, but it must always be done within the framework of good administration. It follows laws governing public administration must be continuously adapted. Sweden recently amended its secrecy legislation to facilitate the use of third-party cloud solutions by public authorities. When the amendment was enacted, most public sector organisations had already been using external cloud solutions for a long time. Today, there is as much pressure on authorities to implement Artificial Intelligence technology as there ever was to move administration into the cloud. This article uses traditional legal methodology to investigate whether the Swedish secrecy legislation adequately enables the use of cloud-based GenAI solutions. Findings indicate that the recent amendment is likely insufficient and that there are significant practical hurdles for the application of the law, particularly with services from global cloud providers. The article contributes to the understanding of Swedish law, and of the difficulties that can occur anywhere when policy makers and legislators do not move in tandem.<\/jats:p>","DOI":"10.1145\/3673659","type":"journal-article","created":{"date-parts":[[2024,6,17]],"date-time":"2024-06-17T10:15:39Z","timestamp":1718619339000},"page":"1-9","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Half a Step Behind\u2014Bulk Disclosure of Confidential Data in Third-party GenAI Solutions under the Swedish Public Access to Information and Secrecy Act"],"prefix":"10.1145","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2825-135X","authenticated-orcid":false,"given":"Bj\u00f6rn","family":"Lundell","sequence":"first","affiliation":[{"name":"University of Sk\u00f6vde","place":["Sk\u00f6vde, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1866-713X","authenticated-orcid":false,"given":"Mathias","family":"Lindroth","sequence":"additional","affiliation":[{"name":"University of Sk\u00f6vde","place":["Sk\u00f6vde, Sweden"]},{"name":"ACF Legal International AB","place":["Sk\u00f6vde, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2700-2535","authenticated-orcid":false,"given":"Jonas","family":"Gamalielsson","sequence":"additional","affiliation":[{"name":"University of Sk\u00f6vde","place":["Sk\u00f6vde, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1001-0283","authenticated-orcid":false,"given":"Andrew","family":"Katz","sequence":"additional","affiliation":[{"name":"University of Sk\u00f6vde","place":["Sk\u00f6vde, Sweden"]},{"name":"Bristows LLP","place":["Sk\u00f6vde, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2161-164X","authenticated-orcid":false,"given":"Christoffer","family":"Brax","sequence":"additional","affiliation":[{"name":"Combitech AB","place":["Sk\u00f6vde, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3959-0266","authenticated-orcid":false,"given":"Tomas","family":"Persson","sequence":"additional","affiliation":[{"name":"Digitalist Sweden AB","place":["Stockholm, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8986-8751","authenticated-orcid":false,"given":"Anders","family":"Mattsson","sequence":"additional","affiliation":[{"name":"Husqvarna AB","place":["Huskvarna, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7844-5614","authenticated-orcid":false,"given":"Tomas","family":"Gustavsson","sequence":"additional","affiliation":[{"name":"PrimeKey Solutions AB","place":["Solna, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6745-0853","authenticated-orcid":false,"given":"Jonas","family":"Feist","sequence":"additional","affiliation":[{"name":"RedBridge AB","place":["Stockholm, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8629-0189","authenticated-orcid":false,"given":"Jonas","family":"\u00d6berg","sequence":"additional","affiliation":[{"name":"Scania CV AB","place":["S\u00f6dert\u00e4lje, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,6,15]]},"reference":[{"key":"e_1_3_2_2_1","unstructured":"AI Sweden. 2023a. Collaboration for AI in Municipalities and Civil Society. Retrieved from https:\/\/www.ai.se\/en\/sector-initiatives\/collaboration-ai-municipalities-and-civil-society"},{"key":"e_1_3_2_3_1","unstructured":"AI Sweden. 2023b. My AI: Use Cases. Retrieved from https:\/\/my.ai.se\/usecases"},{"key":"e_1_3_2_4_1","unstructured":"Sam Altman. 2023. Planning for AGI and Beyond. Retrieved from https:\/\/openai.com\/blog\/planning-for-agi-and-beyond"},{"key":"e_1_3_2_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.giq.2018.10.001"},{"key":"e_1_3_2_6_1","volume-title":"Swedish Legal System","author":"Bogdan Michael","year":"2022","unstructured":"Michael Bogdan and Christoffer Wong. 2022. Swedish Legal System, 2nd edition. Norstedts Juridik, Stockholm.","edition":"2"},{"key":"e_1_3_2_7_1","unstructured":"Jacques R. J. Bughin. 2017. The new spring of artificial intelligence: A few early economies. Retrieved from https:\/\/cepr.org\/voxeu\/columns\/new-spring-artificial-intelligence-few-early-economies"},{"key":"e_1_3_2_8_1","unstructured":"Computer Sweden. 2023. Uddevalla kommun bland de f\u00f6rsta med 365 Copilot\u2014\u201ck\u00e4nns coolt.\u201d Retrieved from https:\/\/computersweden.idg.se\/2.2683\/1.780548\/uddevalla-testar-copilot-coolt-att-ha-direktkontakt-med-microsofts-utvecklare"},{"key":"e_1_3_2_9_1","unstructured":"DIGG. 2023. Slutrapport: Uppdrag att fr\u00e4mja offentlig f\u00f6rvaltnings f\u00f6rm\u00e5ga att anv\u00e4nda artificiell intelligens. I2021\/01825 Agency for Digital Government. Retrieved from https:\/\/www.digg.se\/analys-och-uppfoljning\/publikationer\/publikationer\/2023-01-23-slutrapport-uppdrag-att-framja-offentlig-forvaltnings-formaga-att-anvanda-artificiell-intelligens"},{"key":"e_1_3_2_10_1","unstructured":"EC. 2018. Communication from the Commission to the European Parliament the Council the European Economic and Social Committee and the Committee of the Regions: Artificial Intelligence for Europe COM (2018) 237 final 25 April. Retrieved from https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=COM:2018:237:FIN"},{"key":"e_1_3_2_11_1","unstructured":"European Data Protection Board. 2023. 2022 Coordinated Enforcement Action: Use of cloud-based services by the public sector. Retrieved from https:\/\/edpb.europa.eu\/system\/files\/2023-01\/edpb_20230118_cef_cloud-basedservices_publicsector_en.pdf"},{"key":"e_1_3_2_12_1","unstructured":"eSam. 2015. R\u00f6jandebegreppet enligt offentlighets- och sekretesslagen. eSam Dnr. VER 2015-190 17 December."},{"key":"e_1_3_2_13_1","unstructured":"eSam. 2018. R\u00e4ttsligt uttalande om r\u00f6jande och molntj\u00e4nster. eSam Dnr. VER 2018-57 23 October."},{"key":"e_1_3_2_14_1","unstructured":"eSam. 2023. V\u00e4gledning: Utkontraktering \u2013 sekretess och dataskydd. ES2023-06 July. Retrieved from https:\/\/www.esamverka.se\/download\/18.43a3add4188b9f2345a2fe78\/1687332814480\/ES2023-06%20V%C3%A4gledning%20Utkontraktering%20-%20sekretess%20och%20dataskydd.pdf"},{"key":"e_1_3_2_15_1","unstructured":"EU. 2023. Artificial intelligence act: Council and parliament strike a deal on the first rules for AI in the world. Council of the European Union. Retrieved from http:\/\/web.archive.org\/web\/20231215152206\/https:\/\/www.consilium.europa.eu\/en\/press\/press-releases\/2023\/12\/09\/artificial-intelligence-act-council-and-parliament-strike-a-deal-on-the-first-worldwide-rules-for-ai\/"},{"key":"e_1_3_2_16_1","unstructured":"FLI. 2023. Pause giant AI experiments: An open letter future of life institute. Retrieved from https:\/\/futureoflife.org\/wp-content\/uploads\/2023\/05\/FLI_Pause-Giant-AI-Experiments_An-Open-Letter.pdf"},{"key":"e_1_3_2_17_1","first-page":"406","article-title":"M\u00e5ste myndigheter f\u00f6lja lagarna? Om utkontraktering och legalitet i digital milj\u00f6","volume":"2","author":"Furberg Per","year":"2020","unstructured":"Per Furberg and Mikael Westberg. 2020\/21. M\u00e5ste myndigheter f\u00f6lja lagarna? Om utkontraktering och legalitet i digital milj\u00f6. Juridisk tidskrift 2 (2020\/21), 406\u2013417.","journal-title":"Juridisk tidskrift"},{"key":"e_1_3_2_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3300381"},{"key":"e_1_3_2_19_1","unstructured":"HFD. 2011. H\u00f6gsta f\u00f6rvaltningsdomstolens dom M\u00e5l: 99-11. Retrieved from https:\/\/www.domstol.se\/globalassets\/filer\/domstol\/hogstaforvaltningsdomstolen\/avgoranden-2008-2018\/2011\/mal-nr-99-11.pdf"},{"key":"e_1_3_2_20_1","unstructured":"HFD. 2018. H\u00f6gsta f\u00f6rvaltningsdomstolens dom M\u00e5l: 7439-17. Retrieved from https:\/\/www.domstol.se\/globalassets\/filer\/domstol\/hogstaforvaltningsdomstolen\/avgoranden-2008-2018\/2018\/hfd-2018-ref.-48.pdf"},{"key":"e_1_3_2_21_1","unstructured":"JO. 2020. JO: Riksdagens ombudsm\u00e4n (The Parliamentary Ombudsmen) Beslut: Anm\u00e4lan till JO (\u2018Amelia Andersdotter v G\u00f6teborgs Stad\u2019). Dnr. 551-2020 19 March."},{"key":"e_1_3_2_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11846-023-00696-z"},{"key":"e_1_3_2_23_1","volume-title":"F\u00f6rvaltningsr\u00e4ttslig tidskrift","author":"Karlsson Rikard","year":"2021","unstructured":"Rikard Karlsson and Atle Morseth Edvinsson. 2021. Molntj\u00e4nster och staten - En diskussion om r\u00f6jandebegreppet i offentlighets- och sekretesslagen. F\u00f6rvaltningsr\u00e4ttslig tidskrift 5 (2021). https:\/\/www.forvaltningsrattslig.org\/Journals\/Journal\/1566"},{"key":"e_1_3_2_24_1","doi-asserted-by":"publisher","DOI":"10.1093\/oso\/9780198791355.001.0001"},{"key":"e_1_3_2_25_1","article-title":"The future of cloud computing\u2014Part 1: Recent history","volume":"5","author":"Lillard Terrence","year":"2011","unstructured":"Terrence Lillard. 2011. The future of cloud computing\u2014Part 1: Recent history. EE Times, 5 September. Retrieved from https:\/\/www.eetimes.com\/the-future-of-cloud-computing-part-1-recent-history\/","journal-title":"EE Times"},{"key":"e_1_3_2_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-84789-0_5"},{"key":"e_1_3_2_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-15086-9_6"},{"key":"e_1_3_2_28_1","doi-asserted-by":"publisher","DOI":"10.29379\/jedem.v14i2.749"},{"key":"e_1_3_2_29_1","unstructured":"Microsoft. 2023. Link\u00f6pings universitet bland de f\u00f6rsta i v\u00e4rlden att anv\u00e4nda copilot i sin verksamhet. Microsoft 17 November. Retrieved from https:\/\/news.microsoft.com\/sv-se\/2023\/11\/17\/linkopings-universitet-bland-de-forsta-i-varlden-att-anvanda-copilot-i-sin-verksamhet\/"},{"key":"e_1_3_2_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.giq.2021.101596"},{"key":"e_1_3_2_31_1","doi-asserted-by":"publisher","DOI":"10.1177\/09520767231198411"},{"key":"e_1_3_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3632753"},{"key":"e_1_3_2_33_1","unstructured":"Regeringen. 1976. Regeringens proposition 1975\/76:160 om nya grundlagsbest\u00e4mmelser ang\u00e5ende allm\u00e4nna handlingars offentlighet. Regeringen 26 February. Retrieved from https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/proposition\/om-nya-grundlagsbestammelser-angaende-allmanna_fz03160\/"},{"key":"e_1_3_2_34_1","unstructured":"Regeringen. 2017. Hur Sverige blir b\u00e4st i v\u00e4rlden p\u00e5 att anv\u00e4nda digitaliseringens m\u00f6jligheter \u2013 en skrivelse om politikens inriktning. Regeringens skrivelse 2017\/18:47 Regeringen 16 November. Retrieved from https:\/\/data.riksdagen.se\/fil\/62A2B6A0-87F2-4548-9342-E9943467FBBF"},{"key":"e_1_3_2_35_1","unstructured":"Regeringen. 2018. National approach to artificial intelligence. Article no: N2018.36 Regeringen. Retrieved from https:\/\/www.regeringen.se\/contentassets\/cb7f277635ae49bc9a04899c2e1af8cf\/national-approach-to-artificial-intelligence-pa-engelska.pdf"},{"key":"e_1_3_2_36_1","unstructured":"Regeringen. 2019. S\u00e4ker och kostnadseffektiv it-drift f\u00f6r den offentliga f\u00f6rvaltningen. Kommitt\u00e9direktiv Dir. 2019:64 Regeringen 26 September. Retrieved from https:\/\/www.regeringen.se\/rattsliga-dokument\/kommittedirektiv\/2019\/09\/dir.-201964"},{"key":"e_1_3_2_37_1","unstructured":"Regeringen. 2020. Tystnadsplikt vid utkontraktering av teknisk bearbetning eller lagring av uppgifter. Regeringens proposition 2019\/20:201 Regeringen 3 September. Retrieved from https:\/\/data.riksdagen.se\/fil\/CB2FBF0D-3E3C-40B3-8688-82886B0FEE98"},{"key":"e_1_3_2_38_1","unstructured":"Regeringen. 2023a. Sekretessgenombrott vid utl\u00e4mnande f\u00f6r teknisk bearbetning eller teknisk lagring av uppgifter. Regeringens proposition 2022\/23:97 Regeringen 23 March. Retrieved from https:\/\/www.regeringen.se\/rattsliga-dokument\/proposition\/2023\/03\/prop.-20222397"},{"key":"e_1_3_2_39_1","unstructured":"Regeringen. 2023b. F\u00f6rst\u00e4rkt AI-f\u00f6rm\u00e5ga i Sverige. Kommitt\u00e9direktiv Dir. 2023:164 Regeringen 7 December. Retrieved from https:\/\/www.regeringen.se\/rattsliga-dokument\/kommittedirektiv\/2023\/12\/dir.-2023164"},{"key":"e_1_3_2_40_1","unstructured":"Regeringskansliet. 2017. Hur Sverige blir b\u00e4st i v\u00e4rlden p\u00e5 att anv\u00e4nda digitaliseringens m\u00f6jligheter \u2013 en skrivelse om politikens inriktning. Regeringens skrivelse 2017\/18:47 16 November. https:\/\/www.regeringen.se\/rattsliga-dokument\/skrivelse\/2017\/11\/skr.-20171847"},{"key":"e_1_3_2_41_1","unstructured":"Riksdagen. 2023. Riksdagsskrivelse 2022\/23:204. Sveriges Riksdag 31 May. Retrieved from https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/riksdagsskrivelse\/riksdagsskrivelse-202223204_ha0k204\/"},{"key":"e_1_3_2_42_1","doi-asserted-by":"crossref","unstructured":"SFS. 1949. Tryckfrihetsf\u00f6rordning (1949:105). SFS nr: 1949:105 5 April. Retrieved from http:\/\/rkrattsbaser.gov.se\/sfst?bet=1949:105","DOI":"10.1049\/jiee-2.1949.0036"},{"key":"e_1_3_2_43_1","unstructured":"SFS. 2009. Offentlighets- och sekretesslag (2009:400) SFS nr: 2009:400 20 May. Retrieved from https:\/\/rkrattsbaser.gov.se\/sfst?bet=2009:400"},{"key":"e_1_3_2_44_1","unstructured":"SFS. 2020. Lag om tystnadsplikt vid utkontraktering av teknisk bearbetning eller lagring av uppgifter. Svensk f\u00f6rfattningssamling SFS 2020:914 17 November. Retrieved from https:\/\/svenskforfattningssamling.se\/doc\/2020914.html"},{"key":"e_1_3_2_45_1","unstructured":"SFS. 2023. Lag om \u00e4ndring i offentlighets- och sekretesslagen (2009:400). Svensk f\u00f6rfattningssamling SFS 2023:335 2 July. Retrieved from https:\/\/www.svenskforfattningssamling.se\/doc\/2023335.html"},{"key":"e_1_3_2_46_1","unstructured":"Goteborg. 2017. Promemoria avseende Office 365. Stadsledningskontoret G\u00f6teborgs Stad 20 October."},{"key":"e_1_3_2_47_1","unstructured":"Statskontoret. 2023. Good administration in european countries. Statskontoret OOS 47 8 March. Retrieved from https:\/\/www.statskontoret.se\/publicerat\/publikationer\/publikationer-2023\/good-administration-in-european-countries\/"},{"key":"e_1_3_2_48_1","unstructured":"Stockholm. 2021. Underlag f\u00f6r inriktningsbeslut avseende Microsoft 365 och andra molntj\u00e4nster. Dnr KS 2021\/581 Stadsledningskontoret Stockholm Stad 9 December."},{"key":"e_1_3_2_49_1","doi-asserted-by":"publisher","DOI":"10.29379\/jedem.v12i1.593"},{"key":"e_1_3_2_50_1","unstructured":"Voister. 2023. Digitaliseringsministern: V\u00e4nta inte med att implementera AI Voister. Retrieved from https:\/\/www.voister.se\/artikel\/2023\/05\/digitaliseringsministern-vanta-inte-med-att-implementera-ai"},{"key":"e_1_3_2_51_1","unstructured":"Vinnova. 2018. Vinnova Report VR 2018:09 Artificial intelligence in Swedish business and society\u2014Analysis of development and potential. Retrieved from https:\/\/www.vinnova.se\/contentassets\/29cd313d690e4be3a8d861ad05a4ee48\/vr_18_09.pdf"},{"key":"e_1_3_2_52_1","doi-asserted-by":"publisher","DOI":"10.1080\/01900692.2020.1749851"}],"container-title":["Digital Government: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3673659","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,16]],"date-time":"2025-06-16T12:24:00Z","timestamp":1750076640000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3673659"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,15]]},"references-count":51,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2025,6,30]]}},"alternative-id":["10.1145\/3673659"],"URL":"https:\/\/doi.org\/10.1145\/3673659","relation":{},"ISSN":["2691-199X","2639-0175"],"issn-type":[{"type":"print","value":"2691-199X"},{"type":"electronic","value":"2639-0175"}],"subject":[],"published":{"date-parts":[[2025,6,15]]},"assertion":[{"value":"2024-01-30","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-05-26","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-06-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}