International transfers of personal data impose great risk to the fundamental rights of individuals. Equally true however is the fact that international transfers of personal data (as well as other categories of data) are of great value to the global economy and to the business of many European companies. Personal data has to be able to flow freely within the European single market as well as to the rest of the world, but if the fundamental rights which are recognized by the EU are to be taken seriously this simply can’t be the case, there has to be restrictions of some sort. In other words, international transfers have to recognize fundamental rights, or otherwise they can’t occur. The million-dollar question, therefore, is how these two interests can merge. International transfers of personal data are regulated in the general data protection regulation, which is explored in depth in the thesis. The rules of such transfers are quite complex and have of late been vigorously debated. In the center of it all is Maximilian Schrems, who has succeeded in his attempts to tear down the regulation’s popular mechanisms for international transfers, namely Safe Harbour and Privacy Shield. It has successfully been argued that these mechanisms don’t guarantee an adequate level of protection of the fundamental rights of individuals within the EU when their personal data is transferred to the United States. The secret surveillance of the American intelligence agencies imposes to great of a threat to the fundamental rights, which aren’t safeguarded by these mechanisms. The European Court of Justice has in its case law been sympathetic to the criticism of Mr. Schrems and has judged both Safe Harbour and Privacy Shield invalid. In the light of the case law of the court, specifically the Schrems II ruling, international data transfers to the United States are very problematic from a privacy perspective, and I argue that all transfers to all third countries are troublesome as a consequence of Schrems II. If an international transfer is to be carried out to a country which performs secret surveillance (i.e. most countries of the world) the data controller and processor have to guarantee the protection of the rights of the data subject vis-à-vis the state’s surveillance throughout the transfer, otherwise it can’t materialize. This I argue is not possible, which in practice prohibits the possibility for transfers to most countries almost completely. In summary the thesis explores the dynamic relationship between international transfers of personal data and national security. The overriding conclusion is that it is a dysfunctional relationship indeed and that transfers can’t occur to third countries which doesn’t respect fundamental rights. This is the case in general, regardless of what mechanisms are used, what data is to be transferred and what supplementary measures the parties apply.

Sedan GDPR trädde i kraft har skyddet för personuppgifter stärkts och harmoniserats inom EU. GDPR tillförsäkrar fysiska personer en grundläggande rättighet till skydd för personuppgifter. Den som behandlar personuppgifter åläggs ett särskilt ansvar. Enligt huvudregeln är det förbjudet att överföra personuppgifter till tredjeland. För att tredjelandsöverföring ska vara tillåten, krävs att flera undantagsvillkor är uppfyllda. Den som ansvarar för behandling av personuppgifter, och inte uppfyller villkoren, riskerar dels skadeståndsansvar, dels administrativa sanktionsavgifter upp till så mycket som 20 000 000 euro, eller 4 % av den årliga omsättningen. Syftet med uppsatsen är att redogöra för de handlingsalternativ en kommersiell aktör har, för att tredjelandsöverföring av personuppgifter ska vara tillåten, vid lagring av personuppgifter hos molntjänstleverantör. För att besvara syftet har vi analyserat relevant svensk och EU-rättslig reglering, doktrin, praxis samt rekommendationer och riktlinjer utgivna av EDPB. Vi tillämpar en rättsdogmatisk och en EU-rättslig metod, vilket innebär att vi använder de allmänna rättskällorna, som för svensk rätt utgörs av lagar, förarbeten, praxis och doktrin. EU-rättslig praxis på området är begränsat och en betydelsefull dom avkunnades i närtid. Rättsläget efter domen är relativt oprövat. Den som behandlar personuppgifter är personuppgiftsansvarig. För denne föreligger ansvar att säkerställa att skyddet för personuppgifterna upprätthålls om uppgifterna överförs till tredjeland. Vid behandling av personuppgifter via molntjänst finns risk att personuppgifterna överförs till ett tredjeland, utanför den personuppgiftsansvariges kontroll. Om molntjänstleverantören faller under amerikansk jurisdiktion, kan amerikanska myndigheter med stöd av sin interna rätt, under vissa omständigheter, begära ut uppgifter från molntjänstleverantören. Kapitel V i GDPR reglerar ett antal undantag, som en personuppgiftsansvarig kan åberopa vid tredjelandsöverföring. Oavsett vilket verktyg som väljs, och oavsett om alla villkoren uppfylls, så har EU-domstolen genom Schrems II fastställt, att det i mottagarlandet måste finnas en adekvat skyddsnivå för personuppgifter, och att mottagarlandets interna rätt inte får urholka eller undanröja det skydd som säkerställs genom GDPR. Med adekvat skyddsnivå menas ett väsentligt likvärdigt skydd som tillförsäkras av EU-rätten.

The ongoing Covid-19 pandemic has led to society being forced to switch to a digital presence, where physical meetings have been replaced by digital ones. For universities, this has meant that teaching and examinations have taken place through a special installation of the video conferencing service Zoom. Zoom is offered in a so-called on-premises installation which largely runs on private servers or instance, in Denmark. NORDUnet and Sunet are the providers of the special installation which has been given the “Sunet E-meeting”. For the service to work, personal data is processed. This data includes names and e-mail addresses, but also meeting data, gathered by the camera and audio feed, and IP-addresses. All personal data should be processed on the private instance according to the service description. To connect to the service, various options are provided, including installing a client provided by Zoom on a computer or smartphone. Another way to connect that does not require any installation is through a web client, also provided by Zoom.  One of Sweden’s universities recently discovered that a student who joined the meeting via the web client was connected to a public Zoom data center in the United States. Through network analyzes and the study below, it turns out that the web client is a form of exception in the service where traffic does not go directly to the private cloud. Instead, the traffic goes via Zoom's public cloud where traffic is at risk of going to various data centers both outside and within the European Union. This study of the service is based on the data protection legislation. Questions concerning the division of roles and responsibilities between the data controller and the processor, security concerns, the use personal data, processing, and third-country transfers has been done.  Following the Schrems II judgment, where the European Court of Justice ruled that the United States does not have an adequate level of protection regarding the protection of individuals' personal data, the possibilities of transferring personal data to the country were limited. Determining whether the usage of the cloud service means that personal data is transferred to the United States or not is therefore of great importance. This study concludes that a third country transfer has occurred at least once, which is not compatible within the data protection regulation. The study also shows the importance of knowledge of the service being used both by the controller and processor to ensure correct processing of the data.

The number of scandals during the past years regarding the use and misuse of digital storage of personal infor-mation in combination with the implementation of the General Data Protection Regulation (GDPR) within the EU member states, has resulted in a resurfaced discussion of sovereignty within the public sphere in relation to the storage of digital information. This master thesis examines the attitudes towards national data storage of personal data within twenty Swedish public agencies in the context of the analytical term Digital sovereignty.The thesis uses semi-structured interviews with employees working with data protection and qualitative con-tent analysis of internal documents connected to personal data management, in order to examine Swedish govern-ment agencies attitudes towards national data storage of personal information. The responses of the interviews and the internal policy documents in the area of personal data protections is viewed through the analytic term Digital sovereignty. The government agency the Swedish social security agency’s definition of Digital sovereignty is used in the thesis, which focuses on national governments ability to have control over both the technical and geograph-ical processing and storage of their citizen’s personal data.The thesis concludes that Swedish authorities takes the risk of transfer of personal data to third countries outside of the EU very seriously, while they also see the need to find legal ways to transfer personal data to these same countries. The thesis also concludes that Swedish government agencies try to avoid cloud services and are cautious in their use due to the implications they have for information and data security, while other research have shown that cloud services are used extensively within Swedish government agencies. The thesis also concludes that there is a lack of interest in national data storage of personal information within Swedish government, which can partially be attributed to the relationship between the General Data Protections Regulation and data storage regulation on a national level in Sweden. This leads to the final conclusion in this thesis, which is that there is some indication that the future of storage of personal data with the EU member states lies not in nationally managed cloud services, but rather in a federated cloud service on EU-level such as the currently ongoing project Gaia-X. This is a two years master's thesis in Archival science.