The Administrative Court of Appeal in Stockholm has ruled that SEB and Handelsbanken do not have to give the Swedish Tax Agency (Skatteverket) information about how some of their customers used BankID with other companies and services, including the GPS position and IP address recorded when they logged in.
The court overturned two July 2025 judgments of the Stockholm Administrative Court, which had sided with the tax agency, and annulled the agency’s orders. It found no legal basis for requiring the banks to hand over the data.
“We believe that the law governing the Tax Agency’s ability to obtain such information should be interpreted cautiously, because it concerns an intervention against an individual,” said Fredrik Hammarström, one of the judges in the cases.
Each order carried a fine of 100,000 kronor if the bank did not comply. The agency wanted the time of each BankID use, the type of BankID, the name of the service, the IP address, the hardware ID and the GPS position. The orders covered two SEB customers between 2019 and 2021 and four Handelsbanken customers.
The banks disclosed part of the information but refused to reveal the counterparty, location and IP address when customers had used BankID with someone other than the bank. According to the lower court’s rulings, the agency needed the data for complicated tax cases, including cases involving false invoices, and argued that there was no other way to obtain it, since it could not ask thousands of companies whether a particular person had logged in with them.
The dispute turned on a provision of Sweden’s Tax Procedure Act that lets the agency order a company to provide information about a legal transaction with someone else. The appeals court said the bank itself must be a party to that transaction. It accepted the agency’s view that issuing a BankID and verifying it at each login are transactions involving the bank, but found that the requested data did not concern those transactions.
When a customer logs in, Finansiell ID-Teknik BID AB, the company behind BankID, asks the bank whether the BankID is valid and the bank answers. Where the customer is at that moment is not information about that transaction, the court wrote.
BankID is held by 99.4 percent of registered Swedes aged 18 to 67 and handles an average of 18 million identifications and signatures a day. Each bank was awarded 500,000 kronor toward its legal costs. The rulings can be appealed to the Supreme Administrative Court.
Sources: Sveriges Domstolar, Realtid
–
By the ID Tech Editorial Team
