Imagine that you, as a safety representative, found out that a foreign intelligence agency had access to every second of driving data about your colleagues – their routes, break times, driving speeds, and exact position around the clock. You would demand answers. You would call for an MBL meeting. You would act immediately. Now is the time – because that scenario is not hypothetical. It is the reality for thousands of Swedish transport workers today.

Every modern transport management system – a TMS – is a machine for personal data. GPS positions are logged second by second, driving times are registered meticulously, performance is measured, and behavior patterns are mapped. It is necessary technology and is neither good nor bad in itself. But the question that neither union representatives nor employers have asked is: where does all this data go?

The legal trap that no one talked about

Swedish data protection is strong on paper. GDPR, MBL, collective agreements, and the Data Inspectorate's rules together create a safety net that employers are obliged to respect. But that safety net has a hole that is exactly the right size for a transatlantic data cable.

A US court – a so-called FISA court – can issue a secret decision that forces a US cloud company to hand over data about its customers. The company is not allowed to tell about it. The customer knows nothing. The employee knows nothing. And the decision applies to data about foreign citizens – that is, exactly you, your colleagues, and the drivers you represent.

Palantir case: Not theory – reality

That this is not an abstract risk was confirmed in a brutal way in May 2026. Internal documents revealed that Palantir Technologies – one of the world's leading companies for intelligence software, with deep ties to the NSA and CIA – had been given virtually unlimited access to sensitive personal data for over 50 million British citizens in the national healthcare system NHS.

Transport data is not patient data – but the principle is identical. The drivers' GPS history is as sensitive as any other behavioral profile. It reveals where a person lives, which terminals they visit, when they take breaks, and how their workweek looks. In intelligence contexts, it is gold.

What the violations mean in practice

The consequences do not only affect integrity. An employer who – regardless of whether he or she knew about it – has handed over control of their employees' personal data to a foreign authority has violated GDPR Art. 5 on the integrity principle and Art. 44–46 on third-country transfers. It is a sanctionable offense. And the safety representative who did not know about the IT architecture cannot have ensured that the risk was considered in the systematic work environment work, in violation of AFS 2001:1.