How Swedish data protection law differs from the GDPR