The CJEU held that orally disclosing personal data is 'processing' and potentially subject to the GDPR + sharing criminal data orally (or in writing) is not allowed to fulfill a public access request.
Following the EU-US DPF, the 🇸🇪 Tax Agency approves using Microsoft Office 365 and Teams. Despite emphasising that everyone must do their own assessments, I'd say this could strengthen your own cloud services assessments.
This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.