View source for FiS - 13308-22

{{COURTdecisionBOX

|Jurisdiction=Sweden
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=FiS
|Court_Original_Name=Förvaltningsrätten i Stockholm
|Court_English_Name=Administrative Court of Stockholm
|Court_With_Country=FiS (Sweden)

|Case_Number_Name=13308-22
|ECLI=

|Original_Source_Name_1=noyb.eu (PDF)
|Original_Source_Link_1=hhttps://gdprhub.eu/images/8/8a/Seiten_aus_Stockholm_FR_13308-22_Dom_2022-10-31.pdf
|Original_Source_Language_1=Swedish
|Original_Source_Language__Code_1=SV
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=31.10.2022
|Date_Published=
|Year=2022

|GDPR_Article_1=Article 57(1)(f) GDPR
|GDPR_Article_Link_1=Article 57 GDPR#1f
|GDPR_Article_2=Article 60(8) GDPR
|GDPR_Article_Link_2=Article 60 GDPR#8
|GDPR_Article_3=Article 77 GDPR
|GDPR_Article_Link_3=Article 77 GDPR
|GDPR_Article_4=Article 78 GDPR
|GDPR_Article_Link_4=Article 78 GDPR
|GDPR_Article_5=
|GDPR_Article_Link_5=
|GDPR_Article_6=
|GDPR_Article_Link_6=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=§ 12 Förvaltningslagen (2017:900)
|National_Law_Link_1=https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/forvaltningslag-2017900_sfs-2017-900
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=

|Party_Name_1=Spotify
|Party_Link_1=https://www.spotify.com/
|Party_Name_2=RR
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=

|Appeal_From_Body=IMY (Sweden)
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The Stockholm Administrative Court held that Swedish law does not deny complainants under [[Article 77 GDPR]] to have party status. Consequently, they may demand a decision after six months under Swedish Administrative law. This also applies if the DPA opened a parallel ex officio investigation into a similar matter and the same company.

== English Summary ==

=== Facts ===
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. 

After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months.

The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under [[Article 77 GDPR|Article 77 GDPR]] as the complainant in such a case does not have a party status, according to the preparatory work of the Act.

=== Holding ===
The Administrative Court held that in light of [[Recitals GDPR|recitals 141 and 143 of the GDPR]], Article 8 of the CFR, [[Article 57 GDPR#1f|Articles 57(1)(f)]], [[Article 77 GDPR|77,]] and [[Article 78 GDPR|78 GDPR]] a complainant has a number of individual rights. 

In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22).

A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation.

In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four weeks. The case was referred back to the IMY for reconsideration.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

<pre>
Page 1 (9)

           ADMINISTRATIVE COURT JUDGMENT Case no

           IN STOCKHOLM 2022-10-31 13308-22
           Department 5 Announced in Stockholm




                       COMPLAINT
                       [REDACTED]


                       Agent: Lawyer

                       COUNTERPART
                       The Swedish Privacy Protection Authority


                       OVERRULED DECISION
                       The Data Protection Authority's decision 2022-05-31, see appendix 1


                       THE MATTER
                       Rejected request for case to be settled
                       _____________________


                       DECISION OF THE ADMINISTRATIVE COURT


                       The administrative court approves the appeal and cancels the appealed

                       the decision and refers the case back to the Privacy Protection Authority for
                       processing in accordance with what is stated below.


3
3 Visiting address Opening hours Postal address E-mail
4 Tegeluddsvägen 1 Monday–Friday avd31 fst@dom.se
1 08:00–16:00 115 76 Stockholm
. Phone Website
o 08-561 680 00 www.domstol.se/forvaltningsratten-i-
D Stockholm/ Page 2

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                           CLAIMS, M.M.



                                            claims that the administrative court must establish that he has standing
                           as a party to the supervisory case and show the case back to the Privacy Protection Authority

                           heten (IMY) for review in substance according to § 12 of the Administration Act (2017:900), FL.


                           He brings forward i.a. following. There is no express legal support in Swedish law for

                           a complainant shall not have standing as a party to a complaint relating to his or

                           her rights. This includes i.a. the right of access under Article 15 i

                           regulation 2016/679/EU on the protection of natural persons with regard to
                           processing of personal data and on the free flow of such data and

                           on the repeal of Directive 95/46/EC (hereinafter the data protection regulation or

                           GDPR). The Court of Appeal in Stockholm has in a judgment on 18 May 2022 in case no. 1426-
                           22 held that when IMY has initiated supervision due to a complaint, it shall

                           appellants have the right to appeal IMY's decision in the supervisory matter. On this basis

                           point of view, he has the right to appeal IMY's future decision in the supervisory matter, and

                           should he reasonably also be a party during the authority's proceedings.


                           The assessment that he lacks party status is also not compatible with GDPR and

                           EU legal principles. According to these, the supervisory authority is obliged to process

                           and investigate the complaints that each has the right to file, and the complainant
                           have the right to an effective remedy, i.a. if the supervisory authority fails to

                           process a complaint. By being denied party status, he does not get the opportunity

                           to ensure that his affairs are dealt with impartially, fairly and within
                           reasonable time. In this way, he lacks the opportunity to exercise his rights according to

                           GDPR, which means that these become ineffective in practice.



                           He has filed his complaint because he wishes to enforce his own right to
                           access according to Article 15 of the GDPR and actually receive their personal data from

                           the relevant personal data controller. This is an individual right which








Doc.Id 1554333 Page 3

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                          protected by Article 8.2 of the Charter of the European Union on the fundamentals

                          the rights.


                          In accordance with the principle of the autonomy of EU law, the concept of complaint i

                          the data protection regulation is also interpreted in the light of the data protection regulation

                          and Article 8 of the EU Charter of Rights and not solely with the support of national
                          preparatory works. Furthermore, an appellant is described in the preparatory work as the person who appeals

                          an administrative decision, which was also not the situation when the notification was made

                          the Austrian supervisory authority.


                          IMY in and of itself has the opportunity to initiate supervisory matters on its own initiative against

                          an object of supervision, but by consistently converting complaint cases to

                          general supervisory matters on IMY's own initiative are undermined by the appellant
                          possibility to effectively demand their rights according to data protection

                          the regulation.



                          IMY claims that the authority fulfills the obligations that follow from article
                          57.1 in GDPR by the authority handling the complaint in question

                          the supervisory matter. However, it can be questioned about a procedure with one

                          general supervisory case where the appellant lacks party status means that IMY

                          deals with the specific complaint.


                          Furthermore, the supervisory authority's primary task is to monitor and enforce

                          the application of the data protection regulation. Article 57.1 f of the GDPR shall be read in
                          in the light of Article 77 and Article 78 of the GDPR because the procedural rights

                          which follows from these provisions would lack purpose if there is not one

                          the corresponding obligation of the regulatory authority to deal with complaints and

                          inform the complainant of the progress and outcome of the complaint. It means
                          that the supervisory authority must provide a result for all complaints

                          which specifies the legal considerations used to e.g. reject

                          the complaint, in order to constitute a legally actionable act.






Doc.Id 1554333 Page 4

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                           It thus follows from EU law that he has the status of a party to the case. According to

                           the principle of national procedural autonomy gets procedural questions admittedly

                           regulated by the national law of the Member States, but the regulations must not do
                           it is impossible or unreasonably difficult to enforce EU law.



                           IMY considers that the appeal should be rejected and puts forward, among other things, following.


                           The provision in § 12 FL is not applicable because the appellant lacks standing

                           as a party to the supervisory case. In the preparatory work, it is clearly stated that an individual does not have

                           position as a party in a supervisory matter. That would mean a change of
                           the legal situation to come to a different conclusion in this case.



                           The fact that the appellant is not granted status as a party in the supervisory matter does not entail
                           rather that IMY fails in relation to the obligations that follow from article

                           57.1 in the GDPR, or that the rights that follow from the data protection regulation become

                           ineffective for those registered. This is because IMY in the current

                           the review case investigates the complainant's request for access.


                           Article 78.2 of the GDPR refers to the data subject's right to an effective remedy in that case

                           the supervisory authority fails to process a complaint. In that IMY i

                           the current supervisory case investigates the facts of the registered person's complaint
                           target, the authority has not failed to act. To the extent that IMY arrives at

                           that the complainant's rights according to the data protection regulation have not been satisfied

                           can the subject of supervision, through targeted corrective measures in supervisory decisions,
                           be made to remedy the deficiencies shown by the investigation.



                           A final decision must be adopted in accordance with Article 60.8 of the GDPR on responsible supervisory

                           authority has concluded that there is no reason to take measures
                           taking into account what has been brought forward in the complaint, and that some measures

                           therefore should not be taken against the object of supervision. Because IMY has not yet








Doc.Id 1554333 Page 5

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                          made a decision in the supervisory case, it is not yet clear whether a final decision will be made now

                          current case will be accepted according to Article 60.8 of the GDPR.


                          The Court of Appeal decision to which the appellant refers applies to the question

                          appealability of IMY's decision and does not affect the question of the individual

                          position in the case.


                          THE REASONS FOR THE DECISION



                          Applicable regulations, etc.


                          Union law


                          Article 57.1 f of the GDPR states, among other things, that the supervisory authority shall be responsible for

                          process complaints from a data subject, and where appropriate investigate it

                          matter to which the complaint applies and inform the individual about it within a reasonable time

                          how the investigation is progressing and about the outcome, in particular if required
                          further investigations or coordination with another regulatory authority.



                          If a complaint is dismissed or rejected, the supervisory authority to which

                          the complaint was submitted adopt the decision and notify the individual thereof. According to
                          Article 77 shall every data subject who considers that the processing of personal data

                          which concerns her or him contravenes the data protection regulation has the right to

                          file a complaint with a regulatory authority. The supervisory authority to
                          which the complaint has been submitted must inform the individual about how the work with

                          the complaint is progressing and what the outcome will be, including the possibility of legal action

                          examination according to Article 78.


                          Article 78 of the GDPR states that every natural or legal person shall have the right to one

                          effective remedy against a legally binding decision concerning those who have

                          notified by a supervisory authority. Furthermore, every registered person must have the right






Doc.Id 1554333 Page 6

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                           to an effective remedy if the competent supervisory authority fails

                           to process a complaint or to inform the data subject within three months

                           on how the work on the complaint submitted under Article 77 continues
                           progress or about its results. Actions against a supervisory authority must be brought at

                           the courts of the Member State where the supervisory authority has its seat.


                           National law



                           Section 12 FL states that if a case that has been initiated by an individual party has not

                           decided in the first instance within six months at the latest, the party may request in writing
                           that the authority shall decide the matter. The authority must within four weeks from

                           on the day such a request was received either decide the case or in a special

                           decision reject the request.


                           In the preparatory work for the provision, it is stated i.a. following. The requirement that the case must have

                           initiated by an individual party means that cases initiated on the authority's own

                           initiative or on the initiative of another authority is not covered by the provisions
                           melsen's scope of application. The preparatory work further states that if a supervisory

                           case has been initiated due to a complaint from an individual is determined

                           message not applicable because the person who complained in such a case does not get party-

                           position in the supervisory matter (prop. 2016/17:180 pp. 295-297).


                           The Court of Appeal in Stockholm has in a ruling on 18 May 2022 in case no

                           1426-22 came to the conclusion that IMY's decision to close an initiated supervisory case
                           has been appealable. In the decision, IMY assessed that what was found in

                           the case did not show that the persons concerned processed personal data through

                           camera surveillance. The Court of Appeal considered that IMY thereby took a position on

                           the submitted complaint in substance and that the decision could be assumed to affect it
                           individual's situation in a not insignificant way.










Doc.Id 1554333 Page 7

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                           The assessment of the Administrative Court



                           In January 2019 filed a complaint with the Austrian
                           the regulator regarding a company's way of handling his request for

                           access according to Article 15 of the GDPR. Since IMY is the responsible supervisory

                           authority in Sweden, the case was handed over there. In light of this and
                           a number of other complaints directed against the company regarding the right of access began

                           IMY in June 2019 an inspection of the company's general routines upon request

                           access. In November 2020, IMY extended the supervision to also cover betting

                           which existed in three individual complaints, i.a. Rafael Riegler's complaint.


                                          has now submitted a request according to § 12 FL that the case should

                           be decided. The question in the case is whether he is a party to the supervisory case and whether he has initiated it
                           the.



                           Read in the light of paragraphs 141 and 143 of the preamble to the GDPR, Article 8 of the EU

                           charter of rights as well as the EU Court's statements in the rulings Schrems I and
                           Schrems II (see Schrems I, C-362/14, EU:C:2015:650 and Schrems II, C-

                           311/18, EU:C:2020:559) the administrative court finds that Article 57.1 f, Article 77

                           and Article 78 of the GDPR gives a registered person a number of individual rights.


                           According to the opinion of the administrative court, the articles and the statements of the European Court of Justice provide

                           i.a. expression that the competent supervisory authority is obliged to process,

                           and to an appropriate extent investigate, all complaints regarding the treatment of
                           personal data submitted by a data subject. Furthermore, each must

                           complaints that are not granted result in a reasoned decision, against which it

                           the registered person must have the right to an effective legal remedy (see also Kam-

                           the appeal in Stockholm's decision on May 18, 2022 in case no. 1426-22).


                           IMY has brought forward that the current supervisory case has been initiated by IMY on

                           the authority's own initiative and that it refers to the company's general routines at






Doc.Id 1554333 Page 8

         ADMINISTRATIVE COURT JUDGMENT 13308-22
         IN STOCKHOLM


                           access request, although since November 2020 it also includes a

                           review of i.a. precisely Rafael Riegler's complaint.


                           The Administrative Court states that IMY must, and may, initiate supervisory cases

                           on their own initiative, and that registered persons generally do not have the above

                           said rights or party status solely because their data
                           appears in a supervisory matter.



                                           however, has filed its complaint to protect and

                           protect precisely their rights according to the data protection regulation. In such a case
                           the administrative court considers it incompatible with Union law that the individual,

                           by not being recognized as a party to the case, will be at a disadvantage

                           situation, with regard to the various rights ensured by data protection
                           the regulation than it would otherwise have done. - And this only with

                           reason why IMY chooses to handle the complaint within the framework of a

                           supervisory matter which, on an overall level, refers to the supervised company's

                           general routines. According to the administrative court's opinion is thus
                           party to the case in so far as it relates to his complaint and the handling of his

                           personal data.



                           As regards the question of whether the matter has been initiated by administrative
                           the court's assessment that he has in any case initiated the part of the case that was initiated

                           in November 2020 and which includes three individual complaints, one of which is from

                           him. This also in consideration of the fact that the case of IMY, for other reasons,
                           started in June 2019.



                           IMY has thus not had the right to reject the request according to § 12 FL.

                           The decision must therefore be set aside and the case referred back to IMY for renewal
                           handling.










Doc.Id 1554333 Page 9

       ADMINISTRATIVE COURT JUDGMENT 13308-22
       IN STOCKHOLM


                      HOW TO APPEAL



                      This decision can be appealed. Information on how to appeal can be found in
                      appendix 2 (FR-03).






















































Document ID 1554333
</pre>