View source for Högsta förvaltningsdomstolen - Mål nr 3691-22

{{COURTdecisionBOX

|Jurisdiction=Sweden
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=SAC (Sweden)
|Court_Original_Name=Högsta förvaltningsdomstolen
|Court_English_Name=Supreme Administrative Court Stockholm
|Court_With_Country=SAC (Sweden)

|Case_Number_Name=Mål nr 3691-22
|ECLI=

|Original_Source_Name_1=Mål nr 3691-22
|Original_Source_Link_1=https://www.domstol.se/globalassets/filer/domstol/hogstaforvaltningsdomstolen/2023/domar-och-beslut/3691-22.pdf
|Original_Source_Language_1=Swedish
|Original_Source_Language__Code_1=SV
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=17.11.2023
|Date_Published=17.11.2023
|Year=2023

|GDPR_Article_1=Article 78(1) GDPR
|GDPR_Article_Link_1=Article 78 GDPR#1
|GDPR_Article_2=
|GDPR_Article_Link_2=
|GDPR_Article_3=
|GDPR_Article_Link_3=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=IMY
|Party_Link_1=https://www.imy.se/
|Party_Name_2=
|Party_Link_2=

|Appeal_From_Body=
|Appeal_From_Case_Number_Name=mål nr 1426-22 (18 may 2022)
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=sh
|
}}

The Swedish Supreme Administrative Court determined that data subjects have the right to appeal decisions that are dismissed or rejected by the Swedish DPA under [[Article 78 GDPR#1|Article 78(1) GDPR]].

== English Summary ==

=== Facts ===
The data subject complained to the Swedish DPA that his neighbors were conducting camera surveillance with cameras aimed at other’s plots and a common access road. The DPA investigated and concluded that the neighbours were not processing personal data. The GDPR was therefore not applicable and the case was closed. 

This decision was appealed by the data subject to Stockholm’s Administrative Court who dismissed the case. It reasoned that that the appealed decision did not affect the data subject in such a way that it is appealable. 

The data subject appealed the rejection to the Stockholm Court of Appeal. The Court of Appeal referred the case back to the Administrative Court. It stated that the Swedish DPA ruled on the substance of the data subject's complaint by rejecting it. The data subject should have an effective remedy under the GDPR. 

This decision by the Court of Appeal was appealed by the Swedish DPA to Stockholm’s Supreme Administrative Court. They argued that while data subjects have the right to an effective legal remedy, the decision to not open a case or close a case do not have any legal effects or significant consequences.

=== Holding ===
The question for the Supreme Administrative Court was whether the Swedish DPA’s decision to close a supervisory case without action is appealable. The court decided that the data subject had the right to appeal. 

The right to an effective judicial remedy before the competent national court when a decision has legal consequences is outlined in [[Article 78 GDPR#1|Article 78(1) GDPR]]. To have legal consequences the complaint must be a legally binding decision and this includes decisions where the authority has dismissed a complaint. 

The same situation will arise as if the complaint case was directly closed without hearing the complaint. To ensure the right to an effective remedy, such a decision must also be considered as a legally binding decision within the meaning of [[Article 78 GDPR|Article 78(1) GDPR.]]

Therefore, the appeal of the Swedish DPA is dismissed and the Court of Appeal’s decision upheld.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

<pre>
1 (6)


                      HIGHEST

                      ADMINISTRATIVE COURT

                      JUDGMENT


                                                                              Objective No
                                                                              3691-22




                      announced in Stockholm on 17 November 2023


                      COMPLAINT
                      The Swedish Privacy Protection Authority
                      Box 8114
                      104 20 Stockholm

                      COUNTERPART

                      AA

                      APPEAL AGAINST A DECISION
                      The Court of Appeal in Stockholm's judgment on May 18, 2022 in case no. 1426-22


                      THE THING
                      Rejected appeal in case of personal data processing

                      ___________________


                      DECISION OF THE SUPREME ADMINISTRATIVE COURT



                      The Supreme Administrative Court rejects the appeal.



















4
6 Visiting address Opening hours Postal address E-mail
2 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (6)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 3691-22




                        BACKGROUND



                  1. The EU's data protection regulation aims to protect the data of natural persons

                        fundamental rights and freedoms, especially their right to protection of
                        personal data. Anyone who considers that a processing of personal data that

                        refers to her or him contravening the regulation has the right to file a

                        complaint to a regulatory authority. According to the regulation, everyone must also have

                        right to an effective remedy against the supervisory authority's legal binding
                        decision or if the supervisory authority e.g. fails to process a complaint.



                  2. In Sweden, the Data Protection Authority is the supervisory authority in data protection

                        the area. The authority's decision according to the EU's data protection regulation may be appealed
                        to the general administrative court.



                  3. AA submitted a complaint to the Swedish Privacy Protection Agency, which acted

                        about his neighbors conducting surveillance with cameras aimed at

                        other people's plots and towards a common access road. privacy
                        the protection authority initiated a supervisory case on the basis of the complaint.

                        The authority then assessed that the investigation in the supervisory case did not show that

                        the neighbors processed personal data through camera surveillance. data protection

                        the regulation was therefore not applicable and the case was therefore closed without it
                        measure.



                  4. The administrative court in Stockholm rejected AA's appeal there. As a reason for

                        the decision stated that the appealed decision did not affect him on such
                        way that it is appealable.



                  5. AA appealed the rejection decision to the Court of Appeal in Stockholm.

                        The Court of Appeal set aside the decision and remanded the case to

                        the administrative court for examination of AA's appeal. The Court of Appeal stated
                        following. The decision in the supervisory case means that the Privacy Protection Authority
2
6
2
.
O
D 3 (6)

     HIGHEST Goal no
     ADMINISTRATIVE COURT JUDGMENT 3691-22




                         has taken a position on AA's complaint on the merits by rejecting it. That is the question

                         such legally binding decision of the regulatory authority in relation to

                         him against which, according to the EU's data protection regulation, he shall have the right to one

                         effective remedy.


                         CLAIMS, M.M.



                   6. The Privacy Protection Authority demands that the Supreme Administrative Court should
                         annul the judgment of the Court of Appeal and confirm the decision of the Administrative Court as well as

                         states the following. The Supreme Administrative Court has previously ruled that

                         The Privacy Protection Authority's decision not to take any action with

                         reason for a complaint is not appealable (RÅ 2010 ref. 29). The question in it
                         now the current case differs from the legal case to the extent that it appealed

                         the decision was made within the framework of a supervisory matter. The complaint case

                         was concluded by a decision in connection with the opening of the supervisory case. Decision

                         on writing off a complaint-based supervisory case and decision not to

                         initiating supervision should, however, be assessed in the same way. Such decisions do not get any
                         legal effects or other significant consequences either for the person who

                         filed the complaint or for anyone else.



                   7. AA considers that the appeal should be rejected.


                         THE REASONS FOR THE DECISION



                         The question in the case


                   8. The issue in the case is about the Data Protection Authority's decision to terminate a

                         supervisory case without action is appealable.





2
6
2
.
O
D 4 (6)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 3691-22






                        Legal regulation, etc.



                  9. From Article 78.1 of Regulation (EU) 2016/679 of the European Parliament and of the Council on
                        protection of natural persons with regard to the processing of personal data and

                        on the free flow of such data and on the repeal of directives

                        95/46/EC (General Data Protection Regulation), the EU's data protection regulation, follows that

                        every natural or legal person shall have the right to an effective remedy against a
                        legally binding decisions concerning them issued by a supervisory authority.



                  10. In ch. 7 Section 3 first paragraph of the Act (2018:218) with supplementary provisions

                        to the EU's data protection regulation, the Data Protection Act, states that supervisory authorities
                        the authority's decision according to the EU's data protection regulation may be appealed to the public

                        administrative court.



                        The Supreme Administrative Court's assessment


                  11. The EU Data Protection Regulation came into force on 25 May 2018 and replaced

                        hence the Personal Data Act (1998:204). There are provisions in the Data Protection Act

                        which on a general level supplements the regulation.


                  12. In the preparatory work for the Data Protection Act, the issue of the regulation was discussed

                        presupposes that the individual must have a general right to appeal against supervisory

                        the authority's decision to e.g. not take any action due to one

                        complaint. The government considered that it was unclear whether the regulation means that it
                        data subjects have the right to appeal the supervisory authority's decision not to act

                        any action in response to a complaint. Regardless of how the regulation should

                        interpreted in this respect, however, no constitutional measures were required i

                        Swedish law. It was instead left to the courts to, through an interpretation

                        of the Administrative Act's general provisions on appeals, take a position in

2
6
2
.
O
D 5 (6)

     HIGHEST Goal no
     ADMINISTRATIVE COURT JUDGMENT 3691-22




                         the question of whether Swedish jurisprudence is still relevant or whether the regulation has

                         changed the legal situation (prop. 2017/18:105 p. 164 f.).



                   13. The right to an effective legal remedy according to Article 78.1 of the EU data protection
                         regulation applies in respect of legally binding decisions issued by a

                         supervisory authority. It appears from recitals 141 and 143 in the preamble to the regulation

                         that the data subject should have the right to an effective legal remedy with the competent authority

                         the national court against a decision of a supervisory authority that has legal
                         consequences for this person. Examples include decisions where supervisory

                         the authority rejects or rejects a complaint in whole or in part.



                   14. According to the Supreme Administrative Court, this means that a decision whose meaning
                         is that the Privacy Protection Authority will not do what is requested in one

                         complaint must be considered a legally binding decision that is subject to appeal

                         according to Article 78.1 of the EU Data Protection Regulation.



                   15. When the Privacy Authority closes a complaint case to initiate
                         a supervisory matter, a position will be taken on the complaint only when the supervisory

                         the case is processed. If the outcome of the supervisory case will subsequently differ

                         from what is requested in the complaint the same situation arises as if

                         the complaint case was immediately closed without the complaint being heard. In order to
                         the right to an effective remedy must not be lost, so must one

                         such decision is considered a legally binding decision according to Article 78(1).



                   16. AA's complaints to the Swedish Privacy Agency have not led to those of him
                         the requested measures. It follows from the foregoing that AA has the right to appeal

                         The Privacy Protection Authority's decision.







2
6
2
.
O
D 6 (6)

    HIGHEST Goal no
                                                      JUDGMENT
    ADMINISTRATIVE COURT 3691-22



                        The Privacy Protection Authority's appeal must therefore be rejected.







                        _______________________ _______________________




                        _______________________ _______________________





                        Justice Henrik Jermsten, Thomas Bull,

                        Marie Jönsson and Magnus Medin.


                        The rapporteur has been the Secretary of Justice Max Uhmeier.































4
6
2
.
O
D
</pre>