Högsta förvaltningsdomstolen - 4588-23

SAC (Sweden) - 4588-23
Court:	SAC (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 9(1) GDPR Chapter 1, Section 20 of the Basic Law on Freedom of Expression
Decided:	20.06.2024
Published:
Parties:	Verifiera AB Swedish DPA (IMY)
National Case Number/Name:	4588-23
European Case Law Identifier:
Appeal from:	Administrative Court of Appeal of Stockholm Case No 1128-23
Appeal to:	Not appealed
Original Language(s):	Swedish
Original Source:	domstol.se (in Swedish)
Initial Contributor:	Andreea Lisievici

The Supreme Administrative Court ruled that, the GDPR still applies even if the controller’s operation falls under the Swedish Freedom of Expression Act and thus publishing personal health data is prohibited.

English Summary

Facts

The controller, Verifiera AB, operates a database that includes court decisions on psychiatric compulsory care and substance abuse treatment. The controller falls within the area of the Swedish Freedom of Expression Act due to its publication certificate.

The Swedish DPA (“Integritetsskyddsmyndigheten”) issued a reprimand against the controller as the publication of health-related court decisions by the controller violated Article 9(1) GDPR, which prohibits the processing of personal data related to health. It ordered the controller to take certain measures to comply with the GDPR. The DPA took into account there is an exception under the Swedish Freedom of Expression Act, which allowed for the applicability of the GDPR to the controller’s database.

The Administrative Court and the Court of Appeal in Stockholm upheld the DPA's decision.

The controller appealed to the Supreme Administrative Court (“Högsta förvaltningsdomstolen”), arguing that the GDPR did not apply to their database, because their operation falls under the Freedom of Expression Act, which should protect their right to publish the court decisions. They argued that the GDPR should not override these protections.

Holding

Chapter 1, Section 20 of the Freedom of Expression Act states:

“The provisions of this Constitution shall not preclude the enactment of legislation prohibiting the disclosure of personal data

1. revealing ethnic origin, skin colour or other similar characteristics, political opinions, religious or philosophical beliefs or trade union membership
2. concerning health, sex life or sexual orientation, or
3.  which consists of genetic data or biometric data to uniquely identify a natural person.”

The Supreme Administrative Court took into account that the proposal for the amendments of the Freedom of Expression Act (Prop. 2017/18:49) showed that the intention of this provision was that EU regulations must be covered and that therefore EU regulations must be exempted from the scope of application of the constitution. Furthermore, the proposal (see p. 177) specifically states that the GDPR will apply. The Supreme Administrative Court thus held that under the Freedom of Expression Act, Article 9(1) GDPR is a law that prohibits the publication of personal health data.

Consequently, the Court dismissed the appeal, thereby upholding the reprimand issued by the DPA and the lower courts' decisions.

Comment

The decision does not analyse the primacy of EU law and does not conclude that GDPR prevails due to such primacy. In a rather strange twist, the court concludes that Article 9 GDPR prohibits the publication of health data solely because there is a provision in national law, as the Freedom of Expression Act allows for legal provisions limiting the freedom of expression.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

1 (5)


                      HIGHEST

                      ADMINISTRATIVE COURT

                      JUDGMENT


                                                                              Objective No
                                                                              4588-23







                      announced in Stockholm on 20 June 2024

                      COMPLAINT
                      Verify AB, 556926-3394

                      Representative: Lawyer Joakim Sundqvist

                      ASTRA LAWYERS KB
                      Master Samuelsgatan 42
                      111 57 Stockholm

                      COUNTERPART

                      The Swedish Privacy Protection Authority
                      Box 8114
                      104 20 Stockholm

                      APPEAL AGAINST A DECISION
                      The Court of Appeal in Stockholm's judgment of 22 June 2023 in case no. 1128-23


                      THE THING
                      Supervision according to the EU data protection regulation

                      ___________________


                      DECISION OF THE SUPREME ADMINISTRATIVE COURT



                      The Supreme Administrative Court declares that the EU's data protection regulation is a

                      such law prohibiting the publication of personal data referred to in
                      1 ch. Section 20 of the Freedom of Expression Act.



                      The Supreme Administrative Court does not grant leave to appeal in the case in general.

                      The Court of Appeal's ruling therefore stands.


3
9 Visiting address Opening hours Postal address E-mail
3 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
.          Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 4588-23






                        BACKGROUND



                  1. Verifiera AB provides a database that includes court rulings on
                        compulsory psychiatric treatment and treatment of drug addicts. The company has

                        certificate of issue and the business therefore fall as a point of departure within

                        the area of the Freedom of Expression Act.


                  2. It appears from an exception provision in the Freedom of Expression Act that

                        the provisions of the constitution do not prevent regulations from being issued by law

                        prohibition against publication of information about e.g. health.


                  3. According to the EU's data protection regulation, the processing of personal data if

                        health in principle is prohibited.



                  4. The Privacy Protection Authority decided to notify Verifiera of a reprimand

                        and instructed the company to take certain measures so that the services provided
                        in the database would no longer be in conflict with the EU's data protection regulation.

                        The authority believed that the freedom of expression's exception provision

                        means that the data protection regulation is applicable to the database. Being verified

                        provision of court decisions on compulsory psychiatric care and on
                        care of drug addicts was judged to constitute processing of personal data about

                        health contrary to the regulation.



                  5. The Administrative Court in Stockholm and the Court of Appeal in Stockholm agreed on everything
                        essential in the Privacy Protection Authority's assessment and rejected Verified

                        appeals.



                        CLAIMS, M.M.


                  6. Verifiera AB demands that the Supreme Administrative Court change the Court of Appeal's ruling
9
9
3
.
O
D 3 (5)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 4588-23




                        judgment and cancel the Privacy Protection Authority's decision and order that

                        the exception provision in the Freedom of Expression Act does not allow delegation

                        through a regulation other than that which has been announced by the Riksdag.


                  7. The Privacy Protection Authority considers that the appeal should be rejected.



                        THE REASONS FOR THE DECISION


                        The question in the case



                  8. Permits for examination in the Supreme Administrative Court may, according to § 36 a, pre-

                        the Administrative Procedure Act (1971:291) is limited to applying to a certain issue in the case,
                        the examination of which is important for the management of the application of the law (question of precedent).



                  9. The Supreme Administrative Court has issued leave to appeal as regards

                        the issue of the EU's data protection regulation is one such law with a ban on

                        publication of personal data referred to in ch. 1 § 20 freedom of expression
                        the constitution.



                  10. The issue of notification of leave to appeal concerning the case in general has

                        declared dormant.


                        Legal regulation, etc.



                  11. According to ch. 1 Section 3 first paragraph of the freedom of expression foundation is the constitution
                        applicable to broadcasts of programs addressed to the general public and

                        intended to be received with technical aids.



                  12. From the first paragraph of § 4, it appears that the constitution's regulations on broadcasts of

                        program is also applied when information from a database, the content of which can
                        changed only by the person running the business, the public is provided with
9
9
3
.
O
D 4 (5)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 4588-23




                        using electromagnetic waves i.a. by someone who has a certificate of issue for

                        the business according to section 5.



                  13. Section 14 states that an authority or another public body cannot without support i
                        the constitution may intervene against someone because he or she in a program or a

                        technical recording has abused freedom of expression or contributed to one

                        such abuse.


                  14. In section 20, first paragraph, it is stated that the provisions of the constitution do not prevent that in

                        Act, regulations are issued on the prohibition of publication of personal data

                        if i.a. health. According to the second paragraph, the exception in the first paragraph only applies if

                        the personal data is included in a data collection that has been arranged so that it is
                        possible to search for or compile these and that with regard to

                        the business and the forms in which the data collection is kept available

                        there are particular risks of undue intrusion into individuals' personal privacy.



                  15. According to Article 9.1 of Regulation (EU) 2016/679 on the protection of natural persons
                        with respect to the processing of personal data and on the free flow of

                        such data and on the repeal of Directive 95/46/EC (general

                        data protection regulation), the EU's data protection regulation, applies to processing of

                        personal data about health as a starting point is prohibited.


                        The Supreme Administrative Court's assessment



                  16. The exemption provision in ch. 1 Section 20 first paragraph of the Freedom of Expression Basic Law
                        was introduced in 2019 to strengthen the protection of personal integrity in Swedish law

                        (prop. 2017/18:49 p. 145).



                  17. The preparatory work for the provision shows that the intention is that EU

                        regulations must be covered and therefore be able to constitute such regulation as
                        exempted from the scope of application of the constitution, partly because the chosen wording
9
9
3
.
O
D 5 (5)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 4588-23




                        deemed to be sufficiently clear in this regard (prop. 2017/18:49 p. 147 f.).

                        In addition, it is expressly stated that the provision means that the EU's

                        data protection regulation will apply (a. prop. p. 177).


                  18. Furthermore, it can be noted that the term "law" also in other legislative matters has

                        considered to be able to refer to an EU regulation (see e.g. prop. 1999/00:126 p. 135 f.

                        and 272, prop. 2021/22:59 p. 40 and prop. 2022/23:58 pp. 17 and 104).


                  19. Against this background, the precedent question as Supreme

                        the administrative court has issued leave to appeal in is answered so that the EU's

                        data protection regulation is such a law with a ban on publication of

                        personal data referred to in ch. 1 Section 20 of the Freedom of Expression Act.


                  20. The Supreme Administrative Court finds no reason to issue leave to appeal i

                        the goal in general.






                        _______________________ _______________________




                        _______________________ _______________________





                        Justice Henrik Jermsten, Thomas Bull,
                        Per Classon and Marie Jönsson.



                        The rapporteur has been the Secretary of Justice Max Uhmeier.





9
9
3
.
O
D