Svea Hovrätt - T 10711-21: Difference between revisions

Revision as of 14:46, 13 October 2022

Svea Hovrätt - T 10711-21

Court:	Svea Hovrätt (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 15(3) GDPR Article 57(1)(f) GDPR Article 78 GDPR Article 79(1) GDPR Article 47 EU Charter of Fundamental Rights 10 kap. 19 § rättegångsbalken
Decided:	07.10.2022
Published:	07.10.2022
Parties:	Swedbank AB WN
National Case Number/Name:	T 10711-21
European Case Law Identifier:
Appeal from:	Stockholms tingsrätt T 14908-20
Appeal to:	Unknown
Original Language(s):	Swedish
Original Source:	Svea hovrätt (in Swedish)
Initial Contributor:	S.donner

A data subject can choose to bring their case to civil court even if they have not filed a complaint with the supervisory authority. Data subjects have a right to get access to a voice recording of their own voice. A transcript will not suffice.

English Summary

Facts

The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead.

Holding

The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case.

Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR.

According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data.

In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other rights in the GDPR to apply, for example the right to erasure. A transcript of phone conversations - which they had already obtained - cannot satisfy the right in this regard. Therefore, the data subject had the right to obtain a copy of the bank's recordings of their voice.

Unlike the District Court, the Court of Appeal ruled that there are conditions for obliging the bank to hand over the parts of the audio recordings where the man's voice was heard, but not the parts where the employees' voices were heard. The second person's voice did not in itself constitute personal data with respect to the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

@@ Line 79: / Line 79: @@
 === Facts ===
-A data subject wanted access to the voice recording of his call to a bank. The bank refused access to the voice recording and provided the data subject with access to a transcription of the recording.
+The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead.
 === Holding ===
-.	The supervisory authority does have an obligation to process complaints (according to CJEU Facebook Ireland and Schrems). It is nevertheless clear from the wording of Article 57.1 f GDPR that the authority has a certain amount of freedom to choose in which cases the matter of fact is to be investigated. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from the SA. This suggests that the authority's handling of complaints is not such that it can replace a data subject’s right to bring an action to court. The Court of Appeal's conclusion from the foregoing is that the court is competent to hear the dispute.
+The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of [[Article 57 GDPR|Article 57(1)(f) GDPR]] that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case.
-The data subject's right according to the GDPR is not about him being able to check whether the bank has carried out its risk assessments correctly, but about his interest in his personal data being processed legally and correctly. Article 15.3 of the GDPR on the right to a copy aims to ensure this interest and does not extend beyond that. He is thus entitled to a copy of the personal data in such a form that he can exercise his rights under the GDPR.
+Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. [[Article 15 GDPR|Article 15(3) GDPR]] on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR.
-It follows from case-law that pictures and sounds are personal data (C-212/13 and C-345/17). In line with this a voice is to be deemed as personal data.
+According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data.
-According to Article 15.3 GDPR, the complainant has the right to receive a copy of this personal data. In relation to that personal data, his other rights according to the GDPR also apply, for example the right to erasure. A transcript of the conversations - which he has already obtained - cannot satisfy his right in this regard. He therefore has the right to obtain a copy of the bank's recordings of his voice.
+In line with [[Article 15 GDPR|Article 15(3) GDPR]], the data subject had the right to receive a copy of their personal data as it is a prerequisite for other rights in the GDPR to apply, for example the right to erasure. A transcript of phone conversations - which they had already obtained - cannot satisfy the right in this regard. Therefore, the data subject had the right to obtain a copy of the bank's recordings of their voice.
-The second person's voice does not in itself constitute personal data with respect to the data subject.
+Unlike the District Court, the Court of Appeal ruled that there are conditions for obliging the bank to hand over the parts of the audio recordings where the man's voice was heard, but not the parts where the employees' voices were heard. The second person's voice did not in itself constitute personal data with respect to the data subject.
 == Comment ==