FiS - 13308-22: Difference between revisions
From GDPRhub
(→Facts) |
(→Facts) |
||
| Line 79: | Line 79: | ||
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. | An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. | ||
After three years of inactivity the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months. | After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months. | ||
The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under [[Article 77 GDPR|Article 77 GDPR]] as the complainant in such a case does not have a party status, according to the preparatory work of the Act. | The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under [[Article 77 GDPR|Article 77 GDPR]] as the complainant in such a case does not have a party status, according to the preparatory work of the Act. | ||
Revision as of 14:47, 7 November 2022
| FiS - 13308-22 | |
|---|---|
 | |
| Court: | FiS (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 57(1)(f) GDPR Article 60(8) GDPR Article 77 GDPR Article 78 GDPR § 12 Förvaltningslagen (2017:900) |
| Decided: | 31.10.2022 |
| Published: | |
| Parties: | Spotify RR |
| National Case Number/Name: | 13308-22 |
| European Case Law Identifier: | |
| Appeal from: | IMY (Sweden) |
| Appeal to: | |
| Original Language(s): | Swedish |
| Original Source: | noyb.eu (PDF) (in Swedish) |
| Initial Contributor: | n/a |
The Stockholm Administrative Court held that Swedish law does not deny complainants under Article 77 GDPR to have party status. Consequently, they may demand a decision after six months under Swedish Administrative law. This also applies if the DPA opened a parallel ex officio investigation into a similar matter and the same company.
English Summary
Facts
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify.
After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months.
The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under Article 77 GDPR as the complainant in such a case does not have a party status, according to the preparatory work of the Act.
Holding
The Administrative Court held that in light of recitals 141 and 143 of the GDPR, Article 8 of the CFR, Articles 57(1)(f), 77, and 78 GDPR a complainant has a number of individual rights.
In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22).
A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation.
In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four weeks. The case was referred back to the IMY for reconsideration.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Page 1 (9)
ADMINISTRATIVE COURT JUDGMENT Case no
IN STOCKHOLM 2022-10-31 13308-22
Department 5 Announced in Stockholm
COMPLAINT
[REDACTED]
Agent: Lawyer
COUNTERPART
The Swedish Privacy Protection Authority
OVERRULED DECISION
The Data Protection Authority's decision 2022-05-31, see appendix 1
THE MATTER
Rejected request for case to be settled
_____________________
DECISION OF THE ADMINISTRATIVE COURT
The administrative court approves the appeal and cancels the appealed
the decision and refers the case back to the Privacy Protection Authority for
processing in accordance with what is stated below.
3
3 Visiting address Opening hours Postal address E-mail
4 Tegeluddsvägen 1 Monday–Friday avd31 fst@dom.se
1 08:00–16:00 115 76 Stockholm
. Phone Website
o 08-561 680 00 www.domstol.se/forvaltningsratten-i-
D Stockholm/ Page 2
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
CLAIMS, M.M.
claims that the administrative court must establish that he has standing
as a party to the supervisory case and show the case back to the Privacy Protection Authority
heten (IMY) for review in substance according to § 12 of the Administration Act (2017:900), FL.
He brings forward i.a. following. There is no express legal support in Swedish law for
a complainant shall not have standing as a party to a complaint relating to his or
her rights. This includes i.a. the right of access under Article 15 i
regulation 2016/679/EU on the protection of natural persons with regard to
processing of personal data and on the free flow of such data and
on the repeal of Directive 95/46/EC (hereinafter the data protection regulation or
GDPR). The Court of Appeal in Stockholm has in a judgment on 18 May 2022 in case no. 1426-
22 held that when IMY has initiated supervision due to a complaint, it shall
appellants have the right to appeal IMY's decision in the supervisory matter. On this basis
point of view, he has the right to appeal IMY's future decision in the supervisory matter, and
should he reasonably also be a party during the authority's proceedings.
The assessment that he lacks party status is also not compatible with GDPR and
EU legal principles. According to these, the supervisory authority is obliged to process
and investigate the complaints that each has the right to file, and the complainant
have the right to an effective remedy, i.a. if the supervisory authority fails to
process a complaint. By being denied party status, he does not get the opportunity
to ensure that his affairs are dealt with impartially, fairly and within
reasonable time. In this way, he lacks the opportunity to exercise his rights according to
GDPR, which means that these become ineffective in practice.
He has filed his complaint because he wishes to enforce his own right to
access according to Article 15 of the GDPR and actually receive their personal data from
the relevant personal data controller. This is an individual right which
Doc.Id 1554333 Page 3
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
protected by Article 8.2 of the Charter of the European Union on the fundamentals
the rights.
In accordance with the principle of the autonomy of EU law, the concept of complaint i
the data protection regulation is also interpreted in the light of the data protection regulation
and Article 8 of the EU Charter of Rights and not solely with the support of national
preparatory works. Furthermore, an appellant is described in the preparatory work as the person who appeals
an administrative decision, which was also not the situation when the notification was made
the Austrian supervisory authority.
IMY in and of itself has the opportunity to initiate supervisory matters on its own initiative against
an object of supervision, but by consistently converting complaint cases to
general supervisory matters on IMY's own initiative are undermined by the appellant
possibility to effectively demand their rights according to data protection
the regulation.
IMY claims that the authority fulfills the obligations that follow from article
57.1 in GDPR by the authority handling the complaint in question
the supervisory matter. However, it can be questioned about a procedure with one
general supervisory case where the appellant lacks party status means that IMY
deals with the specific complaint.
Furthermore, the supervisory authority's primary task is to monitor and enforce
the application of the data protection regulation. Article 57.1 f of the GDPR shall be read in
in the light of Article 77 and Article 78 of the GDPR because the procedural rights
which follows from these provisions would lack purpose if there is not one
the corresponding obligation of the regulatory authority to deal with complaints and
inform the complainant of the progress and outcome of the complaint. It means
that the supervisory authority must provide a result for all complaints
which specifies the legal considerations used to e.g. reject
the complaint, in order to constitute a legally actionable act.
Doc.Id 1554333 Page 4
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
It thus follows from EU law that he has the status of a party to the case. According to
the principle of national procedural autonomy gets procedural questions admittedly
regulated by the national law of the Member States, but the regulations must not do
it is impossible or unreasonably difficult to enforce EU law.
IMY considers that the appeal should be rejected and puts forward, among other things, following.
The provision in § 12 FL is not applicable because the appellant lacks standing
as a party to the supervisory case. In the preparatory work, it is clearly stated that an individual does not have
position as a party in a supervisory matter. That would mean a change of
the legal situation to come to a different conclusion in this case.
The fact that the appellant is not granted status as a party in the supervisory matter does not entail
rather that IMY fails in relation to the obligations that follow from article
57.1 in the GDPR, or that the rights that follow from the data protection regulation become
ineffective for those registered. This is because IMY in the current
the review case investigates the complainant's request for access.
Article 78.2 of the GDPR refers to the data subject's right to an effective remedy in that case
the supervisory authority fails to process a complaint. In that IMY i
the current supervisory case investigates the facts of the registered person's complaint
target, the authority has not failed to act. To the extent that IMY arrives at
that the complainant's rights according to the data protection regulation have not been satisfied
can the subject of supervision, through targeted corrective measures in supervisory decisions,
be made to remedy the deficiencies shown by the investigation.
A final decision must be adopted in accordance with Article 60.8 of the GDPR on responsible supervisory
authority has concluded that there is no reason to take measures
taking into account what has been brought forward in the complaint, and that some measures
therefore should not be taken against the object of supervision. Because IMY has not yet
Doc.Id 1554333 Page 5
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
made a decision in the supervisory case, it is not yet clear whether a final decision will be made now
current case will be accepted according to Article 60.8 of the GDPR.
The Court of Appeal decision to which the appellant refers applies to the question
appealability of IMY's decision and does not affect the question of the individual
position in the case.
THE REASONS FOR THE DECISION
Applicable regulations, etc.
Union law
Article 57.1 f of the GDPR states, among other things, that the supervisory authority shall be responsible for
process complaints from a data subject, and where appropriate investigate it
matter to which the complaint applies and inform the individual about it within a reasonable time
how the investigation is progressing and about the outcome, in particular if required
further investigations or coordination with another regulatory authority.
If a complaint is dismissed or rejected, the supervisory authority to which
the complaint was submitted adopt the decision and notify the individual thereof. According to
Article 77 shall every data subject who considers that the processing of personal data
which concerns her or him contravenes the data protection regulation has the right to
file a complaint with a regulatory authority. The supervisory authority to
which the complaint has been submitted must inform the individual about how the work with
the complaint is progressing and what the outcome will be, including the possibility of legal action
examination according to Article 78.
Article 78 of the GDPR states that every natural or legal person shall have the right to one
effective remedy against a legally binding decision concerning those who have
notified by a supervisory authority. Furthermore, every registered person must have the right
Doc.Id 1554333 Page 6
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
to an effective remedy if the competent supervisory authority fails
to process a complaint or to inform the data subject within three months
on how the work on the complaint submitted under Article 77 continues
progress or about its results. Actions against a supervisory authority must be brought at
the courts of the Member State where the supervisory authority has its seat.
National law
Section 12 FL states that if a case that has been initiated by an individual party has not
decided in the first instance within six months at the latest, the party may request in writing
that the authority shall decide the matter. The authority must within four weeks from
on the day such a request was received either decide the case or in a special
decision reject the request.
In the preparatory work for the provision, it is stated i.a. following. The requirement that the case must have
initiated by an individual party means that cases initiated on the authority's own
initiative or on the initiative of another authority is not covered by the provisions
melsen's scope of application. The preparatory work further states that if a supervisory
case has been initiated due to a complaint from an individual is determined
message not applicable because the person who complained in such a case does not get party-
position in the supervisory matter (prop. 2016/17:180 pp. 295-297).
The Court of Appeal in Stockholm has in a ruling on 18 May 2022 in case no
1426-22 came to the conclusion that IMY's decision to close an initiated supervisory case
has been appealable. In the decision, IMY assessed that what was found in
the case did not show that the persons concerned processed personal data through
camera surveillance. The Court of Appeal considered that IMY thereby took a position on
the submitted complaint in substance and that the decision could be assumed to affect it
individual's situation in a not insignificant way.
Doc.Id 1554333 Page 7
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
The assessment of the Administrative Court
In January 2019 filed a complaint with the Austrian
the regulator regarding a company's way of handling his request for
access according to Article 15 of the GDPR. Since IMY is the responsible supervisory
authority in Sweden, the case was handed over there. In light of this and
a number of other complaints directed against the company regarding the right of access began
IMY in June 2019 an inspection of the company's general routines upon request
access. In November 2020, IMY extended the supervision to also cover betting
which existed in three individual complaints, i.a. Rafael Riegler's complaint.
has now submitted a request according to § 12 FL that the case should
be decided. The question in the case is whether he is a party to the supervisory case and whether he has initiated it
the.
Read in the light of paragraphs 141 and 143 of the preamble to the GDPR, Article 8 of the EU
charter of rights as well as the EU Court's statements in the rulings Schrems I and
Schrems II (see Schrems I, C-362/14, EU:C:2015:650 and Schrems II, C-
311/18, EU:C:2020:559) the administrative court finds that Article 57.1 f, Article 77
and Article 78 of the GDPR gives a registered person a number of individual rights.
According to the opinion of the administrative court, the articles and the statements of the European Court of Justice provide
i.a. expression that the competent supervisory authority is obliged to process,
and to an appropriate extent investigate, all complaints regarding the treatment of
personal data submitted by a data subject. Furthermore, each must
complaints that are not granted result in a reasoned decision, against which it
the registered person must have the right to an effective legal remedy (see also Kam-
the appeal in Stockholm's decision on May 18, 2022 in case no. 1426-22).
IMY has brought forward that the current supervisory case has been initiated by IMY on
the authority's own initiative and that it refers to the company's general routines at
Doc.Id 1554333 Page 8
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
access request, although since November 2020 it also includes a
review of i.a. precisely Rafael Riegler's complaint.
The Administrative Court states that IMY must, and may, initiate supervisory cases
on their own initiative, and that registered persons generally do not have the above
said rights or party status solely because their data
appears in a supervisory matter.
however, has filed its complaint to protect and
protect precisely their rights according to the data protection regulation. In such a case
the administrative court considers it incompatible with Union law that the individual,
by not being recognized as a party to the case, will be at a disadvantage
situation, with regard to the various rights ensured by data protection
the regulation than it would otherwise have done. - And this only with
reason why IMY chooses to handle the complaint within the framework of a
supervisory matter which, on an overall level, refers to the supervised company's
general routines. According to the administrative court's opinion is thus
party to the case in so far as it relates to his complaint and the handling of his
personal data.
As regards the question of whether the matter has been initiated by administrative
the court's assessment that he has in any case initiated the part of the case that was initiated
in November 2020 and which includes three individual complaints, one of which is from
him. This also in consideration of the fact that the case of IMY, for other reasons,
started in June 2019.
IMY has thus not had the right to reject the request according to § 12 FL.
The decision must therefore be set aside and the case referred back to IMY for renewal
handling.
Doc.Id 1554333 Page 9
ADMINISTRATIVE COURT JUDGMENT 13308-22
IN STOCKHOLM
HOW TO APPEAL
This decision can be appealed. Information on how to appeal can be found in
appendix 2 (FR-03).
Document ID 1554333
