Högsta förvaltningsdomstolen - 4588-23
| SAC (Sweden) - 4588-23 | |
|---|---|
 | |
| Court: | SAC (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 9(1) GDPR Chapter 1, Section 20 of the Basic Law on Freedom of Expression |
| Decided: | 20.06.2024 |
| Published: | |
| Parties: | Verifiera AB Swedish DPA (IMY) |
| National Case Number/Name: | 4588-23 |
| European Case Law Identifier: | |
| Appeal from: | KamR Stockholm (Sweden) 1128-23 |
| Appeal to: | Not appealed |
| Original Language(s): | Swedish |
| Original Source: | domstol.se (in Swedish) |
| Initial Contributor: | Andreea Lisievici |
The Supreme Administrative Court ruled that Article 9(1) GDPR applies even if the controller’s operation falls under the Swedish Freedom of Expression Act. Thus, the controller was prohibited from publishing health related court decisions in their database.
English Summary
Facts
The controller, Verifiera AB, operates a database that includes court decisions on psychiatric compulsory care and substance abuse treatment. The controller falls within the scope of the Swedish Freedom of Expression Act due to its publication certificate.
The Swedish DPA (“Integritetsskyddsmyndigheten”) issued a reprimand against the controller as the publication of health-related court decisions by the controller violated Article 9(1) GDPR, which prohibits the processing of personal data related to health. It ordered the controller to take certain measures to comply with the GDPR. Although Chapter 1, §7 of the Swedish Data Protection Act, states that the GDPR and the implementing national law shall not apply to the extent that this would conflict, among others, with the Freedom of Expression Act, thus publications using databases developed from publicly available information are not covered by the GDPR. However, the GDPR is still applicable when sensitive data is published in such a database under Chapter 1, §20 of the Swedish Freedom of Expression Act.
Chapter 1, §20 of the Freedom of Expression Act states:
“The provisions of this Constitution shall not preclude the enactment of legislation prohibiting the disclosure of personal data
- revealing ethnic origin, skin colour or other similar characteristics, political opinions, religious or philosophical beliefs or trade union membership
- concerning health, sex life or sexual orientation, or
- which consists of genetic data or biometric data to uniquely identify a natural person.”
Thus, the DPA held that Article 9(1) GDPR is applicable to the controller’s database. Therefore the controller is prohibited from publishing health related court decisions in their database.
The Administrative Court and the Court of Appeal in Stockholm upheld the DPA's decision.
The controller appealed to the Supreme Administrative Court (“Högsta förvaltningsdomstolen”), arguing that the GDPR did not apply to their database, because their operation falls under the Freedom of Expression Act, which should protect their right to publish the court decisions. They argued that the GDPR should not override these protections.
Holding
The Supreme Administrative Court took into account that the proposal for the amendments of the Freedom of Expression Act (Prop. 2017/18:49) showed that the intention of this provision was that EU regulations must be exempted from the scope of application of the constitution. Furthermore, the proposal (see p. 177) specifically states that the GDPR will apply.
The Supreme Administrative Court thus held that under the Freedom of Expression Act, Article 9(1) GDPR is a law that prohibits the publication of personal health data.
Consequently, the Court upheld the reprimand issued by the DPA and the lower courts' decisions. The Court dismissed the other appeal grounds, because there was no prejudicial value identified.
Comment
The decision does not analyse the primacy of EU law and does not conclude that GDPR prevails due to such primacy. The court follows the exact same judgement as the lower instances and concludes that Article 9 GDPR is only applicable because there is a specific provision in the national Freedom of Expression Act allowing for the applicability of other laws that prohibit the publication of specific data categories. There was no room for the court to decide on the primacy issue, only on the question whether the GDPR is considered lex specialis in relation to Chapter 1, Section 20 of the Freedom of Expression Act .
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1 (5)
HIGHEST
ADMINISTRATIVE COURT
JUDGMENT
Objective No
4588-23
announced in Stockholm on 20 June 2024
COMPLAINT
Verify AB, 556926-3394
Representative: Lawyer Joakim Sundqvist
ASTRA LAWYERS KB
Master Samuelsgatan 42
111 57 Stockholm
COUNTERPART
The Swedish Privacy Protection Authority
Box 8114
104 20 Stockholm
APPEAL AGAINST A DECISION
The Court of Appeal in Stockholm's judgment of 22 June 2023 in case no. 1128-23
THE THING
Supervision according to the EU data protection regulation
___________________
DECISION OF THE SUPREME ADMINISTRATIVE COURT
The Supreme Administrative Court declares that the EU's data protection regulation is a
such law prohibiting the publication of personal data referred to in
1 ch. Section 20 of the Freedom of Expression Act.
The Supreme Administrative Court does not grant leave to appeal in the case in general.
The Court of Appeal's ruling therefore stands.
3
9 Visiting address Opening hours Postal address E-mail
3 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
BACKGROUND
1. Verifiera AB provides a database that includes court rulings on
compulsory psychiatric treatment and treatment of drug addicts. The company has
certificate of issue and the business therefore fall as a point of departure within
the area of the Freedom of Expression Act.
2. It appears from an exception provision in the Freedom of Expression Act that
the provisions of the constitution do not prevent regulations from being issued by law
prohibition against publication of information about e.g. health.
3. According to the EU's data protection regulation, the processing of personal data if
health in principle is prohibited.
4. The Privacy Protection Authority decided to notify Verifiera of a reprimand
and instructed the company to take certain measures so that the services provided
in the database would no longer be in conflict with the EU's data protection regulation.
The authority believed that the freedom of expression's exception provision
means that the data protection regulation is applicable to the database. Being verified
provision of court decisions on compulsory psychiatric care and on
care of drug addicts was judged to constitute processing of personal data about
health contrary to the regulation.
5. The Administrative Court in Stockholm and the Court of Appeal in Stockholm agreed on everything
essential in the Privacy Protection Authority's assessment and rejected Verified
appeals.
CLAIMS, M.M.
6. Verifiera AB demands that the Supreme Administrative Court change the Court of Appeal's ruling
9
9
3
.
O
D 3 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
judgment and cancel the Privacy Protection Authority's decision and order that
the exception provision in the Freedom of Expression Act does not allow delegation
through a regulation other than that which has been announced by the Riksdag.
7. The Privacy Protection Authority considers that the appeal should be rejected.
THE REASONS FOR THE DECISION
The question in the case
8. Permits for examination in the Supreme Administrative Court may, according to § 36 a, pre-
the Administrative Procedure Act (1971:291) is limited to applying to a certain issue in the case,
the examination of which is important for the management of the application of the law (question of precedent).
9. The Supreme Administrative Court has issued leave to appeal as regards
the issue of the EU's data protection regulation is one such law with a ban on
publication of personal data referred to in ch. 1 § 20 freedom of expression
the constitution.
10. The issue of notification of leave to appeal concerning the case in general has
declared dormant.
Legal regulation, etc.
11. According to ch. 1 Section 3 first paragraph of the freedom of expression foundation is the constitution
applicable to broadcasts of programs addressed to the general public and
intended to be received with technical aids.
12. From the first paragraph of § 4, it appears that the constitution's regulations on broadcasts of
program is also applied when information from a database, the content of which can
changed only by the person running the business, the public is provided with
9
9
3
.
O
D 4 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
using electromagnetic waves i.a. by someone who has a certificate of issue for
the business according to section 5.
13. Section 14 states that an authority or another public body cannot without support i
the constitution may intervene against someone because he or she in a program or a
technical recording has abused freedom of expression or contributed to one
such abuse.
14. In section 20, first paragraph, it is stated that the provisions of the constitution do not prevent that in
Act, regulations are issued on the prohibition of publication of personal data
if i.a. health. According to the second paragraph, the exception in the first paragraph only applies if
the personal data is included in a data collection that has been arranged so that it is
possible to search for or compile these and that with regard to
the business and the forms in which the data collection is kept available
there are particular risks of undue intrusion into individuals' personal privacy.
15. According to Article 9.1 of Regulation (EU) 2016/679 on the protection of natural persons
with respect to the processing of personal data and on the free flow of
such data and on the repeal of Directive 95/46/EC (general
data protection regulation), the EU's data protection regulation, applies to processing of
personal data about health as a starting point is prohibited.
The Supreme Administrative Court's assessment
16. The exemption provision in ch. 1 Section 20 first paragraph of the Freedom of Expression Basic Law
was introduced in 2019 to strengthen the protection of personal integrity in Swedish law
(prop. 2017/18:49 p. 145).
17. The preparatory work for the provision shows that the intention is that EU
regulations must be covered and therefore be able to constitute such regulation as
exempted from the scope of application of the constitution, partly because the chosen wording
9
9
3
.
O
D 5 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
deemed to be sufficiently clear in this regard (prop. 2017/18:49 p. 147 f.).
In addition, it is expressly stated that the provision means that the EU's
data protection regulation will apply (a. prop. p. 177).
18. Furthermore, it can be noted that the term "law" also in other legislative matters has
considered to be able to refer to an EU regulation (see e.g. prop. 1999/00:126 p. 135 f.
and 272, prop. 2021/22:59 p. 40 and prop. 2022/23:58 pp. 17 and 104).
19. Against this background, the precedent question as Supreme
the administrative court has issued leave to appeal in is answered so that the EU's
data protection regulation is such a law with a ban on publication of
personal data referred to in ch. 1 Section 20 of the Freedom of Expression Act.
20. The Supreme Administrative Court finds no reason to issue leave to appeal i
the goal in general.
_______________________ _______________________
_______________________ _______________________
Justice Henrik Jermsten, Thomas Bull,
Per Classon and Marie Jönsson.
The rapporteur has been the Secretary of Justice Max Uhmeier.
9
9
3
.
O
D
