SAC - 6193-22
| SAC - 6193-22 | |
|---|---|
 | |
| Court: | SAC (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 78(1) GDPR GDPR Recital 141 GDPR Recital 143 The Swedish Data Protection Act Chapter 7, § 3, first paragraph |
| Decided: | 17.11.2023 |
| Published: | 17.11.2023 |
| Parties: | The Swedish DPA IMY |
| National Case Number/Name: | 6193-22 |
| European Case Law Identifier: | |
| Appeal from: | Kammarrätten Stockholm mål nr 2327-22 (17 oktober 2022) |
| Appeal to: | Appealed - Confirmed |
| Original Language(s): | Swedish |
| Original Source: | The Swedish Supreme Administrative Court (in Swedish) |
| Initial Contributor: | Rie Aleksandra Walle |
The Swedish Supreme Administrative Court ruled that the DPA's decision not to investigate a complaint can be appealed.
English Summary
Facts
A data subject filed a complaint against a bank with the Swedish DPA IMY, claiming he was denied access to his personal data. The DPA chose to close the case, explaining that they had informed the bank about the complaint to allow them to evaluate their own processing and rectify any shortcomings.
The data subject appealed to the Administrative Court (Förvaltningsrätten) in Stockholm, but the appeal was dismissed. The court stated that the DPA's decision not to act on his complaint doesn't impact him in a way that qualifies for an appeal.
Subsequently, the data subject took his appeal to the Administrative Court of Appeal (Kammarrätten), which also rejected it. The court argued that the decision did not significantly affect the data subject and was, therefore, not eligible for an appeal under the relevant legal criteria.
Ultimately, the case reached the Supreme Administrative Court (SAC).
Holding
The Supreme Administrative Court (SAC) overturned the decisions of the Administrative Court of Appeal and the Administrative Court, and referred the case back to the Administrative Court for reconsideration.
In their ruling, the SAC cited Article 78(1) GDPR, which pertains to the right to an effective remedy against legally binding decisions made by a DPA. They referred to Recitals 141 and 143, highlighting that a data subject should have access to effective legal remedy at the competent national court against a DPA's decision that legally impacts them. The SAC noted an example from Recital 141, including cases where the DPA dismisses or rejects a complaint, either wholly or partially.
The SAC determined that a decision indicating the DPA's refusal to take the action requested in a complaint should be viewed as a legally binding decision, which is appealable under Article 78(1) GDPR. Therefore, since the data subject's complaint did not result in the desired actions, he is entitled to appeal.
Comment
From initial contributor RAW: IMY has only noted that they'll review the cases in detail.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1 (5)
HIGHEST
ADMINISTRATIVE COURT
JUDGMENT
Objective No
6193-22
announced in Stockholm on 17 November 2023
COMPLAINT
AA
COUNTERPART
The Swedish Privacy Protection Authority
Box 8114
104 20 Stockholm
APPEAL AGAINST A DECISION
The Court of Appeal in Stockholm's judgment on 17 October 2022 in case no. 2327-22
THE THING
Rejected appeal in case of personal data processing
___________________
DECISION OF THE SUPREME ADMINISTRATIVE COURT
The Supreme Administrative Court overrules that of the Court of Appeal and the Administrative Court
rulings and refers the case back to the administrative court for new processing.
BACKGROUND
1. The EU's data protection regulation aims to protect the data of natural persons
fundamental rights and freedoms, especially their right to protection of
personal data. Anyone who considers that a processing of personal data that
refers to her or him contravening the regulation has the right to file a
4
6 Visiting address Opening hours Postal address E-mail
2 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 6193-22
complaint to a regulatory authority. According to the regulation, everyone must also have
right to an effective remedy against the supervisory authority's legal binding
decision or if the supervisory authority e.g. fails to process a complaint.
2. In Sweden, the Data Protection Authority is the supervisory authority in data protection
the area. The authority's decision according to the EU's data protection regulation may be appealed
to the general administrative court.
3. AA has made a complaint to the Swedish Privacy Protection Agency against some
officials at a bank who, according to him, have refused to give him statements like him
have the right to according to the EU data protection regulation. The Swedish Privacy Protection Authority
decided to close the case. In the decision it was stated that the authority sent
information about the complaint to the bank in order to give the bank the opportunity to itself
review its processing of personal data and correct any deficiencies.
4. The administrative court in Stockholm rejected AA's appeal there. As a reason for
the decision stated that the Data Protection Authority's decision not to take any
action in respect of the complaint does not affect him in such a way that
it is appealable.
5. AA appealed the rejection decision to the Court of Appeal in Stockholm.
The Court of Appeal rejected the appeal and stated the following. Applicable
provisions do not contain any explicit regulation of which decisions of
the supervisory authority in complaint cases that must be subject to appeal. The question about
appealability may therefore be assessed in each individual case with an application of
Section 41 of the Administration Act (2017:900). Decisive are the actual effects
the decision gets for the person concerned. The decision has no actual effects in it
meaning that it can be perceived as binding in some respect with the consequence that it
can have effects according to its content and influence other decision-making bodies or
the actions of individuals. The decision therefore does not have the required impact
in accordance with section 41 of the Administrative Act in order for it to be appealable. It can't
3
6
2
.
O
D 3 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 6193-22
rather is perceived as a legally binding decision that actualizes the right to a
effective remedy under the EU Data Protection Regulation.
CLAIMS, M.M.
6. AA pursues its claim.
7. The Privacy Protection Authority considers that the appeal should be rejected.
THE REASONS FOR THE DECISION
The question in the case
8. The question in the case is about the Data Protection Authority's decision not to investigate one
further complaints are appealable.
Legal regulation, etc.
9. From Article 78.1 of Regulation (EU) 2016/679 of the European Parliament and of the Council on
protection of natural persons with regard to the processing of personal data and
on the free flow of such data and on the repeal of directives
95/46/EC (General Data Protection Regulation), the EU's data protection regulation, follows that
every natural or legal person shall have the right to an effective remedy against a
legally binding decisions concerning them issued by a supervisory authority.
10. In ch. 7 Section 3 first paragraph of the Act (2018:218) with supplementary provisions
to the EU's data protection regulation, the Data Protection Act, states that supervisory authorities
the authority's decision according to the EU's data protection regulation may be appealed to the public
administrative court.
3
6
2
.
O
D 4 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 6193-22
The Supreme Administrative Court's assessment
11. The EU Data Protection Regulation came into force on 25 May 2018 and replaced
hence the Personal Data Act (1998:204). There are provisions in the Data Protection Act
which on a general level supplements the regulation.
12. In the preparatory work for the Data Protection Act, the issue of the regulation was discussed
presupposes that the individual must have a general right to appeal against supervisory
the authority's decision to e.g. not take any action due to one
complaint. The government considered that it was unclear whether the regulation means that it
data subjects have the right to appeal the supervisory authority's decision not to act
any action in response to a complaint. Regardless of how the regulation should
interpreted in this respect, however, no constitutional measures were required i
Swedish law. It was instead left to the courts to, through an interpretation
of the Administrative Act's general provisions on appeals, take a position in
the question of whether Swedish jurisprudence is still relevant or whether the regulation has
changed the legal situation (prop. 2017/18:105 p. 164 f.).
13. The right to an effective legal remedy according to Article 78.1 of the EU data protection
regulation applies in respect of legally binding decisions issued by a
supervisory authority. It appears from recitals 141 and 143 in the preamble to the regulation
that the data subject should have the right to an effective legal remedy with the competent authority
the national court against a decision of a supervisory authority that has legal
consequences for this person. Examples include decisions where supervisory
the authority rejects or rejects a complaint in whole or in part.
14. According to the Supreme Administrative Court, this means that a decision whose meaning
is that the Privacy Protection Authority will not do what is requested in one
complaint must be considered a legally binding decision that is subject to appeal
according to Article 78.1 of the EU Data Protection Regulation.
3
6
2
.
O
D 5 (5)
HIGHEST Goal no
JUDGMENT
ADMINISTRATIVE COURT 6193-22
15. AA's complaints to the Swedish Privacy Agency have not led to those of him
the requested measures. It follows from the foregoing that AA has the right to appeal
The Privacy Protection Authority's decision. The Court of Appeal and the Administrative Court
the rulings must therefore be annulled and the case referred back to the administrative court
for new processing.
_______________________ _______________________
_______________________ _______________________
Justice Henrik Jermsten, Thomas Bull,
Marie Jönsson and Magnus Medin.
The rapporteur has been the Secretary of Justice Max Uhmeier.
3
6
2
.
O
D
