IMY (Sweden) - DI-2019-11737
From GDPRhub
| IMY - DI-2019-11737 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 4(1) GDPR Article 4(2) GDPR Article 4(4) GDPR Article 4(7) GDPR Article 6 GDPR Article 6(1) GDPR Article 6(1)(f) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 07.11.2019 |
| Decided: | 26.06.2023 |
| Published: | 06.02.2025 |
| Fine: | 13000000 SEK |
| Parties: | Bonnier News AB |
| National Case Number/Name: | DI-2019-11737 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | IMY (in SV) |
| Initial Contributor: | n/a |
The DPA fined a media company SEK 13,000,000 for unlawfully profiling its users in order to target them with behavioral advertising on its website, thus violating Article 6(1) GDPR.
English Summary
Facts
Bonnier News AB (now Expressen Lifestyle), the controller, is a media company in Sweden. The Bonnier group processed their customers' data for, among other reasons, marketing purposes. They compiled profiles on their users and made these available to affiliated companies who then provided targeted advertisements for their own products and services through direct mail and telemarketing. They relied on legitimate interests under Article 6(1)(f) GDPR to do so.
At the time of the investigation,which followed a complaint from a data subject, there were 15 such affiliated companies, with the personal data being collected from users and website visitors being stored in two group-wide data bases from which it was then shared with the affiliate companies. One of these databases was a “behavioral data base”.
The personal data recorded in this database, by means of a cookie identifier, included the URL that the user visited, as well as its category and content type, information on the user’s device and their IP address, behavioral data in terms of time spent and the time the page was viewed and also whether the user logged into the website. In some instances, this data could be linked with the user’s data in the customer data base, resulting in a full behavior profile including the user’s age, gender, their car ownership and some variable based on the users’ residential area, such as their life phase, housing type and purchasing power.
During the course of the investigation, the controller argued that they are not joint controllers in respect of the personal data, and that after the affiliated companies access the data provided in the databases, that they alone are responsible for the legality of that processing.
The controller further argued that while the personal data in the customer database was personal data, the data in the behavioral database was comprised of anonymous data and as such was not personal data under Article 4(1) GDPR.
The controller stated that they rely on legitimate interest as a lawful basis for the profiling of their customers and users to provide personalised advertisements. The controller identified the legitimate interest as being the need to ensure relevant content and advertisements for their customers so that they can offer competitive services and have attractive advertising spaces. The controller also submitted that this interest outweighed the interest of their customers in the protection of their personal data. The controller claimed that such was the case as the customers could object to the profiling, that the customers already have a direct relationship with one (or more) of the affiliates, either from having purchased from their websites or having visited their website, that the processing was unlikely to adversely affect the data subject’s interests as their interaction with the affiliates was voluntary and, finally, that the processing is consistent with the reasonable expectations of the data subjects.
Holding
The IMY (Swedish DPA), after highlighting the fact that Bonnier set up the framework for the accessing of the personal data by the affiliate countries, held that Bonnier News AB was a joint controller in respect of the processing activities. This included the initial collection of the data, the storage of that data in the databases, the profiling of the data subjects and the use of the data for the purposes of customised advertisements and direct marketing.
The IMY further reasoned that as the behavioral data base distinguished users based on cookie identifiers, and the users can be individually identified from them, the behavioral data base constituted personal data.
The IMY then considered the validity of the controller’s reliance on legitimate interest as a lawful basis for the profiling of user data. It was found that the interest being pursued was legitimate, and the processing in question necessary for the pursuit of the interest.
The IMY then turned to assess the balancing of interests. In respect of the making available of completed behavior profiles, it was noted that the overall benefit of the processing was for the controller to generate revenue from advertisements. The IMY disagreed with the controller’s assertion that the processing would be consistent with the reasonable expectations of the data subject, finding that the profiling was extensive in nature and not something which could be reasonably expected without consenting. The IMY thus found that the privacy interests of the data subjects outweighed the interest being pursued by the controller and as such, the controller infringed Article 6(1) GDPR.
With respect to the processing of simple behavioral profiles, allowing for the mapping of individuals through observation and the use of cookies, the IMY again held that the data subject’s interest in privacy outweighs the interests of the controller. The IMY reasoned that the monitoring of data subject behavior to provide targeted advertisements could give the data subject’s the feeling that they are being monitored.
The IMY thus found that the controller had processed personal data for profiling based on behavioral data for the purposes of enabling targeted advertisements without a lawful basis, infringing Article 6(1) GDPR.
The IMY issued a fine of SEK 13,000,000 (€1,157,483.21).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1(29)
Bonnier News AB
105 15 Stockholm
Registration number: Decision after supervision according to
DI-2019-11737
Data Protection Regulation – Bonnier
Date: News AB
2023-06-26
Contents
1. The Swedish Data Protection Authority's decision........................................................................3
2. Statement of the supervision case..................................................................................3
2.1 Description of the group-wide personal data processing..........................................................4
2.1.1 Description of the processing of personal data contained in
the behavior database..................................................................................5
2.1.2 Description of the processing of personal data stored
in the KDB..................................................................................................................6
3. Justification of the decision..................................................................................................8
3.1 IMY's competence..................................................................................................8
3.1.1 Current circumstances.................................................................................8
3.1.2 Applicable provisions etc. ......................................................8
3.1.3 IMY's assessment ................................................................................9
3.2 Bonnier News AB's personal data responsibility..................................................9
3.2.1 Current circumstances and Bonnier News AB's position.........9
3.2.2 Applicable provisions etc. ......................................................9
3.2.3 IMY's assessment ...........................................................................10
3.3 Which data constitutes personal data?..................................................................10
3.3.1 Current circumstances and Bonnier News AB's position...........10
Postal address: 3.3.2 Applicable provisions and other general starting points...10
Box 8114
104 20 Stockholm 3.3.3 IMY's assessment........................................................................12
3.4 The processing constitutes profiling..................................................................13
Website:
www.imy.se 3.4.1 Applicable provisions..................................................................13
E-mail:
imy@imy.se 3.4.2 IMY's assessment..................................................................................13
Telephone:
08-657 61 00 2
3.5 Legal basis for processing for the purpose of displaying customized advertisements based on
data in behavioral database ................................................................................13
3.5.1 Current circumstances and Bonnier News AB's position...........13
3.5.2 Applicable provisions, etc. ...................................................15
3.5.3 Basis for IMY's assessment.................................................17
3.5.4 Legitimate interest ................................................................................19
3.5.5 Is the processing necessary for the legitimate interest?................................19
3.5.6 The balance of interests for the processing of personal data in
supplemented behavioral profiles ..............................................................19
3.5.7 The balance of interests for the processing of personal data in simple
behavioral profiles ..............................................................................21
3.6 Legal basis for processing for the purpose of making contact details available for
telephone sales and direct mail marketing..................................................21
3.6.1 Applicable provisions, etc. .....................................................21
3.6.2 Current circumstances and Bonnier News AB's position...........22
3.6.3 IMY's assessment................................................................................24
3.6.4 Is Bonnier News AB's interest in profiling individuals for the purpose of
making data available to affiliated companies for use in
telephone sales and direct mail marketing justified?................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ and other general starting points....26
3.7.2 Same or connected data processing................................................26
3.7.3 Penalty fee................................................................................................26
Appendix ......................................................................................................28
Copy to................................................................................................................28
4. How to appeal ................................................................................................29 3
1. Decision of the Data Protection Authority
The Data Protection Authority finds that Bonnier News AB (559080-0917) during the
period from 7 November 2019 to 11 June 2020 has processed personal data
without having a legal basis for it according to Article 6(1) of the Data Protection Regulation by
a) processing personal data for the purpose of profiling the data subjects based on
their behavioural data in so-called supplemented behavioural profiles and
making the profiles available to affiliated companies for the purpose of displaying customised
advertisements,
b) processing personal data for the purpose of profile the data subjects based on
their behavioral data in so-called simple behavioral profiles and make the profiles available to affiliated companies for the purpose of displaying customized advertisements,
c) to process personal data by profiling the data subjects based on
their supplemented customer database profiles for the purpose of making
contact details available to affiliated companies for telephone sales and postal
marketing.
The Swedish Data Protection Authority decides, based on Articles 58(2) and 83 of
the Data Protection Regulation, that Bonnier News AB shall pay an administrative
sanction fee of SEK 13,000,000 (thirteen million).
2. Statement of the supervisory case
The Swedish Data Protection Authority (IMY) has, in a supervision of the former Bonnier Magazine and
Brands AB, now Expressen Lifestyle (ref. DI-2019-6523), noted that
Bonnier News AB, together with other companies within the Bonnier Group, processes
personal data for, among other things, marketing purposes based on the legal basis
legitimate interest according to Article 6(1)(f) of the Data Protection Regulation. IMY has initiated supervision of
Bonnier News AB with the aim of investigating whether Bonnier News AB complies
with the requirements of the Data Protection Regulation for the processing of personal data for
marketing purposes.
Within the framework of this supervision, Bonnier News AB has been asked to comment on seven complaints
submitted to IMY regarding various marketing measures taken by companies within the
Bonnier Group. Bonnier News AB has commented on the complaints and it has then emerged
that the marketing measures taken have not been caused by withdrawals from
the group-wide databases nor have they occurred under Bonnier News AB's
personal data responsibility. Against this background, IMY does not find any reason to investigate these complaints further within the framework of
this case.
Within the framework of the supervision, IMY has examined whether Bonnier News AB has a legal basis
according to Article 6 of the Data Protection Regulation for the processing of personal data that takes place in
the group-wide databases for marketing purposes. The supervision
covers the processing of personal data that takes place by creating profiles and
making such data available for use by affiliated companies to
display customized advertisements. It also covers the processing of personal data,
1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
2DI-2018-22602, DI-2019-10121, DI-2019-10513, DI-2019-11057, DI-2019-7484, DI-2019-8104 and DI-2019-9556 4
creation of profiles and making data available to affiliated companies for the purpose of
using them for telephone sales and direct mail marketing.
IMY has not taken a position on whether Bonnier News AB's personal data processing is otherwise in compliance with the Data Protection Regulation.
The supervisory case began with an inspection on 7 November 2019. In connection with IMY sending the inspection report to Bonnier News AB, IMY asked the company additional questions on 20 December 2019. Bonnier submitted comments on the inspection report and submitted responses to IMY's questions on 14 February 2020. On 15 May 2020, IMY asked further additional questions to Bonnier News AB, to which the company submitted responses on 11 June 2020. Due to Bonnier News AB having updated its personal data policy, the company submitted additional information on 21 July 2020. Bonnier News AB has commented on IMY's draft decision on 13 April 2023. Since the case concerns cross-border processing, IMY has used the mechanisms for cooperation and consistency contained in Article 56 and Chapter VII of the
Data Protection Regulation. The supervisory authorities concerned have been the authorities in
Denmark, Estonia, Finland, Norway and Germany.
2.1 Description of the group-wide
personal data processing
The following has emerged during the inspection and subsequent correspondence. Within
the Bonnier Group, there is a collaboration between Bonnier News AB and a number of affiliated
companies that are part of the group (the affiliated companies). Which companies are affiliated
changes over time. At the time of the inspection, there were 15 affiliated companies, which
drew to 8 during the spring of 2020. The processing of personal data that takes place within
the framework of the collaboration is limited to the affiliated companies' customers on the
Swedish market. The affiliated companies collect personal data from their customers
and people who visit the companies' websites. The collected data is transferred
to two group-wide databases, a customer database (KDB) and a behavior database (the behavior database). In these databases, profiles of individuals are created. The profiles are also linked to information obtained from Bisnode Sverige AB.
Bonnier News AB has stated that it stores collected data in the
group-wide databases for the following purposes:
• To establish a common customer register for affiliated companies with good
data quality, which includes compiling customer and
user data and checking that the data is correct,
updated and appropriate
• To offer the affiliated companies' customers an easy way to exercise their
rights and an opportunity to ask questions about personal data to the
joint customer service
• To make personal data available to affiliated companies for the purpose of:
• Using the contact information of other affiliated companies in order to
market the affiliated companies' own products and services
through direct mail marketing and telephone sales. 5
• Displaying customized content and customized advertisements in the affiliated
companies' digital services, based on the customers' and users'
customer profiles and behavior on the affiliated companies' websites.
• Perform analysis of customer data in order to use the customer insight obtained
to conduct customer communication, marketing of its own products,
services and service.
• Perform analysis of customer data in order to improve and develop existing
services and products.
The personal data processing that takes place for the purpose of adapting affiliated companies'
advertisements is based on data saved in the behavioral database. The
personal data processing that takes place to disclose personal data to affiliated companies
for use in telephone sales and direct mail marketing is based on data in the KDB.
2.1.1 Description of the processing of personal data contained in
the behavioral database
The investigation into the case reveals the following.
The data contained in the behavioral database is processed for the purpose of displaying customized
content and customized advertisements in the affiliated companies' digital services.
When an individual visits an affiliated company's website, the affiliated company collects information about the individual's surfing behavior. This is done by
the affiliated company having placed a script on its website that requests to save a
text file (cookie) on the visitor's computer, tablet or mobile phone. The information in the
cookie can be used to track the user's surfing on the website. The
information (behavioral data) that is collected when the individual surfs and then transferred to the
behavioral database and added to the individual's profile is:
• Information about the URL (web address) of the page visited, its category and a
content tag.
• Information about the user's device type on which the page was viewed,
the browser type and the part of the user's IP address that refers to the country,
• Information about behavior in the form of time spent and time of
the page view,
• Information about a unique randomly generated cookie value (hereinafter
referred to as the cookie identifier),
• Information about whether the page was viewed in logged-in mode.
Bonnier News AB discards the cookie identifier after 30 days and from day
31 the generated behavioral data is no longer used to adapt advertisements to individuals.
Data in the behavioral database and in the KDB can in some cases be linked together.
3A content tag is a description of the content that has been consumed in the participating companies' services. Bonnier
News AB collects two types of tags, predefined according to the IAB (The Interactive Advertising Bureau) standard and
tags produced by the affiliated companies' editorial departments. 6
When the data in the behavioral database cannot be linked with data in the KDB
the data subject's behavioral profile consists only of the data specified above, a
profile that in this decision will be referred to as a simple behavioral profile.
In cases where data in the behavioral database and data in the KDB can be linked together in the behavioral database, data from the KDB on purchase history, gender, age, household additional ownership and postal code, as well as statistical variables based on the individual's residential area such as life stage, purchasing power and housing type are added to the behavioral database. These profiles will hereinafter be referred to in this decision as supplemented behavioral profiles. The data is made available to affiliated companies through a search tool linked to the behavioral database, where the affiliated company can order a segment of customer data based on its chosen variables. An administrator checks whether the order meets certain criteria determined within the collaboration. If so, the affiliated company is given access to a code that makes it possible to target advertisements to users who are included in the segment. The affiliated companies can only retrieve data from the behavioral database based on behavioral data collected from the company's own digital services. This applies regardless of whether it is a simple or supplemented behavioral profile. However, the supplemented behavioral profile may also contain purchase history from other affiliated companies. In the KDB, data is filtered after two years, which is why data older than that cannot be linked to the behavioral database or disclosed to affiliated companies. 2.1.2 Description of the processing of personal data stored in the KDB The investigation into the case reveals the following. The data about individuals in the KDB is processed for the purpose of being used for affiliated companies' marketing of their own products and services through direct mail and telephone sales. When an individual makes a purchase or signs up for a subscription, the affiliated company that has a contractual relationship with the customer collects data from them. Some of this data is transferred to the KDB. In the KDB, information is linked to a profile. In the KDB, the customer profile is assigned a KDB ID. If the affiliated company's customer is already
registered in KDB, the existing customer profile is updated/supplemented with the new
engagement. Otherwise, a new customer profile is created with a new KDB ID. The information
stored in KDB and collected from the customer's contact with the affiliated
company is name, address, telephone number, personal identification number, email address and information
linked to the customer's purchase, such as product category, brand, type of
packaging (whether it is a digital or traditional product and whether it is a free or
paid product). The KDB also records whether the customer has objected to the use of information in
KDB for marketing purposes and information whether the customer has registered in the so-called
NIX register. There are restrictions for the following categories of information:
• Information about email addresses is not disclosed to affiliated companies in the case of
telephone sales and direct mail marketing.
• Personal identification number information is only used to check whether the customer has
registered to oppose marketing in the NIX register (NIX blocking) and
to check that the customer is not deceased.
• Personal identification number information is not made available to the affiliated companies. 7
In addition to the information collected by the affiliated companies, Bonnier News
AB collects information from Bisnode Sverige AB for the purpose of checking and supplementing
individuals' contact information, and to provide statistical data such as life stage, purchasing power
and housing. Furthermore, information on car ownership and on deceased persons is collected
as well as information on a so-called GEDI-id (which is a unique identifier in the form of a
pseudonymized ID).
Information in the KDB and the behavioral database can in some cases also be linked in the KDB.
The profile then constitutes what in this decision will be referred to below as a supplemented
customer database profile. This is done by a customer of an affiliated company visiting
the company's website and logging into their account with the company. The behavioral data that has been
collected about the customer and that is linked to a cookie identifier can then, under certain conditions, be linked with the customer's KDB ID. In cases where the customer's KDB ID and the cookie value can be linked, the KDB profile is supplemented with
information collected over the past 30 days from the behavioral database. The information
that is retrieved is information about which websites the customer has visited, which section
of the website the customer has visited (so-called content tags), and which device type
the customer has surfed from. Bonnier News AB has limited the type of content tags that companies other than the one whose website the individual surfed can base their profiling on
4
for the purposes of telephone sales and direct mail marketing.
When a person ceases to be a customer of an affiliated company, KDB is notified that
the customer's engagement has ceased and the customer is flagged as a passive customer. The customer's data is then deleted
in KDB after two years. Data obtained from the behavioral database
is filtered after 30 days. Any NIX blocking is always activated when
contact data in KDB is made available to customers of other affiliated companies and contact data to own customers when these have been passive for 12 months.
Data is made available to affiliated companies upon request through an application in KDB.
A selection file is created in KDB based on the criteria specified by the affiliated company. Within the framework of
the collaboration, something called purpose-adapted schedules are applied. These regulate what information is disclosed from KDB. When disclosed, only the data points defined as necessary for the marketing channel specified at the time of disclosure are disclosed, i.e., for example, telephone numbers in a telephone sales campaign and addresses in postal direct marketing. The data points on which the segmentation is based are not disclosed. The data is made available through an interface in KDB to the affiliated company.
The data subject has the option of requesting deletion from KDB. The data subject also has the right to object to the use of the data for telephone sales and postal direct marketing.
Bonnier News AB has stated that all affiliated companies are majority-owned by Bonnier Group AB and subject to the Bonnier Group's framework for personal data processing
and that only a small portion of the profiles in question have been able to be linked to data in the behavioral database.
4Only tags categorized with the IAB taxonomy are collected. 8
3. Justification of the decision
3.1 IMY's authority
3.1.1 Current circumstances
Some of the personal data processed within the group-wide
cooperation has been collected by affiliated companies placing a cookie on the
visitor's computer, tablet or mobile phone. Bonnier News AB has stated that
the collection is done through affiliated companies' websites. The affiliated companies then transfer
this information to the behavioral database and in some cases the information is also linked
with profile information in KDB. Bonnier News AB has stated that the obligations that followed from the provisions of the Electronic Communications Act (2003:389) and now follow from the Electronic Communications Act (2022:482) (LEK), affect affiliated companies and not Bonnier News AB since it is the companies that are responsible for the actual collection of the data.
3.1.2 Applicable provisions, etc.
It follows from Article 95 of the Data Protection Regulation that the Data Protection Regulation shall not entail any additional obligations for natural or legal persons who process personal data, for areas that are already covered by obligations in accordance with the so-called eData Protection Directive. The eData Protection Directive has been implemented in Swedish law through the LEK, which, among other things, regulates the collection of data through cookies.
According to Chapter 9 Section 28 of the LEK states that data may be stored in or retrieved from a subscriber's or user's terminal equipment only if the subscriber or user is given access to information about the purpose of the processing and consents to it. It is further stated that this does not prevent such storage or access that is necessary to transmit an electronic message via an electronic communications network or that is necessary to provide a service that the user or subscriber has expressly requested. Before 1 August 2022, when the LEK came into force, the corresponding requirements were set in accordance with Chapter 6, Section 18 of the Electronic Communications Act (2003:389). The Swedish Post and Telecom Agency (PTS) is the supervisory authority under the LEK (Chapter 1, Section 5 of the Electronic Communications Ordinance [2022:511]). The EDPB has issued an opinion on the interaction between the ePrivacy Directive and the 6th General Data Protection Regulation. The opinion states, among other things: that the national supervisory authority designated under the ePrivacy Directive is solely competent to monitor compliance with the Directive. However, the supervisory authority under the Data Protection Regulation is the competent supervisory authority for processing not specifically regulated in the ePrivacy Directive. If only part of the processing falls under the ePrivacy Directive, this does not limit the competence of the data protection authority to examine other parts of the processing under the Data Protection Regulation. 7
This means, among other things, that the supervisory authority under the Data Protection Regulation is competent to assess the lawfulness of the processing of personal data that takes place after the data has been retrieved from the individual's terminal equipment, such as the storage of retrieved
5Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).
6Opinion 5/2019 on the interaction between the Directive on privacy and electronic communications and the General Data Protection Regulation, in particular as regards the competence, tasks and powers of data protection authorities,
adopted on 12 March 2019
7See paragraphs 68 and 69 of the Opinion. 9
data and analysis of such data for the purposes of behavioural advertising
8
online.
3.1.3 IMY's assessment
The data added to the behavioural database has been collected by the affiliated companies
through cookies. The personal data processing examined in this supervisory case
is Bonnier News AB's subsequent processing of personal data in the behavioural database. That processing is not covered by the regulation in LEK or the
previously applicable regulation in the Act on (2003:389) on electronic communications.
This means that the regulations in the Data Protection Regulation apply to the processing and that IMY is the competent supervisory authority.
3.2 Bonnier News AB's personal data responsibility
3.2.1 Current circumstances and Bonnier News AB's position
It is Bonnier News AB's opinion that Bonnier News AB and the respective affiliated
company have a joint personal data responsibility for the processing that takes place in the KDB
and the behavioral database for the purposes stated above as common.
Furthermore, Bonnier News AB has stated that Bonnier News AB and affiliated companies have a
common view of purposes and means and that Bonnier News AB has entered into a so-called Joint
Data Controller Agreement with the affiliated companies in accordance with Article 26(2) of the
GDPR.
Bonnier News AB has stated that each affiliated company has its own independent
("local") personal data responsibility for its own collection of data. Bonnier News AB has further stated that it does not have a joint controller for the processing of personal data carried out after the data has been disclosed to affiliated companies from the joint databases. It is the affiliated company that has retrieved the data that is the controller for the processing carried out by this company after the retrieval.
3.2.2 Applicable provisions, etc.
According to Article 4(7) of the Data Protection Regulation, the controller is the person who alone or jointly with others determines the purposes and means of the processing of personal data. The fact that purposes and means can be determined by more than one actor means that several actors can be controllers for the same processing.
According to Article 4(2) of the Data Protection Regulation, processing is an action or combination of actions concerning personal data or sets of personal data.
In the Fashion-ID case, the CJEU held that a website operator who uses social network plug-ins on its website may become a joint controller with the social network. This applies to the collection and disclosure by transmission of personal data of website visitors that takes place using the social network plug-in. The CJEU also stated that each party is only responsible for those parts of the processing chain for which it actually determined the purposes and means. 8 See paragraph 75 of the Opinion. 9 See judgment in Fashion-ID, C-40/17, EU:C:2019:629, paragraphs 64-85 10 In the Wirtschaftsakademie case, the CJEU stated that joint responsibility for processing does not necessarily mean that the different actors involved in the processing of personal data have the same responsibility. On the contrary, these actors may be involved at different stages of the processing of personal data to varying degrees, and the level of responsibility of each must be assessed taking into account all the relevant circumstances of the individual case.
3.2.3 IMY's assessment
Bonnier News AB provides two databases, the KDB and the behavioral database, where
information from affiliated companies is combined into profiles of individuals. Under the
conditions determined by Bonnier News AB and the companies, the information is
made available to Bonnier News AB and the respective affiliated company.
IMY notes that, in addition to making the databases available to the affiliated companies,
Bonnier News AB has, together with the companies, set up the framework for the processing in
various ways.
IMY therefore assesses that Bonnier News AB is jointly
controller of personal data with the affiliated companies for the part of the
personal data processing that takes place for the common purposes of
making personal data, through profiling of individuals' data, available to affiliated companies to display customized advertisements and for use in telephone sales and
direct mail marketing. This includes the collection of data for the databases, the storage in the databases and the profiling, the collection of additional data from Bisnode Sverige AB, the connection between the behavioral database and KDB, and the transfer of data between the databases. Furthermore, Bonnier News AB is jointly responsible for personal data with the affiliated companies for the actions taken prior to and in the event of disclosure to an affiliated company. 3.3 What data constitutes personal data? 3.3.1 Current circumstances and Bonnier News AB's position The section "Description of the group-wide personal data processing" states that a large amount of data collected from individuals is processed in the KDB and the joint behavioral database. Bonnier News AB believes that what is referred to in this decision as a supplemented behavioral profile constitutes personal data. However, data in the behavioral database - which cannot be linked with data in the KDB - constitutes anonymous behavioral data according to Bonnier News AB. This is because they cannot be linked to a person either via KDB-ID, customer ID, IP address or any other identifier for a person. Bonnier News AB therefore believes that the behavioral profiles referred to in this decision as simple behavioral profiles do not constitute personal data. According to Bonnier News AB, the segmentation made on these simple profiles is only based on the affiliated company's own collected information in the behavioral database (a company can, for example, choose to adapt sports-related content and advertisements to the information registered via a cookie over the last 30 days). 3.3.2 Applicable provisions and other general starting points According to Article 4(1) of the General Data Protection Regulation, personal data is any information relating to an identified or identifiable natural person (i.e. the data subject). The same provision states that an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or online identifiers or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. According to recital 26 of the GDPR, the principles of data protection should apply to any information relating to an identified or identifiable natural person. Personal data which have been pseudonymised and which could be attributed to a natural person by the use of supplementary information should be considered as data relating to an identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means, such as screening, which, either by the controller or by another person, can reasonably be used to directly or indirectly identify the natural person. In order to determine whether means can reasonably be used to identify the natural person, all objective factors, such as the cost and time required for identification, should be taken into account, taking into account both the technology available at the time of the processing and the state of the art. According to recital 26, the principles of data protection should not apply to anonymous information which does not relate to an identified or identifiable natural person, or to personal data which has been rendered anonymous in such a way that the data subject is no longer identifiable. The Regulation therefore does not concern the processing of such anonymous information, which includes information for statistical or research purposes. According to recital 30 of the Data Protection Regulation, natural persons may be linked to online identifiers provided by their equipment, applications, tools and protocols, e.g. IP addresses, cookies or other identifiers, such as radio frequency tags. This may leave traces which, in particular in combination with unique identifiers and other data received by the servers, can be used to create profiles of natural persons and identify them. 11 An opinion of the Article 29 Working Party, which contains an analysis of the concept of personal data, states that a natural person in a group is considered to be “identified” when he or she can be “distinguished” from other individuals in some way. The European Data Protection Board (EDPB), in its guidelines on targeted advertising in social media, has stated that even individuals who use a social media service without having created an account or profile with the social media service may constitute data subjects within the meaning of Article 4(1) of the GDPR if the person is directly or indirectly identified or identifiable. The EDPB has referred to the concept of “thinning” in recital 26 of the GDPR and to the above-mentioned opinion of the Article 29 Working Party.
The Article 29 Working Party’s opinion on online behavioural advertising further elaborates on what it means to be identifiable:
The Article 29 Working Party notes that behavioural advertising often leads to the processing of personal data. Behavioural advertising typically involves the collection of IP addresses and the processing of unique identifiers (through the cookie). The use of such functions with a unique identifier makes it
11The so-called Article 29 Working Party was an advisory and independent working party consisting of representatives of the supervisory authorities in the EU and the EEA. , The working party was tasked with contributing to the uniform application of the Data Protection Directive through, among other things, recommendations. On 25 May 2018, the working party was replaced by the European Data Protection Board, the EDPB.
12See WP 136. Article 29 Working Party Opinion 4/2007 on the concept of personal data, adopted on 20 June 2007, p. 12 f
13See EDPB Guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted on 13 April 2021, p. 19 12
allow users of a particular computer to be tracked even if dynamic IP addresses
are used. In other words, such features make it possible to “point out” individual
data subjects, even if their names are not known. Moreover, the information
collected in the context of behavioural advertising relates to (i.e. concerns) the characteristics or behaviour of a
person and is used to influence that specific
person. This view is further strengthened if one considers the possibility that
profiles can be linked at any time to directly identifiable information provided by the data subject, such as information provided when
registering on a website. Other scenarios that can lead to identifiability are
mergers, data losses and the growing availability on the Internet of
personal data linked to IP addresses. 14
3.3.3 IMY's assessment
IMY initially notes that the supplemented behavioural profiles (i.e.
behavioural profiles linked to KDB) contain data relating to identified
or identifiable natural persons. The supplemented behavioural profiles are thus
personal data.
With regard to the simple behavioural profiles (i.e. behavioural profiles without a link to
KDB), IMY makes the following assessment.
In order for a piece of data to qualify as personal data, it is first required that
the data relates to a natural person. This requirement is met with regard to simple
behavioural profiles since the data describes how the individual surfed with a number
of different parameters.
Furthermore, it is required that the natural person is identified or identifiable. Article 4(1) of the GDPR states that it is sufficient that a person can be identified indirectly. The provision further states that identification can be made by reference to an online identifier. Recital 30 of the GDPR lists cookies (in the English version) as an example of online identifiers. Identification within the meaning of Article 4(1) can thus be made by means of such unique cookie values used in the behavioural database. IMY further notes that recital 26 of the GDPR states that
selection is a way of identifying a person. This means that a person can be
identified by being distinguished from other persons. It is therefore not required that the person be identified by name or personal identification number. Such
selection or selection occurs when the information processed makes it possible to
identify, draw conclusions about or take specific measures in relation to a user. In the behavioral database, the information is linked to a unique identifier, a unique cookie value, which is linked to a specific browser or app, which in turn is linked to a device such as a computer or phone. One of the purposes of the processing of the data is to target marketing to a user based on the user's behavior based on that user's previous behavior in an identified browser or app. The purpose of the processing is thus to draw conclusions about the individual by creating a profile and based on this to influence the individual. IMY thus states that even the simple behavioral profiles that are not linked to the KDB mean that individuals are identifiable.
14See WP 171, Article 29 Working Party Opinion 2/2010 on online behavioural advertising, adopted on 22 June
2010, p. 9 f
15See WP 136. f Article 29 Working Party Opinion 4/2007 on the concept of personal data, adopted on 20 June 2007, p. 12 13
In this context, IMY assesses that simple behavioural profiles constitute
personal data.
3.4 Processing constitutes profiling
3.4.1 Applicable provisions
Profiling is defined in Article 4(4) of the GDPR as any form of
automatic processing of personal data consisting of the use of personal data to
assess certain personal aspects relating to a natural person, in particular to
analyse or predict that natural person's performance at work, economic
situation, health, personal preferences, interests, reliability, behaviour, whereabouts
or movements.
3.4.2 IMY's assessment
IMY notes that both the processing of personal data based on simple behavioral profiles and supplemented behavioral profiles for the purpose of making the data available to affiliated companies for the purpose of displaying tailored advertisements
includes profiling of data subjects as defined in Article 4(4) of the
GDPR. This is because it involves the automated processing of personal data aimed at categorizing data subjects based on their previous behavioral patterns, which in turn makes it possible to assess certain of their personal characteristics.
IMY further notes that the processing of personal data for the purpose of making contact details available for telemarketing and direct mail marketing
includes profiling of data subjects as defined in Article 4(4) of the
GDPR. This is because it involves the automated processing of personal data aimed at categorizing data subjects based on their purchase history and, in some cases, behavioral patterns.
3.5 Legal basis for processing for the purpose of displaying customized advertisements based on data in the behavioral database
3.5.1 Current circumstances and Bonnier News AB's position
Bonnier News AB has stated that it has coordinated its activities within the group to
achieve a better data basis and make it possible to process customers' and
users' personal data for specified purposes in a cost-effective and privacy-friendly manner. Bonnier News AB uses its profiling of individuals to
make information available to affiliated companies for the purpose of displaying customized advertisements, partly on
collected behavioral data that cannot be linked to the KDB, partly on behavioral data where such a
connection can be made and where additional personal data has been added to the data subject's
profile. Bonnier News AB supports its processing of information to make information available to affiliated companies for the purpose of displaying customized advertisements on the legal basis of Article 6(1)(f) of
the General Data Protection Regulation.
Legitimate interest
Bonnier News AB has stated the following.
The company has a legitimate interest consisting of a need to understand the wishes and needs of its customers and users in order to be able to achieve relevance in content and advertising aimed at customers and users and thereby be able to offer competitive products/services and attractive advertising space. Many of the affiliated companies are also engaged in journalistic activities. The operating model of 14 publishers today consists of revenue streams from reader and advertising revenue. The group-wide processing of personal data is important for the financing of the companies' journalistic activities. Bonnier News AB has also pointed to the protection of media freedom and diversity in Article 11 of the EU Charter of Fundamental Rights. Necessary processing Bonnier News AB has stated that the processing of personal data is necessary to achieve the purposes of making individuals' profiles available to affiliated companies in order to display tailored advertisements. The company, together with the other companies, has taken measures
to minimize the amount of data collected and limited how long this data is
processed, and ensured that the databases are kept separate and that only certain data
is transferred between them.
Balancing of interests
Bonnier News AB has stated the following.
Bonnier News AB's interest outweighs the individual's interest in protecting their
personal data.
Processing personal data to display customized advertisements based on the individual's profile is a basic requirement for journalists and publishers to be able to receive
revenue and, in the long run, to be able to conduct journalism.
It is possible to object to profiling based on behavioral data. According to the
information that individuals receive in Bonnier News AB's personal data policy, the individual can object to information about their online behavior being processed in the
16 common customer database. This means that the connection between the individual's
customer data and their surfing behavior is removed.
The data subjects have a direct relationship with one or more affiliated companies.
The users/customers have either visited the website of an affiliated company, purchased
products from an affiliated company or an active digital subscription. Many of
the customers are subscribers who have a long-term relationship with the company that
provides the service or product and can therefore be considered to have a greater expectation that
their data will be processed. Many readers have a strong commitment linked to their
preference for news media. To some extent, customer profiles in KDB belong to piece purchases such as
literature, newspaper and goods purchases. In these cases, the relationship between customer and supplier
can be considered to be somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided
and there are alternative products such as physical newspapers that can be viewed completely
anonymously.
The processing is unlikely to have any negative impact on the data subject's interest.
Individuals' interaction with affiliated companies is voluntary and it is in their interest that the companies' services are as relevant as possible. Furthermore, Bonnier News AB has referred to the fact that the Article 29 Working Party has found that targeted marketing based on simple customer profiles, such as gender, age, place of residence and broad interests (e.g. "fashion") typically does not have a significant impact on individuals. Bonnier News AB has also taken measures to ensure that a minimum of data is processed in relation to the purposes and to reduce privacy risks in general. Among other things, personal data is not shared with companies other than the affiliated companies within the group and 16The version of Bonnier News AB's personal data policy that was submitted on July 21, 2020, see under the heading "How you can access and control your personal data", attachment 20.1. 15
All of these companies are subject to the Bonnier Group's framework for
personal data processing.
The current processing is within the reasonable expectations of the data subjects because
the individuals who come into contact with the companies do so of their own free will in order to
participate in content on websites, purchase services and/or products and that they always have a
customer/user relationship with one or more companies in the group. The companies'
personal data policies contain clear information about how customers' and users'
personal data is processed and shared within the group. The processing carried out
within the framework of the KDB and the behavioral database is closely linked to the companies' services
and products, which is likely to have an impact on the consumer's expectations. The fact that many of the companies' products and services are online and in many cases free or
financed by advertising is likely to entail a particular expectation and acceptance of certain
personal data processing for, among other things, adaptation of content and advertising. Today,
many digital products consumed by a very large portion of
consumers in society are also tailored to the individual, and it is Bonnier News AB's
opinion that today's consumers expect that the digital products and services
that they consume will to some extent be tailored to the individual.
3.5.2 Applicable provisions, etc.
Personal data shall be processed lawfully, fairly and transparently in relation to the data subject, in accordance with Article 5(1)(a) of the GDPR. The fact that the data shall be
processed lawfully means, among other things, that at least one of the conditions set out in Article 6(1) is
met.
Consent is, according to Article 6(1)(a), one of the legal bases on which a
data controller can base its processing of personal data. Another
legal basis is legitimate interest according to Article 6(1)(f), which requires that three
cumulative conditions are met. There must be (i) a legitimate interest of the controller or of a third party to whom the data are disclosed, (ii) the processing of personal data must be necessary for the legitimate interest pursued, and (iii) the data subject's interest in the protection of his or her personal data must not be overridden. 18
Recital 47 of the GDPR states that a legitimate interest may, for example, exist where there is a relevant and appropriate relationship between the data subject and the controller, for example if the data subject is a customer of the controller. It states that the processing of personal data for direct marketing purposes may be considered a legitimate interest. It further states that a legitimate interest requires a careful assessment, which includes whether the data subject can reasonably expect, at the time and in connection with the collection of the personal data, that processing for the specified purpose may take place. In particular, the interests and fundamental rights of the data subject could be overridden if personal data are processed in circumstances where the data subject cannot reasonably expect any further processing.
According to Chapter 9, Section 28 of the LEK, which implements Article 5(3) of the eData Protection Directive into Swedish law,
data may be stored in or retrieved from the terminal equipment of users or subscribers
only if the subscriber or user is given access to information about the purpose of the
processing and consents to it. This does not prevent such storage or access
that is necessary for the transmission of an electronic message via an electronic
communications network or that is necessary for the provision of a service that
the user or subscriber has expressly requested. The corresponding requirement previously applied
according to Chapter 6, Section 18 of the Electronic Communications Act (2003:389).
The EDPB Guidelines on Connected Vehicles state that data collected on the basis of consent in accordance with Article 5(3) of the ePrivacy Directive or subject to the exceptions in Article 5(3) of that Directive may only be further processed for another purpose if the controller requests further consent or is supported by Union or Member State law. The EDPB further states that such further processing cannot rely on a compatibility test under Article 6(4) of the GDPR as it would undermine the protection of the ePrivacy Directive. Furthermore, the EDPB states that consent, where required by the ePrivacy Directive, must be specific and informed, meaning that data subjects must be aware of each purpose of the processing and have the right to object for specific purposes. If further processing on the basis of a compatibility test under Article 6(4) of the GDPR were possible, the very principle of the consent requirements in the current Directive would be circumvented. 20
The EDPB Guidelines on targeted advertising in social media divide personal data into the following categories: data that the data subject has actively and knowingly provided to the controller, data observed by the data subject through the use of the service or device, and inferred and derived data created on the basis of data provided by the data subject. According to the EDPB, there are two legal bases for processing such data that the data subject has actively and knowingly provided, namely consent under Article 6(1)(a) and legitimate interest under Article 6(1)(f) of the GDPR. In the case of data
collected through observed data provided by the data subject through the use of a service or device, including that collected through
cookies, the EDPB states that Article 6(1)(f) cannot constitute a legal basis for such targeted advertising where individuals are tracked across multiple websites and locations. 22
The EDPB further states that for such processing, consent is likely to be the most appropriate
legal basis under Article 6 of the GDPR. The assessment should also take into account that the processing includes activities for which the EU legislator has sought to provide
additional protection. 23
The EDPB has stated in its guidelines on consent that if controllers choose to rely on consent for any part of the processing, they must be prepared to
respect this choice and stop that part of the processing if an individual withdraws their consent. It would be fundamentally unfair to data subjects to give the message that data will be processed based on consent while actually referring to a different legal basis. In other words, the controller may not switch the legal basis from consent to other legal grounds. The EDPB further states that, for example, it is not permissible to retroactively use legitimate interest as a ground to justify processing if there have been problems in obtaining valid consent. Due to the requirement that data controllers must
19See Guidelines 01/2020 on the processing of personal data in the context of connected vehicles and
20relevant applications, Version 2.0, Adopted on 9 March 2021, paragraph 53
21See previous note
22See EDPB Guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted on 13 April 2021, paragraph 40
See previous note, paragraph 77
23See previous note, paragraph 78 17
state the legal basis when collecting personal data, they must have determined the legal basis before collecting the data. 24
An opinion from the Article 29 Working Party on the concept of legitimate interest in Directive
95/46/EC states that when carrying out the balancing of interests, the type of interest invoked, the harm that would be suffered by the controller if the data were not processed, the nature of the data, how the personal data are processed, the position of the data subjects and the position of the controller, the reasonable expectations of the data subjects as to what will happen to their data and the consequences for the data subjects should be taken into account.
If, after analysing the above factors, it is still unclear how this balancing will turn out, the design of so-called additional safeguards may be decisive for the outcome of the balancing of interests. 25
The Article 29 Working Party Guidelines on Automated Individual Decision-Making and Profiling provide guidance on when profiling can be based on legitimate interests under
6.1 f. According to the guidelines, the following factors are relevant:
• The level of detail of the profile.
• The extent of the profile.
• The consequences of the profiling.
• The safeguards intended to ensure a fair, non-
discriminatory and accurate profiling process.
The Article 29 Working Party has reiterated in several opinions its position that it is difficult
to rely on Article 6(1)(f) of the GDPR for such profiling that takes place
for marketing or advertising purposes when individuals are tracked across several
26 different websites, locations, devices, services or for data brokering activities.
3.5.3 Basis for IMY's assessment
Bonnier News AB supports its processing of personal data for the purpose of
making individuals' profiles available to affiliated companies for the purpose of displaying tailored advertisements
on the legal basis of legitimate interest under Article 6(1)(f) of the GDPR. Before IMY examines whether the legal basis can constitute a basis
for Bonnier News AB's processing, IMY finds it necessary to address how the processing
relates to certain statements made in the EDPB guidelines.
The EDPB guidelines on targeted advertising in social media state that, when it comes to
data that the data subject has actively and knowingly provided, both
consent and legitimate interest can constitute a legal basis for the processing. The
guidelines state, however, that for data collected through observation
(for example, through cookies), legitimate interest cannot serve as an appropriate legal basis when the targeted advertising is based on individuals being tracked across multiple
websites and locations.
24
See EDPB Guidelines 05/2020 on consent under Regulation (EU) 2016/679, Version 1.1, adopted on 4 May 2020,
25points 122-123
See Article 29 Working Party Opinion 6/2014 on the notion of legitimate interests of the controller in Article 7 of
Directive 95/46/EC
26See Article 29 Working Party Opinion Guidelines on automated individual decision-making and profiling under
Regulation (EU) 2016/679, adopted on 3 October 2017, p.15 and Article 29 Working Party Opinion 6/2014 on the notion of legitimate interests of the controller in Article 7 of
Directive 95/46/EC, adopted on 9 April 2014, p. 47, and
the examples on pp. 59–60 and EDPB Guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted 13
April 2021 p. 77 18
IMY notes that Bonnier News AB collects data for its behavioral database from several
different websites, but an affiliated company can only retrieve data based on
behavioral data collected from the company's own digital services. This applies regardless
of whether it is a simple or supplemented behavioral profile.
The EDPB Guidelines on connected vehicles state that data collected on the basis of
consent pursuant to 5.3 of the ePrivacy Directive can only be further processed
for another purpose if the data controller requests additional consent or
the processing is supported by EU law or national regulation. The section on the interaction between consent and other legal bases in Article 6 of the EDPB Guidelines on consent also addresses the issue of when the data subject has been informed that they have obtained the rights conferred by consent and the unfairness of not respecting these by referring to another legal basis.
IMY notes that the situation in the case differs to some extent from that described in these guidelines. In the case in point, it is the affiliated companies that collect the data pursuant to
5.3 of the ePrivacy Directive and are thus subject to the requirement for consent in that provision. The affiliated companies must ensure that they have legal grounds for their processing pursuant to
5.3 of the ePrivacy Directive and the GDPR. The affiliated companies’ processing of personal data is not covered by this supervision.
It is therefore not Bonnier News AB that collects the data on the basis of
consent pursuant to the national provisions implementing Article 5.3 of the ePrivacy Directive. It is only when the affiliated companies enter the personal data into the behavioral database and KDB that Bonnier News AB's processing begins. Bonnier News AB therefore does not change the legal basis from consent to legitimate interest.
IMY also notes that Bonnier News AB is part of the same group as the affiliated companies and that Bonnier News AB is jointly responsible for personal data with the affiliated companies for the processing of personal data in the databases. The fact that group-wide databases have been established should not mean that the data subjects receive less protection than if the processing had taken place at the group company that collected the personal data. In other words, Bonnier
News AB should not have greater opportunities to process personal data on the basis of the legal basis of legitimate interest than the affiliated companies have. According to IMY, the guidelines presented above should therefore be of importance for the assessment of the possibility of using legitimate interest as a legal basis in the case.
From the above, it can be concluded that the scope, based on Article 6(1)(f) of the Data Protection Regulation, to further process data collected on the basis of consent according to LEK is very limited. At the same time, it can be stated that the GDPR does not prohibit the use of Article 6(1)(f) as a legal basis for the current form of processing. IMY therefore proceeds to examine whether the processing is supported by Article 6(1)(f) of the GDPR. IMY's examination of whether Bonnier News AB is supported by Article 6(1)(f) of the GDPR is based on the three conditions that must be met according to the provision: (i) Is there a legitimate interest of the controller or a third party to whom the data is disclosed? (ii) Is the processing of personal data necessary for the legitimate interest pursued? 19 (iii) Does the data subject's interest in the protection of his or her personal data outweigh the interests of the data subject? IMY treats the first two steps in the balancing of interests jointly for the
supplemented and simple behavioral profiles (sections 3.5.3 and 3.5.4). Then, the
third and final step is treated separately for the supplemented behavioral profiles
(section 3.5.5) and the simple behavioral profiles (section 3.5.6).
3.5.4 Legitimate interest
Bonnier News AB's interest in creating profiles to make data available to
affiliated companies to display tailored advertisements is of a commercial nature. The fact that an
interest is commercial does not exclude that the interest is legitimate, but the decisive factor for
this assessment is whether the interest is legitimate, specific and constitutes a real and
actual interest.7
Bonnier News AB's and affiliated companies' interest is legitimate, real and actual. IMY
therefore finds that Bonnier News AB's interest in creating profiles for
making available and the interest of the affiliated companies in processing personal data to
display customized advertisements based on customers' and users' customer profiles and
behavioral profiles is justified.
3.5.5 Is the processing necessary for the legitimate interest?
The requirement of necessity in Article 6(1)(f) of the Data Protection Regulation shall be examined together
with the principle of data minimization in Article 5(1)(c). The purpose of the processing is to
make data available to affiliated companies to display customized advertisements based on
individuals' profiles. In the case, it has emerged that Bonnier News AB together with the
affiliated companies have taken measures to minimize the amount of data collected and
limit how long this data is processed and ensured that the databases in which the data is processed are kept separate and that only certain data is transferred
between them. Against this background, IMY finds that the processing described in this
decision is necessary for the stated purpose.
3.5.6 The balance of interests for the processing of personal data in supplemented
behavioral profiles
Bonnier News AB's interest in creating profiles to make data available to affiliated companies to display customized advertisements can, according to the company, benefit the individual
either by higher revenues enabling free or cheaper services or by the individual being met with offers that they are interested in. Bonnier News AB has further
emphasised that many of the affiliated companies are engaged in journalistic activities and
that the current operating model of publishers consists of revenue streams from reader and
advertisement revenues and that the group-wide processing of personal data is
important for the financing of the companies' journalistic activities. Against this
background, the company has assessed that its interest weighs particularly heavily.
As IMY has already stated, the interest in displaying tailored advertisements is legitimate within the meaning of Article 6(1)(f) of the GDPR. As regards the question of how much weight this interest carries, IMY states that the interest is not journalistic in itself, but rather commercial in nature. Profiling creates knowledge about customers and potential customers that enables revenue from tailored advertising. IMY considers that Bonnier
27See Opinion 6/2014 of the Article 29 Working Party on the concept of legitimate interests of the controller in Article 7 of Directive 95/46/EC
28See judgment in Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48 20
News AB and its affiliated companies do not carry as much weight as Bonnier News AB claims.
When assessing the interests of the data subjects, IMY takes the following into account.
As stated above, Bonnier News AB collects personal data in the behavioral database that was originally collected by the affiliated companies through
29 cookies. The consent requirement that applies under Chapter 9, Section 28 of the LEK for that
collection provides strong privacy protection and an opportunity for the data subjects to
control the use of the collected data. This protection risks, as the
EDPB has stated in several of its guidelines, being undermined if the collected
personal data is processed on the basis of other legal grounds, such as
legitimate interest pursuant to Article 6(1)(f) of the GDPR. As IMY has already
stated, Bonnier News AB should not have a greater opportunity than the affiliated companies to
invite the legal basis of legitimate interest for the processing of the
personal data that the affiliated companies have collected using cookies. IMY therefore believes that the nature of the data means that the interests of the data subjects should be given great weight in the balancing of interests.
Furthermore, IMY considers that the scope for using Article 6(1)(f) of the GDPR as a legal basis for profiling based on observed data is limited (cf. EDPB Guidelines 8/2020 on targeted advertising in social media, p. 77–
78). IMY therefore notes that the nature of the processing also means that the privacy interests of the data subjects weigh heavily.
Bonnier News AB has emphasized that profiling and customized advertisements can benefit the data subject by enabling higher revenues for the affiliated companies, which in turn enables them to offer free or cheaper services. It can also benefit the data subject by presenting them with offers that they are interested in. IMY
does not dispute that the processing may to some extent benefit the data subjects, but considers that
the overall interest of profiling is to create advertising that is as accurate as possible in order to get customers and potential customers to purchase goods or services and to generate revenue from such advertising.
In cases where behavioral data can be linked to KDB for the purpose of displaying customized advertisements (the so-called
supplemented behavioral profiles), IMY considers the following in its assessment.
Although data for profiling is not collected from different websites, which according to
the EDPB guidelines would make Article 6(1)(f) of the Data Protection Regulation not an appropriate legal basis, the profiling instead includes data collected
from other contexts such as previous purchases, demographic data collected
and statistical data. IMY considers that profiling is extensive in nature and
that such profiling is not something a data subject can expect without having
consented to such personal data processing.
IMY considers, on a balanced assessment, that the privacy interests of the data subject outweigh the interests of Bonnier News AB and the affiliated companies.
Against this background, IMY finds that Bonnier News AB has processed personal data in violation of Article 6(1) of the Data Protection Regulation for the purpose of profiling the
29At the time of the case, the same requirements applied according to Chapter 6, Section 18 of the Electronic Communications Act (2003:389). 21
registered persons based on their behavioral data in a so-called supplemented behavioral profile
and making the profiles available to affiliated companies for the purpose of displaying customized advertisements.
3.5.7 Balancing of interests for the processing of personal data in simple behavioral profiles
As IMY stated above in section 3.5.4, Bonnier News AB's interest in creating profiles to make data available to affiliated companies to display customized advertisements is a commercial interest that does not weigh as heavily as Bonnier News AB claims.
When assessing the interests of the data subjects, IMY considers the following.
Bonnier News AB has taken measures to minimize the amount of data collected,
introduced privacy-enhancing rules for segmentation, introduced filtering rules and ensured that
data collected from an affiliated company can only be used by that company.
Profiling thus only takes place on a company's "own visitors". Furthermore, Bonnier News AB informs about the current processing through its personal data policy.
This should be weighed against the fact that the collection and profiling of simple behavioral profiles enables the mapping of individuals through observed data, which entails a greater invasion of privacy than when the data is collected through the active participation of the data subject. IMY believes that the data subject's privacy interest is strong due to the nature of the data (that the collection of the data is given special protection in the LEK). As IMY has already stated, Bonnier News AB should not have a greater opportunity than the affiliated companies to invoke the legal basis of legitimate interest for the processing of the personal data that the affiliated companies have collected using cookies. Furthermore, IMY believes that when individuals' surfing behavior is monitored to display tailored advertising, this can give the data subject the feeling of losing control over their data and the feeling of being monitored. This can result in individuals being influenced in their choice of what they see on a website.
IMY considers, on a balanced assessment, that the privacy interests of the data subject outweigh the interests of Bonnier News AB and affiliated companies even when processing personal data in simple behavioral profiles because this enables profiling of individuals.
Against this background, IMY states that Bonnier News AB has processed personal data without having a legal basis for it according to Article 6(1) of the
GDPR for the purpose of profiling the data subjects based on their behavioral data in so-called simple behavioral profiles and making the profiles available to affiliated companies for the purpose of displaying customized advertisements.
3.6 Legal basis for processing for the purpose of making contact details available for telephone sales and direct mail
marketing
3.6.1 Applicable provisions, etc.
In order to be able to rely on Article 6(1)(f) of the GDPR, the three conditions stated in the article must, as stated above, be met. There must be a legitimate interest of the controller or of the third party to whom the data are disclosed, the processing of personal data must be necessary for the 22 legitimate interest pursued and the data subject's interest in the protection of his or her personal data must not outweigh it. 30
The Article 29 Working Party and the EDPB's guidelines on profiling and the application of
Article 6 have been described in section 3.5.
3.6.2 Current circumstances and Bonnier News AB's position
Bonnier News AB has stated that the group has coordinated its activities to
achieve a better data basis and enable the processing of customers' and
users' personal data for the specified purposes in a cost-effective and
privacy-friendly manner. Bonnier News AB profiles data subjects with the aim of making the data available for telephone sales and direct mail marketing. The profiling that this entails is based partly on data in KDB collected from affiliated companies in connection with purchases and subscriptions (so-called customer engagement), partly on data obtained from Bisnode Sverige AB and, for a small part of the profiles, data from the behavioral database. Bonnier News AB bases its processing on Article 6(1)(f) of the GDPR.
Legitimate interest
Bonnier News AB has stated that the affiliated companies have a legitimate interest in marketing their products and services in an efficient and privacy-friendly manner.
Necessary processing
Bonnier News AB has stated that, together with the affiliated companies, they have taken measures to minimize the amount of data collected, how long this data is processed and, in order to comply with the data minimization principle, have kept the databases separate and only transferred certain data. Furthermore, Bonnier News AB has taken measures so that no more information than is necessary is disclosed to the affiliated companies. When disclosing, only the data points that are defined as necessary for the marketing channel specified at the time of disclosure are disclosed, i.e. for example, telephone numbers in a telephone sales campaign and addresses in postal direct marketing. The data points on which the segmentation is based are not disclosed. The balance of interests Bonnier News AB has stated the following. Bonnier News AB's interest in making information available to affiliated companies based on the data subject's profile for use in telephone sales and postal direct marketing outweighs the data subject's privacy interest. By utilizing the Group's existing resources for telephone sales and postal direct marketing, instead of purchasing the same information/resource from an external party, a cost saving occurs while enabling a more controlled degree of utilization of addresses and telephone numbers than would otherwise have been possible.
The processing is also intended to save purchasing costs.
Bonnier News AB, together with the affiliated companies, has taken measures to
minimize the amount of data collected, limit how long this data is processed
and, in order to comply with the data minimization principle, keep the databases separate.
For the purposes of telephone sales and direct mail marketing, Bonnier News
30EU Court of Justice judgment Fashion ID, C-40/17, EU:C:2019:629, paragraph 95. 23
AB has limited the type of content tags generated by the data subject's
surfing of other companies' websites. Furthermore, a connection between the databases has only been
made for a small percentage of users.
Furthermore, something called purpose-adapted
schemes is applied within the framework of the collaboration. These regulate what information is disclosed from the KDB. When disclosing, only the data points defined as necessary for the marketing channel specified at the time of disclosure are disclosed, for example, telephone numbers in the case of a telephone sales campaign and addresses in the case of postal direct marketing. The data points on which the segmentation is based are not disclosed.
There is a specific possibility for the data subject to request deletion from the common database. The data subject also has the right to object to the data being used for telephone sales and postal direct marketing.
The data subjects have a direct relationship with one or more affiliated companies.
The users/customers have either visited the website of an affiliated company, purchased products from an affiliated company or have an active digital subscription. Many of the customers are subscribers who have a long-term relationship with the company that provides the service or product, and can therefore be considered to have a greater expectation that their data will be processed. Many readers have a strong commitment tied to their preference for news media. To some extent, customer profiles in KDB belong to piece purchases such as literature, newspaper and goods purchases, where the relationship between customer and supplier can be considered somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided and there are alternative products such as physical newspapers that can be viewed completely anonymously.
According to Bonnier News AB, the processing does not likely have a negative impact on the interests of the data subject.
The processing that takes place is within the reasonable expectations of the data subjects because the individuals who come into contact with the companies do so of their own free will in order to access content on websites, purchase services and/or products and that they always have a customer/user relationship with one or more group companies. Furthermore, the companies' personal data policies contain clear information about how customers' and users' personal data is processed and shared within the group. The processing carried out within the framework of the KDB/behavioral database is closely linked to the companies' services and products, which should be of importance for the consumer's expectations. The fact that a group coordinates systems and central functions and shares certain data for efficiency reasons should not be unexpected for the data subjects. Customers who have not registered with the NIX register have a reasonable expectation that their contact details may be used for direct mail marketing or telephone sales. Consumers are used to this type of marketing. The group-wide policy provides information on direct marketing and telephone sales. It states that addresses and telephone numbers can be used by the Bonnier companies for direct mail marketing and telephone sales. It also states that the Bonnier companies can select segments that they believe are relevant for the current campaign, e.g. "men in the age range of 40-45 living in Stockholm". It also appears that the Bonnier companies always respect NIX restrictions and whether anyone has objected to the marketing.
31Only tags categorized with the IAB taxonomy are collected. 24
3.6.3 IMY's assessment
IMY treats the first two steps in the balancing of interests jointly for the supplemented and simple behavioral profiles (sections 3.6.4 and 3.6.5). The third and final step is then treated separately for the supplemented behavioral profiles
(section 3.6.6) and the simple behavioral profiles (section 3.6.7).
3.6.4 Is Bonnier News AB's interest in profiling individuals for the purpose of
making data available to affiliated companies for use in telephone sales
and direct mail marketing justified?
Bonnier News AB's interest in creating profiles to make the data available to affiliated companies for use in telephone sales and postal direct marketing is of a commercial nature. IMY assesses that the companies' interest is legitimate, real and actual with Bonnier News AB and the affiliated companies to which the data is disclosed. Against this background, IMY assesses that the company's interest in creating profiles to make data available to affiliated companies for use in telephone sales and postal direct marketing is justified. 3.6.5 Is the processing necessary for the interest in profiling individuals for the purpose of making data available to companies for use in telephone sales and postal direct marketing? The requirement of necessity in Article 6(1)(f) of the Data Protection Regulation shall be examined together with the principle of data minimization in Article 5. The purpose of the processing is to make data available to companies for use in telephone sales and direct mail marketing. In the case, it has emerged that Bonnier News AB, together with the other companies, has taken measures to minimize the amount of data collected and to limit the period for which this data is processed, and has ensured that the databases in which the data is processed are kept separate and that only certain data is transferred between them. Furthermore, the company has ensured that no more data than is necessary is disclosed to the affiliated companies for use in telephone sales and direct mail marketing. Against this background, IMY finds that the processing is necessary for the legitimate purpose.
3.6.6 Balancing of interests for the processing of personal data in supplemented
customer database profiles
Bonnier News AB has emphasized that the affiliated companies have an interest in marketing
their products and services in an efficient and privacy-friendly manner. IMY notes, however, that the interest in making data available for use in telephone sales and
direct mail marketing is a commercial interest that does not weigh particularly heavily.
When assessing the interests of the data subjects, IMY considers the following.
The profiling carried out on the supplemented customer database profiles includes
data collected from affiliated companies when purchasing and subscribing (so-called
customer engagement), data obtained from Bisnode Sverige AB and data from the
behavioral database (including data collected by the affiliated companies through
cookies). IMY has already stated above that Bonnier News AB should not have a greater
opportunity than the affiliated companies to invoke the legal basis of legitimate interest
when processing personal data that the affiliated companies have collected using
cookies. The behavioural data retrieved from the behavioural database of a data subject to
KDB is also collected from the websites of various companies. IMY considers that data subjects
cannot be expected to have their behavioural data collected for marketing purposes
32See judgment Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48 25
just because they visit a website. Nor can they be expected to have their
behavioural data combined with data from another purchasing situation or data collected
from other registers for the purpose of contacting them for telephone sales or direct mail
marketing. This is not changed by the privacy-enhancing measure that the affiliated companies that carry out the marketing measure do not have access to the collected behavioral data, but only contact information.
The EDPB guidelines state that the scope for using legitimate interest as a legal basis for profiling depends on how detailed the profile is, how extensive the profile is, the consequences of the profiling and the safeguards intended to ensure a fair, non-discriminatory and correct profiling process.
IMY believes that the privacy interest of the data subjects is strong due to the nature of the data, since the data enables the mapping of individual behavior and the collection of the data is given special protection in the LEK.
IMY further notes that this is profiling as referred to in Article 4(4) of the GDPR and that the profiling is extensive as it provides an in-depth picture of the data subject. It is also a matter of data collected from various websites combined with data obtained from customer engagement and statistical data from Bisnode Sverige AB. Against this background, IMY notes that the nature of the processing means that the privacy interests of the data subjects outweigh the interests of Bonnier News AB and its affiliated companies in the processing of personal data based on a so-called supplemented customer database profile and which is carried out for the purpose of making contact details available to affiliated companies for telephone sales and postal marketing. Against this background, IMY notes that Bonnier News AB has processed personal data without having a legal basis for it according to Article 6(1) of the GDPR by profiling the data subjects based on their supplemented customer database profiles for the purpose of making contact details available to affiliated companies for telephone sales and postal marketing. 3.6.7 Balancing of interests for personal data not linked to the behavioral database As IMY stated above in section 3.6.6, Bonnier News AB's interest is primarily a commercial interest that does not weigh particularly heavily. When assessing the interests of the data subjects for such processing that is not linked to the behavioral database, IMY considers the following. Bonnier News AB has taken measures to minimize the number of data points both in relation to the principles of data minimization and storage minimization by not sharing data at the item level, but only at the product category, brand and type of packaging. The profiling also does not include data collected through cookies. The investigation has further shown that the individual has had the opportunity to object before the processing and that Bonnier News AB respects the data subjects' wishes to avoid marketing that has been noted in national blocking lists or with the data controller. Against this background, IMY believes that the processing is within the scope of what individuals can reasonably expect based on the information provided and that data is only disclosed to affiliated companies within the group. 26
IMY believes that, on a balanced assessment, the interests or fundamental rights of the data subjects do not outweigh the interests of Bonnier News AB and the affiliated companies in the current processing.
Against this background, IMY notes that Bonnier News AB has been supported for its processing in Article 6(1)(f) of the Data Protection Regulation.
3.7 Choice of intervention
3.7.1 Applicable provisions and other general starting points
IMY has a number of corrective powers in the event of violations of the Data Protection Regulation, including reprimands, injunctions and penalty fees. This follows from
Article 58(2)(a)–(j) of the Data Protection Regulation. The IMY shall impose administrative fines in addition to or in place of other corrective measures referred to in Article 58(2), depending on the circumstances of each case. Where a controller or a processor, in relation to the same or connected processing operations, intentionally or negligently infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount set for the most serious infringement. This is stated in Article 83(3) of the GDPR. Each supervisory authority shall ensure that the imposition of administrative fines in each case is effective, proportionate and dissuasive. This is stated in Article 83(1) of the GDPR. Article 83(2) sets out the factors to be taken into account in determining whether an administrative fine should be imposed and in assessing the amount of the fine.
The EDPB has adopted guidelines on the calculation of administrative fines under the GDPR, which aim to create a harmonised method and principles for calculating fines. 33
In the case of a minor infringement, the IMY may, in accordance with recital 148 of the GDPR, issue a reprimand in accordance with Article 58(2)(b) instead of imposing a fine.
3.7.2 Same or connected data processing operations
The IMY has assessed in three cases above that Bonnier News AB lacked support in Article 6(1) of the GDPR for its processing of personal data. IMY assesses that these
processing operations, which all take place in the company's databases through profiling for
marketing purposes, are interconnected in the manner referred to in
Article 83(3) of the Data Protection Regulation.
3.7.3 Penalty fee
IMY has assessed that Bonnier News AB has violated Article 6(1) of the Data Protection Regulation
in its processing of personal data for the purpose of displaying tailored advertisements
and making contact details available to affiliated companies for telephone sales and
direct postal marketing. IMY does not consider that these are minor infringements.
33EDPB Guidelines 8/2020 Guidelines 04/2022 on the calculation of administrative fines under the GDPR (adopted for
public consultation on 12 May 2022). 27
Bonnier News AB shall therefore be imposed an administrative penalty fee for these
infringements.
IMY notes that infringements of Article 6(1) of the GDPR are covered by
Article 83(5) which means that a fine of up to EUR 20 million or four
percent of the global annual turnover in the preceding financial year, whichever is higher, may be imposed.
In determining the maximum amount of a fine to be imposed on an undertaking,
the definition of the concept of undertaking used by the Court of Justice of the European Union in
the application of Articles 101 and 102 TFEU (see recital 150 of the
GDPR) shall be used. The Court's case law shows that this covers any entity that carries out economic activity, regardless of the legal form of the entity and the way in which it is financed, and even if the entity in legal terms consists of several natural or legal persons.34
IMY assesses that the turnover of the company that should be used as a basis for calculating the administrative penalty that can be imposed on Bonnier News AB is Bonnier News AB's parent company Albert Bonnier AB. From the information obtained, it appears that Albert Bonnier AB's annual turnover in 2021 was SEK 23,299,000,000. The maximum sanction amount that can be determined in the case is four percent of this amount, i.e. approximately SEK 931,960,000.
IMY assesses that the following factors are relevant to the assessment of the seriousness of the infringement.
This has been a matter of profiling of individuals for profit both when the profiling has been carried out to display tailored advertisements and when it has been carried out to disclose contact details for telephone sales and postal marketing. The profiling carried out to display tailored advertisements has, in cases where data in the behavioural database about individuals' surfing behaviour has been linked to the KDB, included surfing history, purchase history and demographic and statistical data. It has been a matter of a violation that has been ongoing for a long time and concerned a large number of data subjects and included a large amount of personal data. However, the data processed, as far as has been established, do not constitute special categories of personal data as specified in Article 9 of the Data Protection Regulation. In this decision, IMY has assessed that the profiling through supplementary behavioural profiles was extensive in nature.
Even for the profiling of personal data in KDB where there was a connection to data in the behavioral database, so-called supplemented customer database profiles, IMY has made the assessment that the profiling was extensive in nature, since it contained data collected about the individual's surfing behavior obtained from several websites combined with data from purchases made (customer engagement) and data obtained from Bisnode Sverige AB. However, IMY makes the assessment that the current personal data processing does not entail major consequences for the data subjects. It concerns an impact that is assessed to be moderate.
In both of these cases, IMY considers that the profiling that took place where data could be linked together in the two databases, supplementary behavioral profiles and the supplementary customer database profiles, has a higher degree of seriousness compared to the
34See Judgment in Akzo Nobel, C-516/15, EU:C:2017:314, paragraph. 48 28
violation concerning the profiling that takes place in the so-called simple behavioral profiles
to display customized advertisements. IMY believes that the profiling that takes place in the so-called simple behavioral profiles
to display customized advertisements is in itself
grounding for sanctions, but that it has a lower degree of seriousness than the violations
where a connection could be made between the different databases. The reason for this is that it concerns
less information about the data subjects and indirect personal data. IMY, however, considers
that this violation also includes systematic processing that has been going on
for a long time and has affected a large number of data subjects.
The measures that Bonnier has taken to limit the infringement of the data subjects'
personal integrity, in the form of set storage periods, that data is not recorded at the product level, that no more data than necessary is disclosed to affiliated companies, according to IMY, result in a significant reduction in the seriousness of the violations.
The personal data has also not been disclosed outside the group. IMY has noted that Bonnier News AB has consistently taken measures to reduce the privacy breach for the data subjects in its group-wide cooperation.
This situation is also taken into account when assessing the seriousness of the violations.
In light of the above circumstances, IMY assesses that these are violations of low severity overall. The starting point for calculating the
sanction fee should therefore be low in relation to the current maximum amount.
In addition to assessing the seriousness of the violation, IMY shall assess whether there are
any aggravating or mitigating circumstances that are significant for the amount of the sanction fee. IMY assesses that there are no further aggravating or mitigating circumstances, in addition to those taken into account when assessing the
severity above, that affect the amount of the sanction fee.
In light of the seriousness of the violation, aggravating and mitigating circumstances
and the high turnover in relation to the violations found
, IMY sets the administrative sanction fee for Bonnier News AB at
13,000,000 SEK. IMY assesses that this amount is effective, proportionate and
dissuasive.
__________________________________________
This decision has been made by Director General Lena Lindgren Schelin after a presentation
by lawyer Ulrika Bergström. The Head of Legal Affairs
David Törngren and the Head of Unit Catharina Fernquist have also participated in the final processing.
Lena Lindgren Schelin, 2023-06-26 (This is an electronic signature)
Appendix
Information on payment of sanction fee
Copy to
DSO 29
4. How to appeal
If you wish to appeal the decision, you should write to IMY. Indicate in the letter which decision you are appealing and the change you are requesting. The appeal must be received by IMY no later than three weeks from the date you received the decision. If the appeal has been received in good time, IMY will forward it to the Administrative Court in Stockholm for review. You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal information or information that may be subject to confidentiality. The authority's contact information is provided on the first page of the decision.
