Svea Hovrätt - T 10711-21
| Svea Hovrätt - T 10711-21 | |
|---|---|
 | |
| Court: | Svea Hovrätt (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 15(3) GDPR Article 57(1)(f) GDPR Article 78 GDPR Article 79(1) GDPR Article 47 EU Charter of Fundamental Rights 10 kap. 19 § rättegångsbalken |
| Decided: | 07.10.2022 |
| Published: | 07.10.2022 |
| Parties: | Swedbank AB WN |
| National Case Number/Name: | T 10711-21 |
| European Case Law Identifier: | |
| Appeal from: | Stockholms tingsrätt T 14908-20 |
| Appeal to: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | Svea hovrätt (in Swedish) |
| Initial Contributor: | S.donner |
A data subject can choose to bring their case to civil court even if they have not filed a complaint with the supervisory authority. Data subjects have a right to get access to a voice recording of their own voice. A transcript will not suffice.
English Summary
Facts
A data subject wanted access to the voice recording of his call to a bank. The bank refused access to the voice recording and provided the data subject with access to a transcription of the recording.
Holding
1. The supervisory authority does have an obligation to process complaints (according to CJEU Facebook Ireland and Schrems). It is nevertheless clear from the wording of Article 57.1 f GDPR that the authority has a certain amount of freedom to choose in which cases the matter of fact is to be investigated. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from the SA. This suggests that the authority's handling of complaints is not such that it can replace a data subject’s right to bring an action to court. The Court of Appeal's conclusion from the foregoing is that the court is competent to hear the dispute.
The data subject's right according to the GDPR is not about him being able to check whether the bank has carried out its risk assessments correctly, but about his interest in his personal data being processed legally and correctly. Article 15.3 of the GDPR on the right to a copy aims to ensure this interest and does not extend beyond that. He is thus entitled to a copy of the personal data in such a form that he can exercise his rights under the GDPR.
It follows from case-law that pictures and sounds are personal data (C-212/13 and C-345/17). In line with this a voice is to be deemed as personal data.
According to Article 15.3 GDPR, the complainant has the right to receive a copy of this personal data. In relation to that personal data, his other rights according to the GDPR also apply, for example the right to erasure. A transcript of the conversations - which he has already obtained - cannot satisfy his right in this regard. He therefore has the right to obtain a copy of the bank's recordings of his voice.
The second person's voice does not in itself constitute personal data with respect to the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
