Förvaltningsrätten - Mål nr 11453-22
| Förvaltningsrätten - Mål nr 11453-22 | |
|---|---|
 | |
| Court: | Förvaltningsrätten (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(a) GDPR Article 15(1)(c) GDPR Article 19 GDPR |
| Decided: | 22.12.2022 |
| Published: | 22.01.2023 |
| Parties: | Klarna Bank AB Integritetsskyddsmyndigheten (IMY) |
| National Case Number/Name: | Mål nr 11453-22 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | Förvaltningsrätten i stockholm (in Swedish) |
| Initial Contributor: | Pantalaimon1337 |
The Swedish administrative court held that article 15.1.c obligates the controller to disclose information regarding which recipients' personal data has been provided to if a data subject expressly asks for it.
English Summary
Facts
The Swedish administrative court upheld a decision by the Swedish DPA reprimanding Klarna Bank for not giving explicit information, in accordance with article 15.1.c GDPR, to the data subject regarding the recipients of his personal data. The data subject had specifically asked Klarna to inform him regarding the recipients of his personal data.
Klarna Bank have interpreted article 15.1.c to mean that they could chose whether to give categories of recipients or specific recipients in a similar to the information requirements in article 14 and 13 GDPR.
Holding
The swedish administrative court held, against the background of what has emerged above, Article 15.1 c, according to the meaning of the administrative court, is interpreted in such a way that the personal data processor has an obligation to satisfy the individual's needs to the best of his ability. If the individual expressly requests access to information relating to which recipient personal data has been provided or is to be provided there is therefore a obligation for the personal data processor to disclose the data, if these are available
Comment
There has been a discussion in recent court cases about the interpretive role of the issued guidelines by EDPB. The Swedish DPA usually cites the guidelines which can be seen as giving the guidelines legal force.
The court has stated in this case that "Despite the fact that the EDPB's guidelines are not legally binding the administrative court (...) agrees with IMY's assessment that the guidelines with consideration of their purpose is guiding when it comes to the interpretation of the articles of the data protection regulation."
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
The administrative court in Stockholm The administrative courts are the first instance among the general administrative courts. The administrative courts settle disputes between individuals and authorities, for example when someone appeals an authority decision. The Administrative Court in Stockholm is Sweden's largest administrative court and one of Sweden's four migration courts.
