Kammarrätten i Stockholm - Mål nr 4413-22
| Kammarrätten i Stockholm - Mål nr 4413-22 | |
|---|---|
 | |
| Court: | KamR Stockholm (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 15(1) GDPR Article 15(1)(c) GDPR Brottsdatalagen 4 kap. 3 § |
| Decided: | 04.04.2023 |
| Published: | |
| Parties: | Polismyndigheten |
| National Case Number/Name: | Mål nr 4413-22 |
| European Case Law Identifier: | |
| Appeal from: | Förvaltningsrätt |
| Appeal to: | Pending appeal |
| Original Language(s): | Swedish |
| Original Source: | Kammarrätten i Stockholm (in Swedish) |
| Initial Contributor: | n/a |
The Stockholm Administrative Court of Appeals ruled that the Police had not provided sufficient information to the data subject about the processing in the criminal investigation activities and archived investigations, nor access to the personal data.
English Summary
Facts
The data subject (DS) made an access request to the Police Authority to receive information on how their personal data had been processed by the National Operations Department. The Police provided certain information of personal data relating to criminal investigation cases and archived criminal investigation cases. The Police refused to provide any further information on how the DS’s data was processed. The Police justified the refusal that such provision of further information on what personal data exactly of the DS was processed, could jeopardise ongoing investigations, other police actions or future activities.
The DS appealed against the decision to the Administrative Court, which rejected the appeal. The DS took the case before the Administrative Court of Appeals in Stockholm.
The DS stated that they only received a summary of the processing activities, but did not receive access to their personal data. The DS gave as an example that they did not receive information on a) what name was she referred to in different cases, and b) who had provided information about her to the Police. The DS viewed that the Swedish Criminal Data Act (brottsdatalagen, the EU's criminal data directive 2016/680 implementation in Swedish law) was not applicable to closed cases. Since this would make the GDPR applicable, the data subject argued, firstly, that under Article 15(1)(c) GDPR they have a right to receive information on the actual recipients of personal data, and secondly, that the information received should be as accurate as possible. The data subject also argued that the Police did not indicate the purposes of the various processing activities for which their personal was being processed.
The Police considered that the appeal should be dismissed, and argued that the GDPR does not provide the data subject with the right to obtain a copy of the information if the right to information can be ensured by other means. The Police represented that it did not have the information of actual recipients regarding the DS’s cases in archived criminal investigations. Therefore, the Police represented that it could only provide the DS with information about the categories of recipients which the Police argued to be sufficient under the GDPR. The Police also stated that the DS does not have a right to know who provided the data, having those third parties a right to be kept anonymous. The police argued it had indeed informed the DS about the purposes of processing the DS’s personal data.
Holding
Firstly, the court established that the GDPR applies to the processing of personal data which does not fall under the Swedish Criminal Data Act. The Court viewed that the Swedish Criminal Data Act is applicable with regard to ongoing criminal investigation activities and GDPR to archived criminal investigations.
As regards to the part of the Police’s refusal where the Police based its refusal on secrecy under the Swedish Public Access to Information and Secrecy Act (offentlighets- och sekretesslagen), the court viewed that it should have been the first instance for the appeal in that sense, in the first place. Therefore, the court set aside the corresponding part of the case and established a separate case, where it will resolve the issue for that part of the case.
The Court assessed if the Police Authority had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and Article 15 GDPR, as applicable. The Court agreed with the Police Authority that data related to a cancelled investigation can be processed until the crime becomes statute-barred.
The Court cited a CJEU decision from 12 January 2023 (C-154/21) and represented that the CJEU has held that Article 15(1)(c) GDPR must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means - where the data has been disclosed or is to be disclosed to recipient(s) - that the controller is required to provide the data subject with information of the actual identity of recipients, unless it is impossible to identify the recipients, or that the controller demonstrates that the data subject's request for access is manifestly unfounded or unreasonable within the meaning of Article 12(5) GDPR.
The Court represented firstly, that a fundamental purpose of the right to be informed in writing is to enable a data subject to be aware of the personal data and verify that they are being processed correctly in order to be able to use any rights in relation to the processing of the personal data. Secondly, that a summary in an intelligible form may be sufficient to fulfil the requirements, and that therefore, it does not have to be a copy of the data or of the exact document in which the personal data are contained. The Court represented that the Police had provided information on the categories of personal data that are normally processed in these cases. The Court stated that the DS has a right to know what the data is and to have access to it under Article 15 GDPR and the Criminal Data Act. The Court also said that the DS has a right to know the source of the data. The Court ruled that the information provided by the Police was therefore too general and that the Police had not fulfilled the requirements of Article 15 GDPR or the Swedish Criminal Data Act.
Additionally, the Court noted that there is an exception of the requirement to provide the identity of the actual recipients under Article 15(c) GDPR. The exception applies when it is impossible to identify the recipient(s). The Court ruled that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients in the Swedish Criminal Data Act. The Court did not question the Police’s statement that, with regard to archived criminal investigations, there is no information about the actual identities of any recipients of the DS’s personal data. However, with regard to the criminal investigation activities, the Court viewed that the Police’s decision did not indicate any reason why information is provided only about the prospective recipients and not about the actual recipients of disclosed data. The Court ruled that the Police authority had not fulfilled its obligations in respect of the decision either in this respect under Chapter 4, section 3 of the Criminal Data Act and Article 15(1) GDPR.
The Court did consider that the Police Authority has provided sufficient information about the purposes for which the DS’s personal data is processed.
the Court ruled that 1) the Police had not provided sufficient information about the processing of personal data relating to the DS in the criminal investigation activities and neither in archived investigations, nor has the DS been given access to the data, and that 2) the information provided to the DS was also insufficient with regard to the criminal investigation activities in terms of who the recipients of the personal data are.
The lower courts' decision was annulled in the aforementioned parts and the case was returned to the Police for a new assessment. The Court added that if, in that second review, the Police comes to the conclusion that certain information cannot be disclosed due to confidentiality it must be stated in the decision itself.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Judgments and decisions Here you can read about what to do when you want to take part in public documents. Here you will also find links to the supreme courts that publish judgments on their own websites, and to other collections of judgments.
