Kammarrätten i Stockholm - Mål nr 4413-22
| Kammarrätten i Stockholm - Mål nr 4413-22 | |
|---|---|
 | |
| Court: | KamR Stockholm (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 15(1) GDPR Article 15(1)(c) GDPR Brottsdatalagen 4 kap. 3 § |
| Decided: | 04.04.2023 |
| Published: | |
| Parties: | Polismyndigheten |
| National Case Number/Name: | Mål nr 4413-22 |
| European Case Law Identifier: | |
| Appeal from: | Förvaltningsrätten i stockholm (Sweden) |
| Appeal to: | Pending appeal |
| Original Language(s): | Swedish |
| Original Source: | Kammarrätten i Stockholm (in Swedish) |
| Initial Contributor: | n/a |
The Stockholm Administrative Court of Appeals ruled that the Police had not provided sufficient information to the data subject about the processing in the criminal investigation activities and archived investigations, nor access to the personal data.
English Summary
Facts
The data subject made an access request to the Police Authority to receive information on how their personal data had been processed by the National Operations Department. In response, the Police provided certain personal data relating to criminal investigation cases and archived criminal investigations concerning the data subject. The Police provided the data in compilations including information, such as, file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit. Additionally, the Police stated that what kind of personal data are normally processed in these cases, such as, name and contact details, information that the data subject or someone else has provided in a report etc.
The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act ((brottsdatalagen, the EU's criminal data directive 2016/680 implementation in Swedish law) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police based their refusal to the argument that such further information is covered by confidentiality and providing such information could jeopardise ongoing investigations, other police actions or future activities.
The data subject appealed against the Police's decision to the Stockholm Administrative Court, which rejected the appeal. The data susbject then took the case before the Administrative Court of Appeals in Stockholm requesting that the Court change the Administrative Court's judgement in their favor.
The data subject stated that they only received a summary of the processing activities, but did not receive access to their personal data. The data subject argued that the Swedish Criminal Data Act was not applicable to closed criminal investigation cases. Since this would make the GDPR applicable in their view, the data subject argued the following. Firstly, the data subject argued that under Article 15(1)(c) GDPR they have a right to receive information on the actual recipients of personal data, and secondly, that the information received should be as accurate as possible. The data subject also argued that the Police did not provide information about the purposes of the processing activities for which their personal was processed.
The Police viewed that the appeal should be dismissed, and that it had provided sufficient information to the data subject under the Criminal Data Act and the GDPR. Firstly, the Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. Therefore, the Police represented that it could only provide the data subject with information about the categories of recipients. Additionaly, the Police also argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data subject, and that 2) the Police had indeed informed the data subject about the purposes of the processing activities.
Holding
Firstly, the court established that the GDPR applies to the processing of personal data which does not fall under the Swedish Criminal Data Act. The Court viewed that the Swedish Criminal Data Act is applicable with regard to ongoing criminal investigation activities and GDPR to archived criminal investigations.
As regards to the part of the Police’s refusal where the Police based its refusal on secrecy under the Swedish Public Access to Information and Secrecy Act (offentlighets- och sekretesslagen), the court viewed that it should have been the first instance for the appeal in that sense, in the first place. Therefore, the court set aside the corresponding part of the case and established a separate case, where it will resolve the issue for that part of the case.
The Court assessed if the Police Authority had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and Article 15 GDPR, as applicable. The Court agreed with the Police Authority that data related to a cancelled investigation can be processed until the crime becomes statute-barred.
The Court cited a CJEU decision from 12 January 2023 (C-154/21) and represented that the CJEU has held that Article 15(1)(c) GDPR must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means - where the data has been disclosed or is to be disclosed to recipient(s) - that the controller is required to provide the data subject with information of the actual identity of recipients, unless it is impossible to identify the recipients, or that the controller demonstrates that the data subject's request for access is manifestly unfounded or unreasonable within the meaning of Article 12(5) GDPR.
The Court represented firstly, that a fundamental purpose of the right to be informed in writing is to enable a data subject to be aware of the personal data and verify that they are being processed correctly in order to be able to use any rights in relation to the processing of the personal data. Secondly, that a summary in an intelligible form may be sufficient to fulfil the requirements, and that therefore, it does not have to be a copy of the data or of the exact document in which the personal data are contained. The Court represented that the Police had provided information on the categories of personal data that are normally processed in these cases. The Court stated that the DS has a right to know what the data is and to have access to it under Article 15 GDPR and the Criminal Data Act. The Court also said that the DS has a right to know the source of the data. The Court ruled that the information provided by the Police was therefore too general and that the Police had not fulfilled the requirements of Article 15 GDPR or the Swedish Criminal Data Act.
Additionally, the Court noted that there is an exception of the requirement to provide the identity of the actual recipients under Article 15(c) GDPR. The exception applies when it is impossible to identify the recipient(s). The Court ruled that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients in the Swedish Criminal Data Act. The Court did not question the Police’s statement that, with regard to archived criminal investigations, there is no information about the actual identities of any recipients of the DS’s personal data. However, with regard to the criminal investigation activities, the Court viewed that the Police’s decision did not indicate any reason why information is provided only about the prospective recipients and not about the actual recipients of disclosed data. The Court ruled that the Police authority had not fulfilled its obligations in respect of the decision either in this respect under Chapter 4, section 3 of the Criminal Data Act and Article 15(1) GDPR.
The Court did consider that the Police Authority has provided sufficient information about the purposes for which the DS’s personal data is processed.
the Court ruled that 1) the Police had not provided sufficient information about the processing of personal data relating to the DS in the criminal investigation activities and neither in archived investigations, nor has the DS been given access to the data, and that 2) the information provided to the DS was also insufficient with regard to the criminal investigation activities in terms of who the recipients of the personal data are.
The lower courts' decision was annulled in the aforementioned parts and the case was returned to the Police for a new assessment. The Court added that if, in that second review, the Police comes to the conclusion that certain information cannot be disclosed due to confidentiality it must be stated in the decision itself.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Judgments and decisions Here you can read about what to do when you want to take part in public documents. Here you will also find links to the supreme courts that publish judgments on their own websites, and to other collections of judgments.
