Högsta förvaltningsdomstolen - 4588-23
| HÖGSTA FÖRVALTNINGSDOMSTOLENS - 4588-23 | |
|---|---|
 | |
| Court: | HÖGSTA FÖRVALTNINGSDOMSTOLENS (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 9(1) GDPR Chapter 1, Section 20 of the Basic Law on Freedom of Expression |
| Decided: | 20.06.2024 |
| Published: | |
| Parties: | Verifiera AB Swedish Authority for Privacy Protection (IMY) |
| National Case Number/Name: | 4588-23 |
| European Case Law Identifier: | |
| Appeal from: | Administrative Court of Appeal of Stockholm Case No 1128-23 |
| Appeal to: | Not appealed |
| Original Language(s): | Swedish |
| Original Source: | domstol.se (in Swedish) |
| Initial Contributor: | Andreea Lisievici |
The Swedish Supreme Administrative Court (Högsta förvaltningsdomstolen) ruled that the EU General Data Protection Regulation (GDPR) qualifies as a law prohibiting the publication of personal health data as per the Freedom of Expression Act. This decision came after Verifiera AB was reprimanded for publishing court decisions containing sensitive health information.
English Summary
Facts
Parties: Verifiera AB (appellant) vs. Integritetsskyddsmyndigheten (respondent) Background: Verifiera AB operates a database containing court decisions on psychiatric compulsory care and substance abuse treatment. The database is covered under the Freedom of Expression Act due to its publication certificate. The GDPR generally prohibits the processing of personal data related to health. Legal Journey: The Administrative Court and the Court of Appeal in Stockholm upheld the Authority's decision. Verifiera AB appealed to the Supreme Administrative Court, maintaining that the GDPR's restrictions should not apply to their database under the Freedom of Expression Act.
Arguments: Verifiera AB: Argued that their operation falls under the Freedom of Expression Act, which should protect their right to publish the court decisions. They contended that the GDPR should not override these protections. Integritetsskyddsmyndigheten: Claimed that the publication of health-related court decisions by Verifiera AB violated the GDPR, which prohibits such data processing. They issued a reprimand and required Verifiera AB to take measures to comply with the GDPR.
Holding
The Supreme Administrative Court determined that the GDPR is a law under the Freedom of Expression Act that prohibits the publication of personal health data. Consequently, the Court did not grant further review, thereby upholding the lower court's decision and the reprimand issued by the Data Protection Authority.
Comment
The decision does not analyze the supremacy of EU law and does not conclude that GDPR prevails due to such supremacy. In a rather strange twist, the court concludes that GDPR Art. 9 prohibits the publication of health data solely because there is a provision into the national law on freedom of expression stating that there can be legal provisions limiting the freedom of expression.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1 (5)
HIGHEST
ADMINISTRATIVE COURT
JUDGMENT
Objective No
4588-23
announced in Stockholm on 20 June 2024
COMPLAINT
Verify AB, 556926-3394
Representative: Lawyer Joakim Sundqvist
ASTRA LAWYERS KB
Master Samuelsgatan 42
111 57 Stockholm
COUNTERPART
The Swedish Privacy Protection Authority
Box 8114
104 20 Stockholm
APPEAL AGAINST A DECISION
The Court of Appeal in Stockholm's judgment of 22 June 2023 in case no. 1128-23
THE THING
Supervision according to the EU data protection regulation
___________________
DECISION OF THE SUPREME ADMINISTRATIVE COURT
The Supreme Administrative Court declares that the EU's data protection regulation is a
such law prohibiting the publication of personal data referred to in
1 ch. Section 20 of the Freedom of Expression Act.
The Supreme Administrative Court does not grant leave to appeal in the case in general.
The Court of Appeal's ruling therefore stands.
3
9 Visiting address Opening hours Postal address E-mail
3 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
BACKGROUND
1. Verifiera AB provides a database that includes court rulings on
compulsory psychiatric treatment and treatment of drug addicts. The company has
certificate of issue and the business therefore fall as a point of departure within
the area of the Freedom of Expression Act.
2. It appears from an exception provision in the Freedom of Expression Act that
the provisions of the constitution do not prevent regulations from being issued by law
prohibition against publication of information about e.g. health.
3. According to the EU's data protection regulation, the processing of personal data if
health in principle is prohibited.
4. The Privacy Protection Authority decided to notify Verifiera of a reprimand
and instructed the company to take certain measures so that the services provided
in the database would no longer be in conflict with the EU's data protection regulation.
The authority believed that the freedom of expression's exception provision
means that the data protection regulation is applicable to the database. Being verified
provision of court decisions on compulsory psychiatric care and on
care of drug addicts was judged to constitute processing of personal data about
health contrary to the regulation.
5. The Administrative Court in Stockholm and the Court of Appeal in Stockholm agreed on everything
essential in the Privacy Protection Authority's assessment and rejected Verified
appeals.
CLAIMS, M.M.
6. Verifiera AB demands that the Supreme Administrative Court change the Court of Appeal's ruling
9
9
3
.
O
D 3 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
judgment and cancel the Privacy Protection Authority's decision and order that
the exception provision in the Freedom of Expression Act does not allow delegation
through a regulation other than that which has been announced by the Riksdag.
7. The Privacy Protection Authority considers that the appeal should be rejected.
THE REASONS FOR THE DECISION
The question in the case
8. Permits for examination in the Supreme Administrative Court may, according to § 36 a, pre-
the Administrative Procedure Act (1971:291) is limited to applying to a certain issue in the case,
the examination of which is important for the management of the application of the law (question of precedent).
9. The Supreme Administrative Court has issued leave to appeal as regards
the issue of the EU's data protection regulation is one such law with a ban on
publication of personal data referred to in ch. 1 § 20 freedom of expression
the constitution.
10. The issue of notification of leave to appeal concerning the case in general has
declared dormant.
Legal regulation, etc.
11. According to ch. 1 Section 3 first paragraph of the freedom of expression foundation is the constitution
applicable to broadcasts of programs addressed to the general public and
intended to be received with technical aids.
12. From the first paragraph of § 4, it appears that the constitution's regulations on broadcasts of
program is also applied when information from a database, the content of which can
changed only by the person running the business, the public is provided with
9
9
3
.
O
D 4 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
using electromagnetic waves i.a. by someone who has a certificate of issue for
the business according to section 5.
13. Section 14 states that an authority or another public body cannot without support i
the constitution may intervene against someone because he or she in a program or a
technical recording has abused freedom of expression or contributed to one
such abuse.
14. In section 20, first paragraph, it is stated that the provisions of the constitution do not prevent that in
Act, regulations are issued on the prohibition of publication of personal data
if i.a. health. According to the second paragraph, the exception in the first paragraph only applies if
the personal data is included in a data collection that has been arranged so that it is
possible to search for or compile these and that with regard to
the business and the forms in which the data collection is kept available
there are particular risks of undue intrusion into individuals' personal privacy.
15. According to Article 9.1 of Regulation (EU) 2016/679 on the protection of natural persons
with respect to the processing of personal data and on the free flow of
such data and on the repeal of Directive 95/46/EC (general
data protection regulation), the EU's data protection regulation, applies to processing of
personal data about health as a starting point is prohibited.
The Supreme Administrative Court's assessment
16. The exemption provision in ch. 1 Section 20 first paragraph of the Freedom of Expression Basic Law
was introduced in 2019 to strengthen the protection of personal integrity in Swedish law
(prop. 2017/18:49 p. 145).
17. The preparatory work for the provision shows that the intention is that EU
regulations must be covered and therefore be able to constitute such regulation as
exempted from the scope of application of the constitution, partly because the chosen wording
9
9
3
.
O
D 5 (5)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23
deemed to be sufficiently clear in this regard (prop. 2017/18:49 p. 147 f.).
In addition, it is expressly stated that the provision means that the EU's
data protection regulation will apply (a. prop. p. 177).
18. Furthermore, it can be noted that the term "law" also in other legislative matters has
considered to be able to refer to an EU regulation (see e.g. prop. 1999/00:126 p. 135 f.
and 272, prop. 2021/22:59 p. 40 and prop. 2022/23:58 pp. 17 and 104).
19. Against this background, the precedent question as Supreme
the administrative court has issued leave to appeal in is answered so that the EU's
data protection regulation is such a law with a ban on publication of
personal data referred to in ch. 1 Section 20 of the Freedom of Expression Act.
20. The Supreme Administrative Court finds no reason to issue leave to appeal i
the goal in general.
_______________________ _______________________
_______________________ _______________________
Justice Henrik Jermsten, Thomas Bull,
Per Classon and Marie Jönsson.
The rapporteur has been the Secretary of Justice Max Uhmeier.
9
9
3
.
O
D
