FiS - 6034-24
| FiS - 6034-24 | |
|---|---|
 | |
| Court: | FiS (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 58 GDPR |
| Decided: | 17.07.2024 |
| Published: | 17.07.2024 |
| Parties: | Region Uppsala |
| National Case Number/Name: | 6034-24 |
| European Case Law Identifier: | |
| Appeal from: | IMY (Sweden) |
| Appeal to: | |
| Original Language(s): | English |
| Original Source: | noyb (in English) |
| Initial Contributor: | ec |
A court held that the DPA
English Summary
Facts
The data subject lodged a complaint against the controller, the Region Uppsala, at the Swedish DPA (“IMY”) for recording telephone conversations without a legal basis for the processing. The DPA sent an information letter to the controller, informing them of the complaint, the applicable law and to close the case without taking any further action. The DPA held that the purpose of the letter was to give the controller the opportunity to review its processing and to correct any shortcomings themselves. The DPA therefore did not see any grounds to investigate the complaint further. The data subject appealed this decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”), arguing that the DPA has the obligation to take effective measures to limit violations. As the letter stated that the DPA did not intend to take further action, there was no incentive for the controller to remedy its violations. Therefore, the data subject argued that the DPA failed to investigate the matter with due diligence, even though it was clear from the complaint that the controller did not have a legal basis for its processing. The data subject further argued that information letters are not a corrective measure under Article 58 GDPR and can therefore not constitute as an effective measure. The data subject argued that this was also not in line with the EDPB internal document on Supervisory Authorities’ duties in relation to alleged GDPR infringements. The IMY held that the appeal should be rejected as the measure was sufficient. The IMY held that if the letter did not result in the controller correcting any shortcomings, the data subject was free to submit a new complaint at a later stage.
Holding
The court assessed whether the DPA had grounds for not investigating the data subject’s complaint further, beyond sending an information letter to the controller. The court took into account the CJEU judgement in the Joined Cases C-26/22 and C‑64/22 SCHUFA which concerns corrective measures under the GDPR and held that it supports the conclusion that IMY as a supervisory authority has considerable discretion to assess the extent to which a complaint should be investigated and that investigative measures are appropriate, necessary and proportionate in the individual case. The court took into account the Swedish bill on the GDPR (2017/18:105), which stated that the supervisory authority has no obligation to take supervisory measures or even to always investigate the facts more closely. The court thus held that IMY has a clear discretion to decide for itself which supervisory cases are to be pursued and how this is to be done The court dismissed the data subject’s arguments and held that the IMY has the possibility to decide not to investigate a complaint further and to close a case by sending an information letter to the controller. The court took into account that the DPA was uncertain whether the controller had complied with its obligations under Article 6 GDPR, and therefore was justified to send an information letter. Thus, there is no reason to question IMY's view that no further investigative measure was necessary. The DPA thus investigated the matter in question to the extent that is appropriate in the individual case and that the information letter sent has been a sufficient measure. The court held that the EDPB’s internal documents are not binding and therefore does not lay down any obligations for the DPA as regards to the content of the information letter. The court thus dismissed the appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
