Förvaltningsrätten - Mål nr 11453-22

From GDPRhub
Revision as of 12:01, 3 January 2023 by Prigor (talk | contribs)
Förvaltningsrätten - Mål nr 11453-22
Courts logo1.png
Court: Förvaltningsrätten (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 5(1)(a) GDPR
Article 15(1)(c) GDPR
Article 19 GDPR
Decided: 22.12.2022
Published: 22.01.2023
Parties: Klarna Bank AB
Integritetsskyddsmyndigheten (IMY)
National Case Number/Name: Mål nr 11453-22
European Case Law Identifier:
Appeal from:
Appeal to: Unknown
Original Language(s): Swedish
Original Source: Förvaltningsrätten i stockholm (in Swedish)
Initial Contributor: Pantalaimon1337

The Swedish administrative court held that article 15.1.c obligates the controller to disclose information regarding which recipients' personal data has been provided to if a data subject expressly asks for it.

English Summary

Facts

The Swedish administrative court upheld a decision by the Swedish DPA reprimanding Klarna Bank for not giving explicit information, in accordance with article 15.1.c GDPR, to the data subject regarding the recipients of his personal data. The data subject had specifically asked Klarna to inform him regarding the recipients of his personal data.

Klarna Bank have interpreted article 15.1.c to mean that they could chose whether to give categories of recipients or specific recipients in a similar to the information requirements in article 14 and 13 GDPR.

Holding

The swedish administrative court held, against the background of what has emerged above, Article 15.1 c, according to the meaning of the administrative court, is interpreted in such a way that the personal data processor has an obligation to satisfy the individual's needs to the best of his ability. If the individual expressly requests access to information relating to which recipient personal data has been provided or is to be provided there is therefore a obligation for the personal data processor to disclose the data, if these are available

Comment

There has been a discussion in recent court cases about the interpretive role of the issued guidelines by EDPB. The Swedish DPA usually cites the guidelines which can be seen as giving the guidelines legal force.

The court has stated in this case that "Despite the fact that the EDPB's guidelines are not legally binding the administrative court (...) agrees with IMY's assessment that the guidelines with consideration of their purpose is guiding when it comes to the interpretation of the articles of the data protection regulation."

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

The administrative court in Stockholm The administrative courts are the first instance among the general administrative courts. The administrative courts settle disputes between individuals and authorities, for example when someone appeals an authority decision. The Administrative Court in Stockholm is Sweden's largest administrative court and one of Sweden's four migration courts.