FiS - 13308-22
|FiS - 13308-22|
|Relevant Law:||Article 57(1)(f) GDPR|
Article 60(8) GDPR
Article 77 GDPR
Article 78 GDPR
§ 12 Förvaltningslagen (2017:900)
|National Case Number/Name:||13308-22|
|European Case Law Identifier:|
|Appeal from:||IMY (Sweden)|
|Original Source:||(in Swedish)|
The Stockholm Administrative Court held that Swedish law does not deny complainants under Article 77 GDPR to have party status. Consequently, they may demand a decision after six months under Swedish Administrative law. This also applies if the DPA opened a parallel ex officio investigation into a similar matter and the same company.
English Summary[edit | edit source]
Facts[edit | edit source]
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify.
After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months.
The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under Article 77 GDPR as the complainant in such a case does not have a party status, according to the preparatory work of the Act.
Holding[edit | edit source]
In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22).
A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation.
In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four weeks. The case was referred back to the IMY for reconsideration.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Page 1 (9) ADMINISTRATIVE COURT JUDGMENT Case no IN STOCKHOLM 2022-10-31 13308-22 Department 5 Announced in Stockholm COMPLAINT [REDACTED] Agent: Lawyer COUNTERPART The Swedish Privacy Protection Authority OVERRULED DECISION The Data Protection Authority's decision 2022-05-31, see appendix 1 THE MATTER Rejected request for case to be settled _____________________ DECISION OF THE ADMINISTRATIVE COURT The administrative court approves the appeal and cancels the appealed the decision and refers the case back to the Privacy Protection Authority for processing in accordance with what is stated below. 3 3 Visiting address Opening hours Postal address E-mail 4 Tegeluddsvägen 1 Monday–Friday avd31 firstname.lastname@example.org 1 08:00–16:00 115 76 Stockholm . Phone Website o 08-561 680 00 www.domstol.se/forvaltningsratten-i- D Stockholm/ Page 2 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM CLAIMS, M.M. claims that the administrative court must establish that he has standing as a party to the supervisory case and show the case back to the Privacy Protection Authority heten (IMY) for review in substance according to § 12 of the Administration Act (2017:900), FL. He brings forward i.a. following. There is no express legal support in Swedish law for a complainant shall not have standing as a party to a complaint relating to his or her rights. This includes i.a. the right of access under Article 15 i regulation 2016/679/EU on the protection of natural persons with regard to processing of personal data and on the free flow of such data and on the repeal of Directive 95/46/EC (hereinafter the data protection regulation or GDPR). The Court of Appeal in Stockholm has in a judgment on 18 May 2022 in case no. 1426- 22 held that when IMY has initiated supervision due to a complaint, it shall appellants have the right to appeal IMY's decision in the supervisory matter. On this basis point of view, he has the right to appeal IMY's future decision in the supervisory matter, and should he reasonably also be a party during the authority's proceedings. The assessment that he lacks party status is also not compatible with GDPR and EU legal principles. According to these, the supervisory authority is obliged to process and investigate the complaints that each has the right to file, and the complainant have the right to an effective remedy, i.a. if the supervisory authority fails to process a complaint. By being denied party status, he does not get the opportunity to ensure that his affairs are dealt with impartially, fairly and within reasonable time. In this way, he lacks the opportunity to exercise his rights according to GDPR, which means that these become ineffective in practice. He has filed his complaint because he wishes to enforce his own right to access according to Article 15 of the GDPR and actually receive their personal data from the relevant personal data controller. This is an individual right which Doc.Id 1554333 Page 3 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM protected by Article 8.2 of the Charter of the European Union on the fundamentals the rights. In accordance with the principle of the autonomy of EU law, the concept of complaint i the data protection regulation is also interpreted in the light of the data protection regulation and Article 8 of the EU Charter of Rights and not solely with the support of national preparatory works. Furthermore, an appellant is described in the preparatory work as the person who appeals an administrative decision, which was also not the situation when the notification was made the Austrian supervisory authority. IMY in and of itself has the opportunity to initiate supervisory matters on its own initiative against an object of supervision, but by consistently converting complaint cases to general supervisory matters on IMY's own initiative are undermined by the appellant possibility to effectively demand their rights according to data protection the regulation. IMY claims that the authority fulfills the obligations that follow from article 57.1 in GDPR by the authority handling the complaint in question the supervisory matter. However, it can be questioned about a procedure with one general supervisory case where the appellant lacks party status means that IMY deals with the specific complaint. Furthermore, the supervisory authority's primary task is to monitor and enforce the application of the data protection regulation. Article 57.1 f of the GDPR shall be read in in the light of Article 77 and Article 78 of the GDPR because the procedural rights which follows from these provisions would lack purpose if there is not one the corresponding obligation of the regulatory authority to deal with complaints and inform the complainant of the progress and outcome of the complaint. It means that the supervisory authority must provide a result for all complaints which specifies the legal considerations used to e.g. reject the complaint, in order to constitute a legally actionable act. Doc.Id 1554333 Page 4 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM It thus follows from EU law that he has the status of a party to the case. According to the principle of national procedural autonomy gets procedural questions admittedly regulated by the national law of the Member States, but the regulations must not do it is impossible or unreasonably difficult to enforce EU law. IMY considers that the appeal should be rejected and puts forward, among other things, following. The provision in § 12 FL is not applicable because the appellant lacks standing as a party to the supervisory case. In the preparatory work, it is clearly stated that an individual does not have position as a party in a supervisory matter. That would mean a change of the legal situation to come to a different conclusion in this case. The fact that the appellant is not granted status as a party in the supervisory matter does not entail rather that IMY fails in relation to the obligations that follow from article 57.1 in the GDPR, or that the rights that follow from the data protection regulation become ineffective for those registered. This is because IMY in the current the review case investigates the complainant's request for access. Article 78.2 of the GDPR refers to the data subject's right to an effective remedy in that case the supervisory authority fails to process a complaint. In that IMY i the current supervisory case investigates the facts of the registered person's complaint target, the authority has not failed to act. To the extent that IMY arrives at that the complainant's rights according to the data protection regulation have not been satisfied can the subject of supervision, through targeted corrective measures in supervisory decisions, be made to remedy the deficiencies shown by the investigation. A final decision must be adopted in accordance with Article 60.8 of the GDPR on responsible supervisory authority has concluded that there is no reason to take measures taking into account what has been brought forward in the complaint, and that some measures therefore should not be taken against the object of supervision. Because IMY has not yet Doc.Id 1554333 Page 5 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM made a decision in the supervisory case, it is not yet clear whether a final decision will be made now current case will be accepted according to Article 60.8 of the GDPR. The Court of Appeal decision to which the appellant refers applies to the question appealability of IMY's decision and does not affect the question of the individual position in the case. THE REASONS FOR THE DECISION Applicable regulations, etc. Union law Article 57.1 f of the GDPR states, among other things, that the supervisory authority shall be responsible for process complaints from a data subject, and where appropriate investigate it matter to which the complaint applies and inform the individual about it within a reasonable time how the investigation is progressing and about the outcome, in particular if required further investigations or coordination with another regulatory authority. If a complaint is dismissed or rejected, the supervisory authority to which the complaint was submitted adopt the decision and notify the individual thereof. According to Article 77 shall every data subject who considers that the processing of personal data which concerns her or him contravenes the data protection regulation has the right to file a complaint with a regulatory authority. The supervisory authority to which the complaint has been submitted must inform the individual about how the work with the complaint is progressing and what the outcome will be, including the possibility of legal action examination according to Article 78. Article 78 of the GDPR states that every natural or legal person shall have the right to one effective remedy against a legally binding decision concerning those who have notified by a supervisory authority. Furthermore, every registered person must have the right Doc.Id 1554333 Page 6 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM to an effective remedy if the competent supervisory authority fails to process a complaint or to inform the data subject within three months on how the work on the complaint submitted under Article 77 continues progress or about its results. Actions against a supervisory authority must be brought at the courts of the Member State where the supervisory authority has its seat. National law Section 12 FL states that if a case that has been initiated by an individual party has not decided in the first instance within six months at the latest, the party may request in writing that the authority shall decide the matter. The authority must within four weeks from on the day such a request was received either decide the case or in a special decision reject the request. In the preparatory work for the provision, it is stated i.a. following. The requirement that the case must have initiated by an individual party means that cases initiated on the authority's own initiative or on the initiative of another authority is not covered by the provisions melsen's scope of application. The preparatory work further states that if a supervisory case has been initiated due to a complaint from an individual is determined message not applicable because the person who complained in such a case does not get party- position in the supervisory matter (prop. 2016/17:180 pp. 295-297). The Court of Appeal in Stockholm has in a ruling on 18 May 2022 in case no 1426-22 came to the conclusion that IMY's decision to close an initiated supervisory case has been appealable. In the decision, IMY assessed that what was found in the case did not show that the persons concerned processed personal data through camera surveillance. The Court of Appeal considered that IMY thereby took a position on the submitted complaint in substance and that the decision could be assumed to affect it individual's situation in a not insignificant way. Doc.Id 1554333 Page 7 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM The assessment of the Administrative Court In January 2019 filed a complaint with the Austrian the regulator regarding a company's way of handling his request for access according to Article 15 of the GDPR. Since IMY is the responsible supervisory authority in Sweden, the case was handed over there. In light of this and a number of other complaints directed against the company regarding the right of access began IMY in June 2019 an inspection of the company's general routines upon request access. In November 2020, IMY extended the supervision to also cover betting which existed in three individual complaints, i.a. [xxx] complaint. has now submitted a request according to § 12 FL that the case should be decided. The question in the case is whether he is a party to the supervisory case and whether he has initiated it the. Read in the light of paragraphs 141 and 143 of the preamble to the GDPR, Article 8 of the EU charter of rights as well as the EU Court's statements in the rulings Schrems I and Schrems II (see Schrems I, C-362/14, EU:C:2015:650 and Schrems II, C- 311/18, EU:C:2020:559) the administrative court finds that Article 57.1 f, Article 77 and Article 78 of the GDPR gives a registered person a number of individual rights. According to the opinion of the administrative court, the articles and the statements of the European Court of Justice provide i.a. expression that the competent supervisory authority is obliged to process, and to an appropriate extent investigate, all complaints regarding the treatment of personal data submitted by a data subject. Furthermore, each must complaints that are not granted result in a reasoned decision, against which it the registered person must have the right to an effective legal remedy (see also Kam- the appeal in Stockholm's decision on May 18, 2022 in case no. 1426-22). IMY has brought forward that the current supervisory case has been initiated by IMY on the authority's own initiative and that it refers to the company's general routines at Doc.Id 1554333 Page 8 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM access request, although since November 2020 it also includes a review of i.a. precisely [xxx]'s complaint. The Administrative Court states that IMY must, and may, initiate supervisory cases on their own initiative, and that registered persons generally do not have the above said rights or party status solely because their data appears in a supervisory matter. however, has filed its complaint to protect and protect precisely their rights according to the data protection regulation. In such a case the administrative court considers it incompatible with Union law that the individual, by not being recognized as a party to the case, will be at a disadvantage situation, with regard to the various rights ensured by data protection the regulation than it would otherwise have done. - And this only with reason why IMY chooses to handle the complaint within the framework of a supervisory matter which, on an overall level, refers to the supervised company's general routines. According to the administrative court's opinion is thus party to the case in so far as it relates to his complaint and the handling of his personal data. As regards the question of whether the matter has been initiated by administrative the court's assessment that he has in any case initiated the part of the case that was initiated in November 2020 and which includes three individual complaints, one of which is from him. This also in consideration of the fact that the case of IMY, for other reasons, started in June 2019. IMY has thus not had the right to reject the request according to § 12 FL. The decision must therefore be set aside and the case referred back to IMY for renewal handling. Doc.Id 1554333 Page 9 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM HOW TO APPEAL This decision can be appealed. Information on how to appeal can be found in appendix 2 (FR-03). Document ID 1554333