Högsta förvaltningsdomstolen - Mål nr 3691-22
| SAC (Sweden) - Mål nr 3691-22 | |
|---|---|
 | |
| Court: | SAC (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 78(1) GDPR |
| Decided: | 17.11.2023 |
| Published: | 17.11.2023 |
| Parties: | IMY |
| National Case Number/Name: | Mål nr 3691-22 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Swedish |
| Original Source: | Mål nr 3691-22 (in Swedish) |
| Initial Contributor: | sh |
The Swedish Supreme Administrative Court determined that data subjects have the right to appeal decisions that are dismissed or rejected by the Swedish DPA under Article 78(1) GDPR.
English Summary
Facts
The data subject complained to the Swedish DPA that his neighbors were conducting camera surveillance with cameras aimed at other’s plots and a common access road. The DPA investigated and concluded that the neighbours were not processing personal data. The GDPR was therefore not applicable and the case was closed.
This decision was appealed by the data subject to Stockholm’s Administrative Court who dismissed the case. It reasoned that that the appealed decision did not affect the data subject in such a way that it is appealable.
The data subject appealed the rejection to the Stockholm Court of Appeal. The Court of Appeal referred the case back to the Administrative Court. It stated that the Swedish DPA ruled on the substance of the data subject's complaint by rejecting it. The data subject should have an effective remedy under the GDPR.
This decision by the Court of Appeal was appealed by the Swedish DPA to Stockholm’s Supreme Administrative Court. They argued that while data subjects have the right to an effective legal remedy, the decision to not open a case or close a case do not have any legal effects or significant consequences.
Holding
The question for the Supreme Administrative Court was whether the Swedish DPA’s decision to close a supervisory case without action is appealable. The court decided that the data subject had the right to appeal.
The right to an effective judicial remedy before the competent national court when a decision has legal consequences is outlined in Article 78(1) GDPR. To have legal consequences the complaint must be a legally binding decision and this includes decisions where the authority has dismissed a complaint.
The same situation will arise as if the complaint case was directly closed without hearing the complaint. To ensure the right to an effective remedy, such a decision must also be considered as a legally binding decision within the meaning of Article 78(1) GDPR.
Therefore, the appeal of the Swedish DPA is dismissed and the Court of Appeal’s decision upheld.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1 (6)
HIGHEST
ADMINISTRATIVE COURT
JUDGMENT
Objective No
3691-22
announced in Stockholm on 17 November 2023
COMPLAINT
The Swedish Privacy Protection Authority
Box 8114
104 20 Stockholm
COUNTERPART
AA
APPEAL AGAINST A DECISION
The Court of Appeal in Stockholm's judgment on May 18, 2022 in case no. 1426-22
THE THING
Rejected appeal in case of personal data processing
___________________
DECISION OF THE SUPREME ADMINISTRATIVE COURT
The Supreme Administrative Court rejects the appeal.
4
6 Visiting address Opening hours Postal address E-mail
2 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (6)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 3691-22
BACKGROUND
1. The EU's data protection regulation aims to protect the data of natural persons
fundamental rights and freedoms, especially their right to protection of
personal data. Anyone who considers that a processing of personal data that
refers to her or him contravening the regulation has the right to file a
complaint to a regulatory authority. According to the regulation, everyone must also have
right to an effective remedy against the supervisory authority's legal binding
decision or if the supervisory authority e.g. fails to process a complaint.
2. In Sweden, the Data Protection Authority is the supervisory authority in data protection
the area. The authority's decision according to the EU's data protection regulation may be appealed
to the general administrative court.
3. AA submitted a complaint to the Swedish Privacy Protection Agency, which acted
about his neighbors conducting surveillance with cameras aimed at
other people's plots and towards a common access road. privacy
the protection authority initiated a supervisory case on the basis of the complaint.
The authority then assessed that the investigation in the supervisory case did not show that
the neighbors processed personal data through camera surveillance. data protection
the regulation was therefore not applicable and the case was therefore closed without it
measure.
4. The administrative court in Stockholm rejected AA's appeal there. As a reason for
the decision stated that the appealed decision did not affect him on such
way that it is appealable.
5. AA appealed the rejection decision to the Court of Appeal in Stockholm.
The Court of Appeal set aside the decision and remanded the case to
the administrative court for examination of AA's appeal. The Court of Appeal stated
following. The decision in the supervisory case means that the Privacy Protection Authority
2
6
2
.
O
D 3 (6)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 3691-22
has taken a position on AA's complaint on the merits by rejecting it. That is the question
such legally binding decision of the regulatory authority in relation to
him against which, according to the EU's data protection regulation, he shall have the right to one
effective remedy.
CLAIMS, M.M.
6. The Privacy Protection Authority demands that the Supreme Administrative Court should
annul the judgment of the Court of Appeal and confirm the decision of the Administrative Court as well as
states the following. The Supreme Administrative Court has previously ruled that
The Privacy Protection Authority's decision not to take any action with
reason for a complaint is not appealable (RÅ 2010 ref. 29). The question in it
now the current case differs from the legal case to the extent that it appealed
the decision was made within the framework of a supervisory matter. The complaint case
was concluded by a decision in connection with the opening of the supervisory case. Decision
on writing off a complaint-based supervisory case and decision not to
initiating supervision should, however, be assessed in the same way. Such decisions do not get any
legal effects or other significant consequences either for the person who
filed the complaint or for anyone else.
7. AA considers that the appeal should be rejected.
THE REASONS FOR THE DECISION
The question in the case
8. The issue in the case is about the Data Protection Authority's decision to terminate a
supervisory case without action is appealable.
2
6
2
.
O
D 4 (6)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 3691-22
Legal regulation, etc.
9. From Article 78.1 of Regulation (EU) 2016/679 of the European Parliament and of the Council on
protection of natural persons with regard to the processing of personal data and
on the free flow of such data and on the repeal of directives
95/46/EC (General Data Protection Regulation), the EU's data protection regulation, follows that
every natural or legal person shall have the right to an effective remedy against a
legally binding decisions concerning them issued by a supervisory authority.
10. In ch. 7 Section 3 first paragraph of the Act (2018:218) with supplementary provisions
to the EU's data protection regulation, the Data Protection Act, states that supervisory authorities
the authority's decision according to the EU's data protection regulation may be appealed to the public
administrative court.
The Supreme Administrative Court's assessment
11. The EU Data Protection Regulation came into force on 25 May 2018 and replaced
hence the Personal Data Act (1998:204). There are provisions in the Data Protection Act
which on a general level supplements the regulation.
12. In the preparatory work for the Data Protection Act, the issue of the regulation was discussed
presupposes that the individual must have a general right to appeal against supervisory
the authority's decision to e.g. not take any action due to one
complaint. The government considered that it was unclear whether the regulation means that it
data subjects have the right to appeal the supervisory authority's decision not to act
any action in response to a complaint. Regardless of how the regulation should
interpreted in this respect, however, no constitutional measures were required i
Swedish law. It was instead left to the courts to, through an interpretation
of the Administrative Act's general provisions on appeals, take a position in
2
6
2
.
O
D 5 (6)
HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 3691-22
the question of whether Swedish jurisprudence is still relevant or whether the regulation has
changed the legal situation (prop. 2017/18:105 p. 164 f.).
13. The right to an effective legal remedy according to Article 78.1 of the EU data protection
regulation applies in respect of legally binding decisions issued by a
supervisory authority. It appears from recitals 141 and 143 in the preamble to the regulation
that the data subject should have the right to an effective legal remedy with the competent authority
the national court against a decision of a supervisory authority that has legal
consequences for this person. Examples include decisions where supervisory
the authority rejects or rejects a complaint in whole or in part.
14. According to the Supreme Administrative Court, this means that a decision whose meaning
is that the Privacy Protection Authority will not do what is requested in one
complaint must be considered a legally binding decision that is subject to appeal
according to Article 78.1 of the EU Data Protection Regulation.
15. When the Privacy Authority closes a complaint case to initiate
a supervisory matter, a position will be taken on the complaint only when the supervisory
the case is processed. If the outcome of the supervisory case will subsequently differ
from what is requested in the complaint the same situation arises as if
the complaint case was immediately closed without the complaint being heard. In order to
the right to an effective remedy must not be lost, so must one
such decision is considered a legally binding decision according to Article 78(1).
16. AA's complaints to the Swedish Privacy Agency have not led to those of him
the requested measures. It follows from the foregoing that AA has the right to appeal
The Privacy Protection Authority's decision.
2
6
2
.
O
D 6 (6)
HIGHEST Goal no
JUDGMENT
ADMINISTRATIVE COURT 3691-22
The Privacy Protection Authority's appeal must therefore be rejected.
_______________________ _______________________
_______________________ _______________________
Justice Henrik Jermsten, Thomas Bull,
Marie Jönsson and Magnus Medin.
The rapporteur has been the Secretary of Justice Max Uhmeier.
4
6
2
.
O
D
