Högsta förvaltningsdomstolen - 4588-23

SAC (Sweden) - 4588-23

Court:	SAC (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 9(1) GDPR Chapter 1, §20 YGL
Decided:	20.06.2024
Published:
Parties:	Verifiera AB Swedish DPA (IMY)
National Case Number/Name:	4588-23
European Case Law Identifier:
Appeal from:	KamR Stockholm (Sweden) 1128-23
Appeal to:	Not appealed
Original Language(s):	Swedish
Original Source:	domstol.se (in Swedish)
Initial Contributor:	Andreea Lisievici

The Supreme Administrative Court ruled that Article 9(1) GDPR applies even if the controller’s operation falls under the Swedish Freedom of Expression Act. Thus, the controller was prohibited from publishing court decision containing health data in their database.

English Summary

Facts

The controller, Verifiera AB, operates a database that includes court decisions pertaining to involuntary psychiatric care and care of persons with substance abuse. The controller's business operations falls within the scope of the Swedish constitutional law on Freedom of Expression (Yttrandefrihetsgrundlag - YGL) due to their publishing license ("utgivningsbevis").

The Swedish DPA (Integritetsskyddsmyndigheten - IMY) issued a reprimand and an injunction against the controller. The DPA found that the publication of health-related court decisions by the controller violated Article 9(1) GDPR, which prohibits the processing of personal data related to health. It ordered the controller to take certain measures to comply with Article 9(1) GDPR. Although Chapter 1, §7 of the Swedish Data Protection Act, states that the GDPR and the implementing national law shall not apply to the extent that this would conflict, among others, with the constitutional law on Freedom of Expression, the GDPR is still applicable when sensitive data is published under Chapter 1, §20 YGL.

Chapter 1, §20 YGL states:

“The provisions of this Constitution shall not preclude the enactment of legislation prohibiting the disclosure of personal data

revealing ethnic origin, skin colour or other similar characteristics, political opinions, religious or philosophical beliefs or trade union membership
concerning health, sex life or sexual orientation, or
which consists of genetic data or biometric data to uniquely identify a natural person.”

Thus, the DPA held that Article 9(1) GDPR is applicable to the controller’s database. Therefore the controller is prohibited from publishing health related court decisions in their database.

The Administrative Court and the Court of Appeal in Stockholm upheld the DPA's decision.

The controller appealed to the Supreme Administrative Court (Högsta förvaltningsdomstolen), arguing that the GDPR did not apply to their database, because their operation falls under the Freedom of Expression Act, which should protect their right to publish the court decisions. They argued that the GDPR should not override these protections.

Holding

The Supreme Administrative Court took into account that the proposal for the amendments of the constitutional law on Freedom of Expression (Prop. 2017/18:49) showed that the intention of this provision was that EU regulations must be exempted from the scope of application of the constitution. Furthermore, the proposal (see p. 177) specifically states that the GDPR will apply.

The Supreme Administrative Court thus held that under the YGL, Article 9(1) GDPR is a law that prohibits the publication of personal health data.

Consequently, the Court upheld the reprimand issued by the DPA and the lower courts' decisions. The Court dismissed the other appeal grounds, because there was no prejudicial value identified.

Comment

The decision does not analyse the primacy of EU law and does not conclude that GDPR prevails due to such primacy. The court follows the exact same judgement as the lower instances and concludes that Article 9 GDPR is only applicable because there is a specific provision in the national Freedom of Expression Act allowing for the applicability of other laws that prohibit the publication of specific data categories. There was no room for the court to decide on the primacy issue, only on the question whether the GDPR is considered lex specialis in relation to Chapter 1, Section 20 YGL .

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

1 (5)

HIGHEST

ADMINISTRATIVE COURT

JUDGMENT

Objective No
4588-23

announced in Stockholm on 20 June 2024

COMPLAINT
Verify AB, 556926-3394

Representative: Lawyer Joakim Sundqvist

ASTRA LAWYERS KB
Master Samuelsgatan 42
111 57 Stockholm

COUNTERPART

The Swedish Privacy Protection Authority
Box 8114
104 20 Stockholm

APPEAL AGAINST A DECISION
The Court of Appeal in Stockholm's judgment of 22 June 2023 in case no. 1128-23

THE THING
Supervision according to the EU data protection regulation

___________________

DECISION OF THE SUPREME ADMINISTRATIVE COURT

The Supreme Administrative Court declares that the EU's data protection regulation is a

such law prohibiting the publication of personal data referred to in
1 ch. Section 20 of the Freedom of Expression Act.

The Supreme Administrative Court does not grant leave to appeal in the case in general.

The Court of Appeal's ruling therefore stands.

3
9 Visiting address Opening hours Postal address E-mail
3 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)

HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23

BACKGROUND

1. Verifiera AB provides a database that includes court rulings on
compulsory psychiatric treatment and treatment of drug addicts. The company has

certificate of issue and the business therefore fall as a point of departure within

the area of the Freedom of Expression Act.

2. It appears from an exception provision in the Freedom of Expression Act that

the provisions of the constitution do not prevent regulations from being issued by law

prohibition against publication of information about e.g. health.

3. According to the EU's data protection regulation, the processing of personal data if

health in principle is prohibited.

4. The Privacy Protection Authority decided to notify Verifiera of a reprimand

and instructed the company to take certain measures so that the services provided
in the database would no longer be in conflict with the EU's data protection regulation.

The authority believed that the freedom of expression's exception provision

means that the data protection regulation is applicable to the database. Being verified

provision of court decisions on compulsory psychiatric care and on
care of drug addicts was judged to constitute processing of personal data about

health contrary to the regulation.

5. The Administrative Court in Stockholm and the Court of Appeal in Stockholm agreed on everything
essential in the Privacy Protection Authority's assessment and rejected Verified

appeals.

CLAIMS, M.M.

6. Verifiera AB demands that the Supreme Administrative Court change the Court of Appeal's ruling
9
9
3
.
O
D 3 (5)

HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23

judgment and cancel the Privacy Protection Authority's decision and order that

the exception provision in the Freedom of Expression Act does not allow delegation

through a regulation other than that which has been announced by the Riksdag.

7. The Privacy Protection Authority considers that the appeal should be rejected.

THE REASONS FOR THE DECISION

The question in the case

8. Permits for examination in the Supreme Administrative Court may, according to § 36 a, pre-

the Administrative Procedure Act (1971:291) is limited to applying to a certain issue in the case,
the examination of which is important for the management of the application of the law (question of precedent).

9. The Supreme Administrative Court has issued leave to appeal as regards

the issue of the EU's data protection regulation is one such law with a ban on

publication of personal data referred to in ch. 1 § 20 freedom of expression
the constitution.

10. The issue of notification of leave to appeal concerning the case in general has

declared dormant.

Legal regulation, etc.

11. According to ch. 1 Section 3 first paragraph of the freedom of expression foundation is the constitution
applicable to broadcasts of programs addressed to the general public and

intended to be received with technical aids.

12. From the first paragraph of § 4, it appears that the constitution's regulations on broadcasts of

program is also applied when information from a database, the content of which can
changed only by the person running the business, the public is provided with
9
9
3
.
O
D 4 (5)

HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23

using electromagnetic waves i.a. by someone who has a certificate of issue for

the business according to section 5.

13. Section 14 states that an authority or another public body cannot without support i
the constitution may intervene against someone because he or she in a program or a

technical recording has abused freedom of expression or contributed to one

such abuse.

14. In section 20, first paragraph, it is stated that the provisions of the constitution do not prevent that in

Act, regulations are issued on the prohibition of publication of personal data

if i.a. health. According to the second paragraph, the exception in the first paragraph only applies if

the personal data is included in a data collection that has been arranged so that it is
possible to search for or compile these and that with regard to

the business and the forms in which the data collection is kept available

there are particular risks of undue intrusion into individuals' personal privacy.

15. According to Article 9.1 of Regulation (EU) 2016/679 on the protection of natural persons
with respect to the processing of personal data and on the free flow of

such data and on the repeal of Directive 95/46/EC (general

data protection regulation), the EU's data protection regulation, applies to processing of

personal data about health as a starting point is prohibited.

The Supreme Administrative Court's assessment

16. The exemption provision in ch. 1 Section 20 first paragraph of the Freedom of Expression Basic Law
was introduced in 2019 to strengthen the protection of personal integrity in Swedish law

(prop. 2017/18:49 p. 145).

17. The preparatory work for the provision shows that the intention is that EU

regulations must be covered and therefore be able to constitute such regulation as
exempted from the scope of application of the constitution, partly because the chosen wording
9
9
3
.
O
D 5 (5)

HIGHEST Goal no
ADMINISTRATIVE COURT JUDGMENT 4588-23

deemed to be sufficiently clear in this regard (prop. 2017/18:49 p. 147 f.).

In addition, it is expressly stated that the provision means that the EU's

data protection regulation will apply (a. prop. p. 177).

18. Furthermore, it can be noted that the term "law" also in other legislative matters has

considered to be able to refer to an EU regulation (see e.g. prop. 1999/00:126 p. 135 f.

and 272, prop. 2021/22:59 p. 40 and prop. 2022/23:58 pp. 17 and 104).

19. Against this background, the precedent question as Supreme

the administrative court has issued leave to appeal in is answered so that the EU's

data protection regulation is such a law with a ban on publication of

personal data referred to in ch. 1 Section 20 of the Freedom of Expression Act.

20. The Supreme Administrative Court finds no reason to issue leave to appeal i

the goal in general.

_______________________ _______________________

Justice Henrik Jermsten, Thomas Bull,
Per Classon and Marie Jönsson.

The rapporteur has been the Secretary of Justice Max Uhmeier.

9
9
3
.
O
D