IMY (Sweden) - DI-2019-11737: Difference between revisions
From GDPRhub
(→Facts) |
No edit summary |
||
| Line 65: | Line 65: | ||
}} | }} | ||
The Swedish DPA found that the group-wide processing of personal data within the Bonnier group for various marketing purposes did not have a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]]. Bonnier News AB was fined 13 000 000 SEK (approx. € 1 090 000 EUR). | The Swedish DPA found that the group-wide processing of personal data within the Bonnier group for various marketing purposes did not have a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]]. Bonnier News AB was fined 13 000 000 SEK (approx. € 1 090 000 EUR) for the found violations. | ||
== English Summary == | == English Summary == | ||
Revision as of 11:54, 11 July 2023
| IMY - DI-2019-11737 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 4(4) GDPR Article 6(1)(f) GDPR Article 60 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 26.06.2023 |
| Published: | |
| Fine: | 13000000 SEK |
| Parties: | Bonier News AB |
| National Case Number/Name: | DI-2019-11737 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | IMY (Sweden) (in SV) |
| Initial Contributor: | n/a |
The Swedish DPA found that the group-wide processing of personal data within the Bonnier group for various marketing purposes did not have a legal basis under Article 6(1) GDPR. Bonnier News AB was fined 13 000 000 SEK (approx. € 1 090 000 EUR) for the found violations.
English Summary
Facts
Bonnier News AB (Bonnier) processed personal data together with a number of affiliated companies belonging to the Bonnier group for various marketing purposes.
The affiliated companies collected information on their customers as well as browsing behavior of their website visitors through cookies. That data was transmitted to two Bonnier group-wide databases: (1) the customer database and (2) the behavioral database to create profiles of individuals (the data subjects).
In some cases, information relating to a data subject in those two databases were linked which allowed the customer data, including contact information of an individual data subject, to be linked with behavioral data collected about them. Furthermore, in some cases, information obtained from Bisnode Sverige AB – a company offering business, marketing and credit information – was also linked to individual data subjects within the customer database.
Bonnier made the behavioral data available to the affiliated companies for the purpose of displaying personalised ads, and the customer information for telemarkting and postal marketing purposes. This allowed Bonnier to collect data from several different websites through the affiliated companies. However, an affiliated company could only retrieve information based on behavioral data collected from that company's own services.
Bonnier claimed to have a legitimate under Article 6(1)(f) GDPR for the collection and processing of personal data in question.
Following various complaints lodged with the Swedish DPA against companies of the Bonnier group, the DPA initiated an investigation on whether Bonnier had a legal basis under Article 6(1) GDPR for its processing of the personal data included in the group-wide databases.
Holding
The DPA assessed the question whether Bonnier had a separate legal basis under the GDPR for processing personal data for 1) the purpose of displaying personalised ads based on the behavioral data, and 2) the purpose of making the customer data available for telemarketing and postal marketing purposes.
1) Purpose of displaying personalised ads based on behavioral data
Essentially, the DPA found that the interests of the data subjects outweighed the interests of Bonnier when it processed the behavioral because such processing enables profiling of individual data subjects as defined in Article 4(4) GDPR.
Furthermore, the fact that in some cases the behavioral data of an individual data subject was linked with their customer data in the customer database, was considered to be profiling that is extensive in nature and that a data subject could not expect such profiling without having consented to it.
2) Purpose of making customer data available for telemarketing and postal direct marketing
In cases where the customer information of an individual data subject was linked with behavioral data collected about them, the DPA held that the interests of the data subjects outweighed the interests of Bonnier. This was because such processing also constituted profiling pursuant to Article 4(4) GDPR, and the DPA considered the profiling to be extensive in nature, since it provides an in-depth picture of the data subject. Further, because the data was collected from various websites and combined with additional data collected from Bisnode Sverige AB.
On the other hand, when the customer information of an individual data subject was not linked with behavioral data collected about them, the DPA held that the interests of the data subjects do not override the interests of Bonnier. In this case, the DPA considered that the individuals could reasonably expect such processing and took into consideration that the data was only disclosed to affiliated companies within the Bonnier group, and that the data did not include information collected through cookies (behavioral data).
Consequently, the DPA found that Bonnier had processed personal data in breach of Article 6(1)(f) GDPR when the interests of data subjects were found to outweigh the interests of Bonnier, and imposed a fine of 13 000 000 (thirteen million) SEK (approx. € 1 094 000) on Bonnier.
Comment
This case concerned cross-border processing, and thus, the DPA applied the cooperation and consistency mechanisms provided for in the GDPR. The supervisory authorities concerned were the authorities of Denmark, Estonia, Finland, Norway and Germany.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1(29)
Bonnier News AB
105 15 Stockholm
Diary number: Decision after supervision according to
DI-2019-11737
data protection regulation – Bonnier
Date: News AB
2023-06-26
Content
1. The Privacy Protection Authority's decision............................................... ..........................3
2. Statement of the supervisory matter ............................................... .....................................3
2.1 Description of the group-wide personal data processing......4
2.1.1 Description of the processing of personal data contained in
the behavior database ................................................... ................................5
2.1.2 Description of the processing of stored personal data
in KDB................................................ ................................................... .......6
3. Justification of the decision................................... ................................................ ..8
3.1 IMY's authority................................................ ..............................................8
3.1.1 Current circumstances................................................ ......................8
3.1.2 Applicable regulations, etc. ................................................ .....8
3.1.3 IMY's assessment ........................................... ...................................9
3.2 Bonnier News AB's responsibility for personal data............................................ ..........9
3.2.1 Current circumstances and Bonnier News AB's approach.........9
3.2.2 Applicable regulations, etc. ................................................... .....9
3.2.3 IMY's assessment ........................................... ................................10
3.3 What information constitutes personal data?............................................. .............10
3.3.1 Current circumstances and Bonnier News AB's approach.......10
Postal address: 3.3.2 Applicable regulations and other general starting points....10
Box 8114
104 20 Stockholm 3.3.3 IMY's assessment............................................ ................................12
3.4 The processing constitutes profiling............................................... .......................13
Website:
www.imy.se 3.4.1 Applicable regulations ......................................... ......................13
E-mail:
imy@imy.se 3.4.2 IMY's assessment ....................................... .....................................13
Phone:
08-657 61 00 2
3.5 Legal basis for processing for the purpose of displaying customized advertisements from outside
data in the behavior database .............................................. ..........................13
3.5.1 Current circumstances and Bonnier News AB's approach.......13
3.5.2 Applicable regulations, etc. ................................................... ...15
3.5.3 Starting points for IMY's assessment............................................ ...17
3.5.4 Legitimate interest ............................................. ............................19
3.5.5 Is the processing necessary for the legitimate interest?.............19
3.5.6 The balancing of interests for the processing of personal data i
supplemented behavioral profiles ................................................ ..............19
3.5.7 Balance of interests for the processing of personal data in simple
behavioral profiles ................................................... .....................................21
3.6 Legal basis for processing for the purpose of making available contact information for
telephone sales and postal direct marketing............................................21
3.6.1 Applicable regulations, etc. ................................................... ...21
3.6.2 Current circumstances and Bonnier News AB's approach.......22
3.6.3 IMY's assessment ........................................... ................................24
3.6.4 Is Bonnier News AB's interest in profiling individuals for the purpose of
make data available to affiliated companies for use in
telephone sales and postal direct marketing eligible?...............24
3.6.5 Is the processing necessary for the purpose of profiling individuals
to make information available to companies for use in
telephone sales and postal direct marketing?................................24
3.6.6 Balance of interests for processing personal data i
completed customer database profiles................................................... .........24
3.6.7 Balance of interests for personal data without connection to
the behavior database ................................................... ..............................25
3.7 Choice of intervention............................................... ..........................................26
3.7.1 Applicable regulations and other general starting points....26
3.7.2 Same or connected data processing...................26
3.7.3 Penalty fee............................................... ................................26
Appendix ................................................ ................................................... ...28
Copy to................................................ ................................................... .28
4. How to appeal ............................................ ................................................ ...29 3
1. The Data Protection Authority's decision
The Privacy Protection Authority notes that Bonnier News AB (559080-0917) under
the period from 7 November 2019 to 11 June 2020 has processed personal data
without having a legal basis for it according to article 6.1 of the data protection regulation through
a) to process personal data for the purpose of profiling the registered based on
their behavioral data in so-called supplemented behavioral profiles and
make the profiles available to affiliated companies in order to show customized
Adverts,
b) to process personal data for the purpose of profiling the registered based on
their behavioral data in so-called simple behavioral profiles and make available
the profiles of affiliated companies for the purpose of displaying customized advertisements,
c) to process personal data by profiling the registered based on
their completed customer database profiles for the purpose of making available
contact details for affiliated companies for telephone and postal sales
marketing.
The Privacy Protection Authority decides with the support of articles 58.2 and 83 i
the data protection regulation that Bonnier News AB must pay an administrative
penalty fee of 13,000,000 (thirteen million) kroner.
2. Statement of the supervisory matter
The Swedish Privacy Protection Agency (IMY) has in a supervision against former Bonnier Magazine and
Brands AB, now Expressen Lifestyle (dnr DI-2019- 6523) noted that
Bonnier News AB together with other companies within the Bonnier Group processes
personal data for e.g. marketing purposes supported by the legal basis
legitimate interest according to Article 6.1 f of the data protection regulation. IMY has initiated supervision of
Bonnier News AB for the purpose of investigating whether Bonnier News AB complies
the data protection regulation's requirements for the processing of personal data that takes place for
marketing purposes.
Within the framework of this supervision, Bonnier News AB has had to comment on seven complaints
submitted to IMY regarding various marketing measures taken by companies within
The Bonnier Group. Bonnier News AB has commented on the complaints and it has then
revealed that the marketing measures taken have not been caused by withdrawals from
the group-wide databases and also did not happen under Bonnier News AB's
personal data responsibility. Against this background, IMY finds no reason to within the framework of
this matter investigate these complaints further.
IMY has, within the scope of supervision, examined whether Bonnier News AB has a legal basis
according to article 6 of the data protection regulation for the personal data processing that takes place in
the group-wide databases for marketing purposes. Supervision
includes the processing of personal data that takes place by creating profiles and
making such data available for use by affiliated companies for
to display personalized ads. It also covers the processing of personal data,
1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regarding the processing of personal data and on the free flow of such data and on the cancellation of
directive 95/46/EC (General Data Protection Regulation).
2DI-2018-22602, DI-2019-10121, DI-2019-10513, DI-2019-11057, DI-2019-7484, DI-2019-8104 and DI-2019-9556 4
creation of profiles and making information available to affiliated companies for the purpose of
used by affiliated companies for telephone sales and postal direct marketing.
IMY has not taken a position on Bonnier News AB's processing of personal data in general
complies with the data protection regulation.
The supervisory case began with an inspection on November 7, 2019. In connection with
IMY sent the inspection report to Bonnier News AB, IMY provided additional information
questions to the company on 20 December 2019. Bonnier provided comments on
the inspection protocol and submitted with answers to IMY's questions on 14 February 2020. IMY
asked additional supplementary questions to Bonnier News AB on 15 May 2020, which
the company submitted a response on June 11, 2020. Due to the fact that Bonnier News AB
updated its personal data policy, the company came in with supplementary information
on July 21, 2020.
Bonnier News AB has commented on IMY's draft decision on April 13, 2023.
Since the case concerns cross-border treatment, IMY has used them
cooperation and consistency mechanisms found in Article 56 and Chapter VII i
data protection regulation. The supervisory authorities concerned have been the authorities in
Denmark, Estonia, Finland, Norway and Germany.
2.1 Description of the group common
the processing of personal data
The following has emerged during the inspection and subsequent exchange of letters. Within
The Bonnier Group is a collaboration between Bonnier News AB and a number of affiliates
companies that are part of the group (the affiliated companies). Which companies are connected
changes over time. At the time of the inspection, there were 15 affiliated companies which
in the spring of 2020 fell to 8. The processing of personal data that takes place within
the scope of the collaboration is limited to refer to the affiliated companies' customers on it
Swedish market. The affiliated companies collect personal data from their customers
and people who visit the companies' websites. The collected data is transferred
to two group-wide databases, a customer database (KDB) and a
behavior database (the behavior database). In these databases, profiles are created about individuals
people. The profiles are also linked to information taken from Bisnode Sverige AB.
Bonnier News AB has stated that it stores collected data in them
the group-wide databases to use for the following purposes:
• To establish a common customer register for affiliated companies with approval
data quality, which includes compiling customer and
user data and to check that the data is correct,
updated and appropriate
• To offer the affiliated companies' customers a simple way to redeem theirs
rights and an opportunity to ask questions about personal data to it
joint customer service
• To make personal data available to affiliated companies in order to:
• Use other affiliated companies' contact details to be able to
market the affiliated companies' own products and services
through direct mail marketing and telephone sales. 5
• Show custom content and custom ads in the affiliates
the companies' digital services, based on customers' and users'
customer profile and behavior on the affiliated companies' sites.
• Perform analysis of customer data in order to, using obtained customer insight
carry out customer communication, marketing of their own products,
services and service.
• Perform analysis of customer data in order to improve and develop existing ones
services and products.
The personal data processing that takes place for the purpose of adaptation of affiliated companies
ads are based on data stored in the behavioral database. The
personal data processing that takes place to disclose personal data to affiliated companies
for use in telephone sales and direct mail marketing is based on
data in KDB.
2.1.1 Description of the processing of personal data contained in
the behavior database
The investigation into the matter shows the following.
The information contained in the behavioral database is processed for the purpose of displaying customized information
content and customized advertisements in the connected companies' digital services.
In connection with an individual visiting an affiliated company's website, it collects
the affiliated company enters information about the individual's surfing behavior. This is done by
the affiliated company has placed a script on its web page requesting to save one
text file (web cookie) on the visitor's computer, tablet or mobile phone. The information in
the web cookie can be used to track the user's browsing on the website. The
information (behavioral data) that is collected when the individual surfs and then transferred to
the behavior database and added to the individual's profile is:
• Details of the visited page's URL (web address), its category and a
content tag .
• Details of the user's device type in which the page was viewed,
browser type and the part of the user's IP address that refers to country,
• Data on behavior in the form of time spent and time of
the page view,
• Statement of a unique randomly generated web cookie value (below
called cookie identifier),
• Information on whether the page was viewed in logged-in mode.
Bonnier News AB deletes the cookie identifier after 30 days and from today
31, the generated behavioral data is no longer used for the adaptation of advertisements to
individuals.
Data in the behavior database and in the KDB can in some cases be linked together.
3A content tag is a description of the content that has been consumed in the participating companies' services. Bonnie
News AB collects two types of tags, predefined according to the IAB's (The Interactive Advertising Bureau) standard and
tags produced by the affiliated companies' editorial offices. 6
When the data in the behavior database cannot be linked with data in the KDB
the data subject's behavioral profile consists only of the data listed above, a
profile which in this decision will be called simple behavior profile.
In cases where data in the behavior database and data in the KDB can be linked in
the behavior database is supplied with data from KDB on purchase history gender, age, household's
car ownership and zip code, as well as statistical variables based on the individual
residential area such as life phase, purchasing power and form of living to the behavioral database.
These profiles will henceforth in this decision be referred to as supplemented
behavioral profile.
The availability to affiliated companies takes place through a search tool linked to
the behavioral database where the affiliated company can order a segment of
customer data based on their chosen variables. An administrator reviews the order
fulfills certain criteria determined within the collaboration. If so, it gets connected
the company access to a code that makes it possible to target ads to users who
included in the segment.
The affiliated companies can only retrieve information from the behavioral database based on
on behavioral data collected from the company's own digital services. It applies regardless
whether it is a simple or supplemented behavioral profile. As for it
supplemented the behavioral profile, however, it may also contain purchase history from others
affiliated companies. In KDB, information is thinned out after two years, which is why older information cannot
linked to the behavioral database or disclosed to affiliated companies.
2.1.2 Description of the processing of personal data stored in KDB
The investigation into the matter shows the following.
The information about individuals that is in KDB is processed for the purpose of being used for affiliates
the company's marketing of its own products and services by postal mail
direct marketing and telephone sales.
In connection with an individual making a purchase or signing a subscription, it collects
affiliated companies that have a contractual relationship with the customer enter information from him. Some of
this data is transferred to KDB. In KDB, information is linked to a profile. In KDB
the customer profile is assigned a KDB ID. If the connected company's customer already exists
registered in KDB, the existing customer profile is updated/supplemented with the new one
the commitment. Otherwise, a new customer profile is created with a new KDB ID. The data
which are stored in KDB and which are collected from the customer's contact with the connected
the company's name, address, telephone number, social security number, e-mail address and information
which are linked to the customer's purchase, such as product category, brand, type of
packaging (if it is a digital or traditional item and if it is a free or
paid product). In KDB, it is also registered if the customer has objected to data in
KDB is used for marketing as well as information on whether the customer has registered in it
called the NIX registry. For the following categories of data there are restrictions:
• Information about e-mail address is not disclosed to affiliated companies at
telephone sales and postal direct marketing.
• Information about social security number is only used to check whether the customer has
registered to oppose marketing in the NIX registry (NIX block) as well
to check that the customer is not deceased.
• Information on social security numbers is not made available to the affiliated companies. 7
In addition to the data collected by the affiliated companies, Bonnier News collects
AB enters information from Bisnode Sverige AB for the purpose of checking and supplementing
individuals' contact details, as well as to add statistical data such as life phase, purchasing power
and form of accommodation. Furthermore, information is collected on car ownership and on deceased persons
as well as information about a so-called GEDI ID (which is a unique identifier in the form of a
pseudonymised ID).
Data in the KDB and the behavior database can in some cases be linked together in the KDB as well.
The profile then constitutes what in this decision below will be called supplemented
customer database profile. This is done by a customer of an affiliated company visiting
the company's website and logs into their account with the company. The behavioral data that has
collected about the customer and which is linked to a cookie identifier can then under
certain prerequisites are linked with the customer's KDB–ID. In cases where the customer's KDB
The ID and the cookie value can be linked together if the KDB profile is supplemented with
data collected in the last 30 days from the behavioral database. The data
that is retrieved is information about which websites the customer has visited, which section
on the website the customer visited (so-called content tags), as well as which device type
the customer surfed from. Bonnier News AB has limited the type of content tags that
companies other than the one whose website the individual surfed on can base their profiling on
4
for the purposes of telephone sales and postal direct marketing.
When a person ceases to be a customer of an affiliated company, KDB is notified that
the customer's commitment has ended and the customer is flagged as a passive customer. Then deleted
the customer's data in KDB after two years. Data obtained from the behavioral database
thinned after 30 days. Any NIX block is always activated when making available
contact details in KDB for customers of other affiliated companies and contact details for own
customers when these have been inactive for 12 months.
Information is made available to affiliated companies upon request through an application in KDB. IN
KDB creates a selection file based on the criteria specified by the affiliated company. Within the scope of
the collaboration applies something called purpose-adapted schedules. These regulate
what information is disclosed from KDB. In the case of disclosure, only those are left
data points defined as necessary for the marketing channel that
specified at the time of disclosure, i.e. for example telephone numbers in the case of telephone sales
campaign and address for postal direct marketing. The data points that
the segmentation is based on, is not disclosed. The data is made available through a
interface in KDB to the connected company.
It is possible for the registered person to request deletion from KDB. It registered
also has the right to object to the data being used for telephone and postal sales
direct marketing.
Bonnier News AB has stated that all affiliated companies are majority owned by Bonnier
Group AB and subordinate Bonnier Group's framework for personal data processing
and that only a small part of the profiles in question have been able to be made one
connection to data in the behavior database.
4Only tags categorized with the IAB's taxonomy are collected. 8
3. Justification of the decision
3.1 IMY's authority
3.1.1 Current circumstances
Part of the personal data that is processed within the group
the collaboration has been collected by affiliated companies placing a cookie on
the visitor's computer, tablet or mobile phone. Bonnier News AB has stated that
the collection is done through affiliated companies' websites. The affiliated companies transfer
then this data to the behavior database and in some cases the data is linked
also together with profile information in KDB. Bonnier News AB has stated that they
obligations that resulted from the provisions of the Act (2003:389) on electronic
communication and now follows from the Act (2022:482) on electronic communication
(LEK), meets affiliated companies and not Bonnier News AB because it is those companies
who is responsible for the actual collection of the data.
3.1.2 Applicable regulations, etc.
It follows from Article 95 of the Data Protection Regulation that the Data Protection Regulation shall not
entail any additional obligations for natural or legal persons who
processes personal data, for such areas that are already covered by obligations
according to the so-called eData protection directive. The eData Protection Directive has been implemented in
Swedish law through LEK, where, among other things, collection of information through web cookies
regulated.
According to ch. 9 Section 28 LEK may store data in or retrieve from a subscriber's or
user's terminal equipment only if the subscriber or user gets access to
information about the purpose of the treatment and consent to it. Furthermore, it appears
that this does not prevent such storage or access as is necessary to transfer one
electronic message via an electronic communication network or which is necessary
to provide a service that the user or subscriber expressly has
requested. Before August 1, 2022, when LEK entered into force, corresponding requirements were made
according to ch. 6 Section 18 of the Act on (2003:389) on electronic communications. It's Post-
and the Swedish Telecom Agency (PTS), which is the supervisory authority according to LEK (chapter 1 § 5 of the regulation
[2022:511] on electronic communication).
The EDPB has commented on the interaction between the eData Protection Directive and
6
the data protection regulation. From the opinion, i.a. follows that the national regulatory authority
appointed under the eData Protection Directive is solely authorized to monitor compliance
of the directive. However, according to the data protection regulation, the supervisory authority is competent
supervisory authority for the processing that is not specifically regulated in the eData Protection Directive.
If only part of the processing falls under the eData Protection Directive, does not limit
this the authority of the data protection authority to test other parts of the processing
according to the data protection regulation. 7
This means, among other things, that the supervisory authority according to the data protection regulation is
authorized to assess the legality of the personal data processing that takes place after
the information is retrieved from the individual's terminal equipment, e.g. storage of collected
5 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 on the processing of personal data and
privacy protection in the electronic communications sector (Directive on Privacy and Electronic Communications).
6Opinion 5/2019 on the interaction between the directive on privacy and electronic communications and the general
the data protection regulation, especially with regard to the competence, tasks and powers of the data protection authorities,
adopted on 12 March 2019
7 See points 68 and 69 of the opinion. 9
data and analysis of such data for purposes related to behavioral advertising
8
online.
3.1.3 IMY's assessment
The information added to the behavioral database has been collected by the affiliated companies
through cookies. The personal data processing that is reviewed in this supervisory matter
is Bonnier News AB's subsequent processing of personal data i
the behavior database. That processing is not covered by the regulation in LEK or the
previously applicable regulations in the Act on (2003:389) on electronic communications.
This means that the regulation in the data protection regulation is applicable to the processing and
that IMY is the competent supervisory authority.
3.2 Bonnier News AB's responsibility for personal data
3.2.1 Current circumstances and Bonnier News AB's attitude
It is Bonnier News AB's opinion that Bonnier News AB and the respective affiliate
companies have joint personal data responsibility for the processing that takes place in KDB
and the behavioral database for the purposes listed above as common.
Furthermore, Bonnier News AB has stated that Bonnier News AB and affiliated companies have a
common view of goals and means and that Bonnier News AB has entered into so-called Joint
Data Controller Agreement with the affiliated companies in accordance with Article 26.2 i
data protection regulation.
Bonnier News AB has stated that each affiliated company has its own independent
("local") personal data responsibility for its own collection of data. Bonnier News AB has
further stated that it has no joint personal data responsibility for them
personal data processing that is carried out after the data has been disclosed to
affiliated companies from the common databases. It is the affiliated company which
retrieved the data who is responsible for personal data for the treatments like this
company carries out after collection.
3.2.2 Applicable regulations, etc.
According to Article 4.7 of the data protection regulation, the person responsible for personal data is the person alone
or together with others determine the purposes and means of the processing of
personal data. That means and ends can be determined by more than one actor means
that several actors can be responsible for personal data for the same processing.
According to Article 4.2 of the Data Protection Regulation, processing is an action or
combination of measures concerning personal data or sets of
personal data.
In the Fashion-ID case, the European Court of Justice has found that a website owner who
using plug-ins from social networks on their website can become common
personal data controller with the social network. This applies to the collection as well
the disclosure by transmission of the website visitors' personal data which
takes place with the help of the social network plug-in. The court also stated that
each party is only responsible for the parts of the processing chain that it actually
9
definite end and means for.
8 See point 75 of the opinion.
9 See judgment Fashion-ID, C-40/17, EU:C:2019:629, paragraphs 64-85 10
In the Wirtschaftsakademie case, the European Court of Justice stated that a joint responsibility for a
treatment does not necessarily mean that the various actors involved in
10
the processing of personal data has the same responsibility. These actors can do the opposite
involved in different stages of the processing of personal data to varying degrees, and where and
one's level of responsibility must be assessed taking into account all the relevant circumstances therein
individual case.
3.2.3 IMY's assessment
Bonnier News AB provides two databases, KDB and the behavior database, there
information from affiliated companies is combined into profiles of individuals. Under them
prerequisites that Bonnier News AB and the companies determined, the information is made
available to Bonnier News AB and respective affiliated companies.
IMY notes that, in addition to making the databases available to the affiliated companies,
Bonnier News AB, together with the companies, has set up the framework for the processing of
different ways.
IMY therefore makes the assessment that Bonnier News AB is joint
personal data controller with the affiliated companies for that part of
the personal data processing that takes place for the common purposes of
make personal data available, through profiling of individual data, to connected
company to display customized ads and for use in telemarketing and
postal direct marketing. This includes collecting data for the databases,
the storage in the databases and the profiling, obtaining additional data from
Bisnode Sverige AB, the connection between the behavior database and KDB
as well as the transfer of data between the databases. Further is Bonnier
News AB jointly responsible for personal data with the affiliated companies for them
measures that take place before and during a disclosure to an affiliated company.
3.3 What information constitutes personal data?
3.3.1 Current circumstances and Bonnier News AB's attitude
Under the section “Description of the group common
the processing of personal data" it is clear that a lot of data collected from
individuals are processed in the KDB and the common behavior database. Bonnier News
AB considers that what is referred to in this decision as a completed behavioral profile constitutes
personal data. In contrast, data in the behavior database - which cannot be linked
together with data in KDB - according to Bonnier News AB anonymous behavioral data. This
because they cannot be linked to a person either via KDB ID, customer ID, IP address or
any other identifier for a person. Bonnier News AB thus believes that they
behavioral profiles which in this decision are referred to as simple behavioral profiles do not constitute
personal data. The segmentation that is done on these simple profiles is, according to Bonnier
News AB, based only on the affiliated company's own collected information i
the behavior database (a company can, for example, choose to sports-related content and advertisements
must be adapted to the data registered via a web cookie during the last
the 30 days).
3.3.2 Applicable regulations and other general starting points
According to Article 4.1 of the Data Protection Regulation, personal data is any information which
refers to an identified or identifiable natural person (ie the data subject). Of the same
provision states that an identifiable natural person is a person who directly or
10 See judgment Wirtschaftsakademie, C-210/16, EU:C:2018:388, paragraph 43 11
indirect can be identified especially by reference to an identifier such as a name, one
identification number, a location data or online identifiers or a or
several factors specific to the natural person's physical, physiological,
genetic, psychological, economic, cultural or social identity.
According to recital 26 of the data protection regulation, the principles of data protection should apply to everyone
information relating to an identified or identifiable natural person. Personal data
which has been pseudonymised and which could be attributed to a natural person through
that supplementary information is used should be considered as information about an identifiable person
physical person. To determine whether a natural person is identifiable, all should be considered
aids, such as thinning out, which, either by the data controller or
by another person, may reasonably be used to directly or indirectly
identify the natural person. To determine whether aids with reasonable
probability may be used to identify the physical person should one
take into account all objective factors, such as costs and time required for identification,
taking into account the technology available at the time of the treatment as well as the
technological development. According to reason 26, the principles for data protection should not apply to
anonymous information that does not relate to an identified or identifiable physical
person, or for personal data that has been anonymized in such a way that it
registered is no longer identifiable. The regulation therefore does not affect the treatment of
such anonymous information, which includes information for statistical purposes or
research purposes.
According to recital 30 of the data protection regulation, natural persons can be linked to
network identifiers provided by their equipment, applications, tools and protocols;
for example IP addresses, cookies or other identifiers, such as radio frequency tags. This can
leave traces that, especially in combination with unique identifiers and other data
received by the servers, can be used to create profiles of natural persons
and identify them.
11
From an opinion of the Article 29 Working Party, which contains an analysis of
the concept of personal data, it appears that a natural person in a group is considered "identified"
12
when he or she can in some way be "distinguished" from other persons. European
The Danish Data Protection Agency (EDPB) has in its guidelines on targeted advertising in social media
found that even people who use a social media service without having created
an account or profile with the social media service may constitute registrants therein
meaning referred to in Article 4.1 of the Data Protection Regulation if the person is directly or
13
indirectly identified or identifiable. The EDPB has referred to the concept
"thinning" in recital 26 to the data protection regulation and to the above-mentioned opinion from
Article 29 Group.
In the Article 29 group's opinion regarding behavioral advertising on the Internet is developed
further what it means to be identifiable:
The Article 29 Group notes that behavioral advertising often leads to
Processing of personal data. Behavioral advertising normally includes
collection of IP addresses and processing of unique identifiers (by
the cookie). The use of such functions with a unique identifier does so
11The so-called the Article 29 Group was an advisory and independent working group consisting of representatives of
the supervisory authorities in the EU and EEA. , The group had the task of, among other things, recommendations contribute to a
uniform application of the data protection directive. On 25 May 2018, the working group was replaced by European
Data Protection Board, EDPB.
12See WP 136. Article 29 Group Opinion 4/2007 on the concept of personal data, adopted on 20 June 2007, p 12 f
13 See EDPB guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted 13 April 2021, p 19 12
possible to track users of a particular computer even if dynamic IP addresses
is used. In other words, such functions make it possible to "point out" individuals
registered, even if their names are not known. Furthermore, the information relates
which is collected in behavioral advertising to (that is, about) a
person's characteristics or behavior and is used to influence this specific
person. This point of view is further strengthened if one considers the possibility that
profiles at any time can be linked to directly identifiable information such as
provided by the data subject, for example information specified at
registration on a website. Other scenarios that can lead to identifiability are
mergers, data loss and the growing accessibility of the Internet to
personal data linked to IP addresses. 14
3.3.3 IMY's assessment
IMY initially states that the completed behavioral profiles (i.e.
behavioral profiles linked to KDB) contain information relating to identified persons
or identifiable natural persons. The complementary behavioral profiles are thus
personal data.
In the case of the simple behavioral profiles (ie behavioral profiles without connection to
KDB) IMY makes the following assessment.
In order for a piece of data to be qualified as personal data, it is first required that
the information relates to a natural person. This requirement is met with respect to simple
behavioral profiles because the data describes how the individual surfed with a number
different parameters.
Furthermore, it is required that the natural person is identified or identifiable. Of Article 4.1 i
the data protection regulation states that it is sufficient that a person can be identified indirectly. IN
the provision further states that identification can be made by reference to a
online identifier. Recital 30 of the regulation states cookies ("cookie identifiers" in it
the English language version) as an example of a network identifier. Identification in it
meaning referred to in Article 4.1 can thus take place with the help of such unique
cookie values used in the behavior database.
IMY further notes that it appears from recital 26 to the data protection regulation that
thinning is a way of identifying a person. This means that a person can
identified by being distinguished from other persons. It is therefore not required to
the person is identified by name or social security number. Such a distinctive or
thinning occurs when the information being processed makes it possible to point out, draw
conclusions about or take specific actions in relation to a user.
In the behavioral database, the information is linked with a unique identifier, a unique
cookie value, which is linked to a specific browser or app, which in turn is
connected to a device such as a computer or telephone. One of the purposes of the treatment of
the data is to, on the basis of the user's behavior, target marketing to a
user based on that particular user's past behavior in an identified
browser or app. The purpose of the treatment is thus to draw conclusions about it
individual by creating a profile and based on this influence the individual. IMY
thus states that even the simple behavioral profiles that are not connected with
KDB means that individuals are identifiable.
14See WP 171, Article 29 Working Party Opinion 2/2010 on Behavioral Advertising on the Internet, adopted on 22 June
2010, p. 9 f
15 See WP 136. f Article 29 Group opinion 4/2007 on the concept of personal data, adopted on 20 June 2007 p. 12 13
Against this background, IMY makes the assessment that the simple behavior profiles constitute
personal data.
3.4 The processing constitutes profiling
3.4.1 Applicable regulations
Profiling is defined in Article 4.4 of the Data Protection Regulation as any form of
automatic processing of personal data which consists of personal data being used for
to assess certain personal characteristics of a natural person, in particular to
analyze or predict this natural person's work performance, financial
situation, health, personal preferences, interests, reliability, behavior, whereabouts
or transfers.
3.4.2 IMY's assessment
IMY notes that both the processing of personal data based on simple
behavioral profiles and supplemented behavioral profiles that take place for the purpose of
make the data available to affiliated companies in order to display customized advertisements
includes profiling of data subjects as defined in Article 4.4 i
data protection regulation. This is because it is a question of automatic processing of
personal data aimed at categorizing the registrants based on their past
behavior pattern which in turn makes it possible to assess some of their personal
characteristics.
IMY further notes that the processing of personal data that takes place for the purpose of
make available contact details for telephone sales and postal direct marketing
includes profiling of data subjects as defined in Article 4.4 i
data protection regulation. This is because it is a question of automatic processing of
personal data for the purpose of categorizing the registrants based on their purchase history and i
in some cases also behavioral patterns.
3.5 Legal basis for processing for the purpose of displaying customized
advertisements based on information in the behavioral database
3.5.1 Current circumstances and Bonnier News AB's attitude
Bonnier News AB has stated that within the group it has coordinated its activities for
to achieve a better data basis and make it possible to process the customers' and
users' personal data for specified purposes in a cost-effective and
privacy-friendly way. Bonnier News AB uses its profiling of individuals to
make information available to affiliated companies for the purpose of displaying customized advertisements on
collected behavioral data that cannot be linked to KDB, partly on behavioral data where a
such connection can be made and where additional personal data is added it is registered
profile. Bonnier News AB supports its processing to make information available to connected users
company for the purpose of displaying customized advertisements on the legal basis in Article 6.1 f i
data protection regulation.
Legitimate interest
Bonnier News AB has stated the following.
The company has a legitimate interest that consists in a need to understand its customers and
users' wishes and needs in order to achieve relevance in content and
advertising that is aimed at customers and users and thereby be able to offer
competitive products/services and attractive advertising space. Many of the connected
the companies also engage in journalistic activities. Publicists' business model of 14
today consists of revenue streams from readership and advertising revenue. The
Group-wide personal data processing is important for the financing of
the companies' journalistic activities. Bonnier News AB has also pointed to the protection for
freedom and diversity of the media in Article 11 of the EU Charter on the fundamentals
the rights.
Necessary treatment
Bonnier News AB has stated that the processing of personal data is necessary to
achieve the purposes of making individuals' profiles available to affiliated companies for viewing
customized ads. The company, together with the other companies, has taken measures
to minimize the number of collected data and limit the duration of this data
processed and ensured that the databases are kept separate and that only certain data
transferred in between.
Balance of interests
Bonnier News AB has stated the following.
Bonnier News AB's interest outweighs the individual's interest in protection for their own
personal data.
Processing of personal data to display customized advertisements based on it
an individual's profile is a basic prerequisite for journalists and publicists to be able to obtain
income and, by extension, be able to conduct journalism.
It is possible to object to profiling based on behavioral data. According to it
information that individuals receive in Bonnier News AB's personal data policy it can
individuals object to information about their online behavior being processed in it
16
common customer database. This means that the connection between the individual
customer data and their surfing behavior are deleted.
Those registered have a direct relationship with one or more affiliated companies.
The users/customers have either visited an affiliated company's website, purchased
products of an affiliated company or an active digital subscription. Many of
the customers are subscribers who have a long-term relationship with the company that
provides the service or product and can therefore be considered to have a greater expectation of
that their data is processed. Many readers have a strong commitment to theirs
preference for news media. To a certain extent, customer profiles in KDB belong to piece purchases such as
literature, newspaper and merchandise purchases. In these cases, the relationship between customer and supplier gets
considered somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided
and there are alternative products such as physical newspapers that one can partake of completely
anonymously.
The processing is unlikely to have any negative impact on the data subject's interests.
Individuals interacting with affiliated companies is voluntary and it is in their interest to
the companies' services are as relevant as possible. Furthermore, Bonnier News AB has referred to
that the Article 29 Group found that targeted marketing based on simple
customer profiles, such as gender, age, place of residence and broad interests (eg "fashion") typically
seen not to have any significant impact on the individuals. Bonnier News AB has further
taken measures to ensure that a minimum of data is processed in relation
for the purposes and to reduce integrity risks in general. Among other things shared
the personal data not with companies other than the affiliated companies within the group and
16The version of Bonnier News AB's personal data policy that was submitted on 21 July 2020, see under the heading "How you
accesses and controls your personal data", file attachment 20.1. 15
all of these companies are subject to the Bonnier Group's framework for
17
personal data processing.
The current processing is within the data subject's reasonable expectations
of the fact that the individuals who come into contact with the companies do so of their own free will in order to take
part of content on websites, buy services and/or products and that they always have one
customer/user relationship with one or more companies in the group. The company's
personal data policies contain clear information about how customers and users
personal data is processed and shared within the group. The treatment that is carried out
within the framework of KDB and the behavioral database is closely associated with the companies' services
and products, which is likely to have an impact on consumer expectations. That many of
the companies' products and services are online and in many cases free or
ad-financed should entail a special expectation and acceptance for certain
personal data processing for e.g. customization of content and advertising. Today is
also many digital products that are consumed by a very large part of
consumers in society adapted to the individual and that is Bonnier News AB's
perception that today's consumers expect the digital products and services
which they consume to some extent will be tailored to the individual.
3.5.2 Applicable regulations, etc.
Personal data must be processed in a legal, correct and transparent manner in relation to
the data subject, according to Article 5.1 a of the data protection regulation. That the data should
processed legally means i.a. that at least one of the conditions stated in Article 6.1 is
fulfilled.
Consent is, according to Article 6.1 a, one of the legal grounds that a
The personal data controller can support its processing of personal data at Another
legal basis is legitimate interest according to Article 6.1 f , which requires that three
cumulative conditions are met. It must (i) have a legitimate interest
personal data controller or with a third party to whom the data is disclosed, (ii)
the processing of personal data must be necessary for the legitimate interest which
is pursued and (iii) the data subject's interest in the protection of his personal data may
not weigh heavier. 18
Recital 47 of the data protection regulation states that a legitimate interest can, for example
exist when there is a relevant and appropriate relationship between the data subject
and the personal data controller, for example if the data subject is a customer of it
personal data controller. It is stated that the processing of personal data for
direct marketing can be considered a legitimate interest. Furthermore, it is stated that a
legitimate interest requires a careful assessment, which includes whether it
registered at the time and in connection with the collection of personal data
can reasonably expect that processing for the stated purpose may take place. The
data subject's interests and fundamental rights could weigh in particular
heavier if personal data is processed in circumstances where the data subject is not
can reasonably expect some further treatment.
According to ch. 9 § 28 LEK, which implements Article 5.3 of the eData Protection Directive in Swedish law,
may data be stored in or retrieved from users' or subscribers' terminal equipment
only if the subscriber or user gets access to information about the purpose of
the treatment and consent to it. This does not prevent such storage or access
which is needed to transmit an electronic message via an electronic
17Further measures taken can be seen from the opinion filed on February 14, 2020, file appendix 13, in appendix O
18 See, Judgment in Fashion ID, C-40/17, EU:C:2019:629, point. 95. 16
communication network or which is necessary to provide a service which
the user or subscriber has expressly requested. Corresponding requirements previously applied
according to ch. 6 § 18 of the Act (2003:389) on electronic communications.
It appears from the EDPB's guidelines on connected vehicles that data collected on
basis of consent in accordance with Article 5.3 of the eData Protection Directive or covered
of the exceptions in Article 5.3 of that directive can only be further processed for another
purposes, if the person in charge of personal data requests further consent or has support in
Union law or the legislation of a Member State. The EDPB further states that such
further processing cannot rely on a compatibility test according to Article 6.4 i
the data protection regulation because it would undermine the protection in
eData Protection Directive. Furthermore, the EDPB states that a consent must, when required by
eData Protection Directive, be specific and informed, which means that the registered
must be aware of each processing purpose and have the right to refuse specific purposes.
If further processing on the basis of a compatibility test according to Article 6.4 i
the data protection regulation would be possible would the very principle of consent requirements
in the current directive is circumvented. 20
In the EDPB's guidelines on targeted advertising in social media, personal data is divided into
the categories of data that it actively recorded and knowingly provided to it
personal data controller, observed data provided by the data subject
through use of the Service or Device and derivative and derived data that
21
created on the basis of the data provided by the data subject. According to the EDPB
there are two legal bases that may come into question for processing such data
which the data subject actively and knowingly provided, namely consent according to 6.1
a and legitimate interest according to 6.1 f of the data protection regulation. When it comes to data
which was collected through observed data provided by the data subject
through use of a Service or Device, including that collected through
cookies, the EDPB states that Article 6.1 f cannot constitute a legal basis for such directed
advertising where individuals are tracked across multiple websites and locations. 22
Furthermore, the EDPB states that for such processing, consent is probably the most appropriate
the legal basis in Article 6 of the Data Protection Regulation. In the assessment, one must move on
take into account that the processing includes activities that the legislator in the EU has wanted to provide
additional protection.23
The EDPB has stated in its guidelines on consent that if the data controller chooses
to invoke consent for any part of the processing they must be prepared to
respect this choice and stop this part of the processing about an individual
revokes his consent. It would be fundamentally unfair to the data subjects to give
the message that the data will be processed based on consent while
one actually refers to another legal basis. In other words, don't get it
personal data controller change the legal basis from consent to other legal grounds.
The EDPB further states that, for example, retroactive fair use is not permitted
interest as a basis for justifying the treatment, if there have been problems with
obtain valid consent. Due to the requirement that the data controllers must
19 See Guidelines 01/2020 on the processing of personal data in connection with connected vehicles and
Safety-related applications, Version 2.0, Adopted on 9 March 2021, paragraph 53
21 See previous note
22 See EDPB guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted 13 April 2021, point 40
See previous note, point 77
23 See previous note point 78 17
specify a legal basis when the personal data is collected, they must have determined which one
the legal basis is before they collect the data. 24
In an opinion of the Article 29 Working Party on the concept of legitimate interest in directives
95/46/EG it appears that when carrying out the balancing of interests should be taken into account
what type of interest is stated, what damage the personal data controller would
hit by whether the data was not processed, the nature of the data, how
the personal data is processed, the position of the data subjects and the
the position of the data controller, the data subject's reasonable expectations of what
will happen to their data and the consequences for the data subjects. If
that, after the above factors are analyzed, it is still unclear how this
trade-off occurs, the design of the so-called additional protective measures are essential
for the outcome in the balancing of interests. 25
In the Article 29 Working Party Guidelines on Automated Individual Decision-Making and
profiling is given guidance when profiling can be based on legitimate interests according to
6.1 f. According to the guidelines, the following factors are relevant:
• How detailed the profile is.
• How extensive the profile is.
• The consequences of profiling.
• The safeguards intended to ensure a fair, non-
discriminatory and accurate profiling process.
In several opinions, the Article 29 group has repeated its position that it is difficult
to rely on Article 6.1 f of the data protection regulation for such profiling that takes place
for marketing or advertising purposes when individuals are tracked on several different
26
websites, locations, devices, services or for data brokerage operations.
3.5.3 Starting points for IMY's assessment
Bonnier News AB supports its processing of personal data for the purpose of
make individuals' profiles available to affiliated companies for the purpose of displaying customized advertisements
on the legal basis legitimate interest according to Article 6.1 f i
data protection regulation. Before IMY examines whether the legal basis can constitute a basis
for Bonnier News AB's processing, IMY finds reason to go into how the processing
relates to certain statements made in the EDPB guidelines.
From the EDPB's guidelines on targeted advertising in social media, it appears that when applicable
data that the registrant actively and knowingly provided so can both
consent and legitimate interest constitute a legal basis for the processing. Of
however, the guidelines state that for such data collected through observation
(e.g. through cookies) legitimate interest cannot serve as an appropriate legal
basis when the targeted advertising is based on individuals being tracked over several
websites and locations.
24
See EDPB Guidelines 05/2020 on consent under Regulation (EU) 2016/679, Version 1.1, adopted on 4 May 2020,
Chapters 122-123
See Article 29 Working Party Opinion 6/2014 on the concept of the controller's legitimate interests in Article 7 of
directive 95/46/EC
26See the opinion of the Article 29 group Guidelines on automated individual decision-making and profiling according to
Regulation (EU) 2016/679, adopted on 3 October 2017, p.15 and Article 29 Working Party Opinion 6/2014 on the concept
the controller's legitimate interest in Article 7 of Directive 95/46/EC, adopted on 9 April 2014, p. 47, and
the examples on pp. 59–60 as well as the EDPB's guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted 13
April 2021 p. 77 18
IMY states that Bonnier News AB collects data for its behavioral database from several sources
different websites but an affiliated company can only extract data based on
behavioral data collected from the company's own digital services. It applies regardless
whether it is a simple or supplemented behavioral profile.
The EDPB's guidelines on connected vehicles state that data collected on
basis of consent according to 5.3 of the eData Protection Directive can only be further processed
for another purpose if the controller requests further consent or
the processing is supported by EU law or national regulation. Also the section on interaction
between consent and other legal grounds in Article 6 of the EDPB guidelines on consent
takes aim when the data subject is given the message that they have obtained the rights as one
consent entails and the unfairness of not respecting these by referring to a
other legal basis.
IMY states that the situation in the case differs to some extent from that described in
these guidelines. In the matter, it is the affiliated companies that collect the data according to
5.3 of the eData Protection Directive and which is thus covered by the requirement for consent therein
the provision. The affiliated companies have to ensure that they have legal support for their
processing according to the eData Protection Directive and the Data Protection Regulation. The connected
the companies' processing of personal data is not covered by this supervision.
It is thus not Bonnier News AB that collects the data with the support of
consent according to the national provisions implementing Article 5.3 i
eData Protection Directive. It is only when the affiliated companies enter the personal data in
the behavior database and KDB as Bonnier News AB's treatment begins. Bonnie
News AB thus does not change the legal basis from consent to legitimate interest.
IMY notes at the same time that Bonnier News AB is part of the same group as them
affiliated companies and that Bonnier News AB is jointly responsible for personal data
with the affiliated companies for the processing of personal data in the databases. The
the fact that group-wide databases have been established should not mean that they
data subjects receive less protection compared to if the processing took place with them
group company that collected the personal data. In other words, Bonnier should not
News AB have greater opportunities to process the personal data with the support of it
legal basis justified interest than the affiliated companies have. According to IMY should
therefore the guidelines reported above have significance for the assessment of the possibility to
use legitimate interest as a legal basis in the matter.
From the above, it can be concluded that the space with the support of Article 6.1 f i
the data protection regulation, to further process data collected with the support of
consent according to LEK is very limited. At the same time, it can be stated that in
data protection regulation there is no prohibition against using article 6.1 f as
legal basis for the current form of treatment. IMY therefore goes ahead and tries
if the processing is supported by Article 6.1 f of the data protection regulation. IMY's examination of
if Bonnier News AB has support for its processing in Article 6.1 f i
the data protection regulation is based on the three conditions that must be met according to
the provision:
(i) Is there a legitimate interest of the personal data controller or
with third parties to whom the data is disclosed?
(ii) Is the processing of personal data necessary for the legitimate purpose
interest pursued? 19
(iii) Weighs the data subject's interest in protection of his personal data
heavier?
IMY treats the first two steps in the balancing of interests jointly for them
supplemented and simple behavioral profiles (sections 3.5.3 and 3.5.4). Then
the third and final step is treated separately for the completed behavioral profiles
(section 3.5.5) and the simple behavioral profiles (section 3.5.6).
3.5.4 Legitimate interest
Bonnier News AB's interest in creating profiles to make information available for
affiliates to display customized ads are of a commercial nature. That one
interest is commercial does not exclude that the interest is justified but decisive for
this assessment is whether the interest is legal, specific and constitutes a real and
actual interest.7
The interest of Bonnier News AB and affiliated companies is legal, real and factual. IMY
therefore states that Bonnier News AB's interest in creating profiles for
making available and the affiliated companies' interest in processing personal data for
to display customized ads based on customers' and users' customer profiles and
behavioral profiles is justified.
3.5.5 Is the processing necessary for the legitimate interest?
The requirement of necessity in Article 6.1 f of the data protection regulation must be tested together
with the principle of data minimization in Article 5.1 c. The purpose of the processing is to
make data available to affiliates to display customized ads based on
individual profiles. In the case it has emerged that Bonnier News AB together with them
affiliated companies have taken measures to minimize the number of data collected and
limit how long these data are processed and ensure that the databases in which
the data processed is kept separate and that only certain data is transferred
in between. Against this background, IMY finds that the treatment described herein
decision is necessary for the stated purpose.
3.5.6 The balancing of interests for the processing of personal data in supplemented
behavioral profiles
Bonnier News AB's interest, to create profiles to make data available for
affiliated companies to show customized ads can, according to the company, benefit the individual
either by higher income enabling free or cheaper services or that it
individuals are met with offers that they are interested in. Bonnier News AB has further
emphasized that many of the affiliated companies engage in journalistic activities and
that publishers' business model today consists of revenue streams from readers and
advertising revenue and that the group-wide personal data processing is
important for the financing of the companies' journalistic activities. The company has against it
background assessed that its interest weighs particularly heavily.
As IMY has already stated, the interest in displaying customized ads is justified in it
meaning referred to in article 6.1 f of the data protection regulation. As for the question how
heavy this interest weighs, IMY states that the interest is not journalistic in itself, but
of a commercial nature. Through profiling, knowledge is created about customers and potential customers
customers that enable revenue from customized advertising. IMY assesses that Bonnier
27 See the Article 29 Group's opinion 6/2014 on the concept of the controller's legitimate interests in Article 7 of
directive 95/46/EC
28 See judgment Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48 20
The commercial interest of News AB and the affiliated companies does not weigh as much as
Bonnier News AB claims.
With regard to the assessment of the interests of the data subjects, IMY considers the following.
As stated above, Bonnier News AB collects personal data in
the behavioral database originally collected by the affiliated companies through
29
web cookies. The consent requirement that applies according to ch. 9 § 28 PLAY for it
the collection provides a strong privacy protection and an opportunity for the registered to
control the use of the collected data. This protection risks, as
EDPB found in several of its guidelines, to be undermined if the collected
the personal data is processed with the support of other legal bases, such as, for example
legitimate interest according to Article 6.1 f of the data protection regulation. Like IMY already
established, Bonnier News AB should not have more opportunity than the affiliated companies to
invoke the legal basis legitimate interest for the processing of them
personal data collected by the affiliated companies using cookies. IMY believes
because the nature of the data means that the interest of the data subjects should be considered high
weight in the balancing of interests.
Furthermore, IMY assesses that the scope for using Article 6.1 f i
the data protection regulation as the legal basis for profiling based on observed data
is limited (cf. EDPB guidelines 8/2020 on targeted advertising in social media p. 77–
78). IMY therefore notes that the nature of the treatment also means that they
data subject's privacy interest weighs heavily.
Bonnier News AB has emphasized that profiling and customized advertisements can benefit it
registered in that it enables higher revenues for the affiliated companies which in its
luck enables them to offer free or cheaper services. It can also be beneficial
the registrant by being met with offers in which he is interested. IMY
does not question that the processing can to some extent benefit the data subjects, but considers that
the overall interest of the profiling is to create as accurate advertising as
possible to get customers and potential customers to buy goods or services and to get
revenue from such advertising.
In cases where behavioral data can be linked to KDB for the purpose of displaying customized advertisements (the so
called the supplemented behavioral profiles) IMY considers the following in its assessment.
Data for the profiling is admittedly not collected from different websites, which according to
The EDPB's guidelines would make Article 6.1 f of the Data Protection Regulation not work as
an appropriate legal basis, but profiling instead includes data collected
from other contexts such as previously made purchases, collected demographic data
as well as statistical data. IMY considers that the profiling is extensive in nature and
that such profiling is not something a data subject can expect without having
consented to such personal data processing.
In a balanced assessment, IMY considers that the data subject's privacy interest
outweighs the interests of Bonnier News AB and the affiliated companies.
Against this background, IMY notes that Bonnier News AB has treated
personal data in violation of Article 6.1 of the data protection regulation for the purpose of profiling them
29 At the time in question in the case, the same requirement according to ch. 6 applied. Section 18 of the Act (2003:389) on electronic
communication. 21
registered based on their behavioral data in a so-called supplemented behavioral profile
and make the profiles available to affiliated companies for the purpose of displaying customized advertisements.
3.5.7 Balance of interests for the processing of personal data in simple
behavioral profiles
As IMY stated above in section 3.5.4, Bonnier News AB's interest is to create
profiles to make available information for affiliated companies to display custom
advertisements are a commercial interest that does not carry as much weight as Bonnier News AB
claims.
With regard to the assessment of the interests of the data subjects, IMY considers the following.
Bonnier News AB has taken measures to minimize the number of data collected,
introduced integrity-enhancing rules for the segmentation, introduced thinning rules and ensured that
information collected from an affiliated company can only be used by that company.
The profiling thus only takes place on a company's "own visitors". Further informs
Bonnier News AB through its personal data policy on the current processing.
Against this must be weighed the collection and profiling of simple behavioral profiles
enables a mapping of individuals through observed data which implies a larger
breach of privacy than when the data is collected through the data subject's active
participation. IMY considers that the data subjects' privacy interest is strong due to
the nature of the data (that the collection of the data is given special protection in LEK). As
As IMY has already stated, Bonnier News AB should not have a greater opportunity than the affiliates
the companies to invoke the legal basis of legitimate interest for the processing of them
personal data collected by the affiliated companies using cookies. Furthermore consider
IMY that when the surfing behavior of individuals is monitored to show customized advertising this can
give the data subject the feeling of losing control over his data and the feeling of
to be monitored. This can result in individuals being influenced in the choice of what they take part in
on a website.
In a balanced assessment, IMY considers that the data subject's privacy interest
weighs more heavily than the interests of Bonnier News AB and affiliated companies even at
processing of personal data in simple behavioral profiles because this enables
profiling of individuals.
Against this background, IMY notes that Bonnier News AB has treated
personal data without having a legal basis for it according to Article 6.1 i
the data protection regulation in order to profile the data subjects based on their
behavioral data in so-called simple behavioral profiles and make the profiles available to
affiliated companies for the purpose of displaying customized advertisements.
3.6 Legal basis for processing for the purpose of making available
contact details for telephone and postal sales
direct marketing
3.6.1 Applicable regulations, etc.
To be able to rely on Article 6.1 f of the data protection regulation must, as
reported above, the three conditions stated in the article are met. There have to be
a legitimate interest of the personal data controller or of a third party to which
the information is disclosed, the processing of personal data must be necessary for the 22
legitimate interest pursued and the data subject's interest in protection for their
personal data must not weigh more heavily. 30
The Article 29 Group and EDPB guidelines on profiling and the application of
Article 6 has been explained in section 3.5.
3.6.2 Current circumstances and Bonnier News AB's approach
Bonnier News AB has stated that the group has coordinated its activities for
to achieve a better data base and make it possible to process the customers' and
users' personal data for specified purposes in a cost-effective and
privacy-friendly way. Bonnier News AB profiles registered users in order to make it available
the data for telephone sales and direct mail marketing. The profiling that
this means is partly based on data in KDB collected from affiliated companies at
purchases and subscriptions (so-called customer engagement), partly on information obtained from
Bisnode Sverige AB and, for a small part of the profiles, information from
the behavior database. Bonnier News AB supports its treatment on Article 6.1 f i
data protection regulation.
Legitimate interest
Bonnier News AB has stated that the affiliated companies have a legitimate interest to
market their products and services in an efficient and privacy-friendly way.
Necessary treatment
Bonnier News AB has stated that they, together with the affiliated companies, have taken
measures to minimize the number of collected data, how long these data
processed and, in order to live up to the data minimization principle, kept the databases
separated and only transferred certain data. Furthermore, Bonnier News AB has taken
measures so that no more information than is necessary is disclosed to those connected
the companies. When disclosing, only the data points defined as
necessary for the marketing channel specified at the time of disclosure, i.e. to
for example, telephone number in the case of a telephone sales campaign and address in the case of postal mail
direct marketing. The data points on which the segmentation is based are not provided
out.
The balancing of interests
Bonnier News AB has stated the following.
Bonnier News AB's interest in making information available for affiliated companies is based on
the registrant's profile to be used for telephone and postal sales
direct marketing outweighs the data subject's privacy interest.
By using the group's existing resources for telephone and postal sales
direct marketing, instead of buying the same information/resource from an external
party, a cost saving occurs at the same time as it enables a more controlled
degree of utilization of addresses and telephone numbers than would have been possible otherwise.
The treatment also aims to save on purchasing costs.
Bonnier News AB, together with the affiliated companies, has taken measures to
minimize the number of collected data, limited how long this data is processed
and in order to live up to the data minimization principle, kept the databases separated.
For the purposes of telephone sales and postal direct marketing, Bonnier News has
30 CJEU judgment Fashion ID, C-40/17, EU:C:2019:629, para. 95. 23
AB limited the type of content tags generated by the registrant
surfed other companies' websites. A connection between the databases has also been possible
is only done in a small percentage of users.
Furthermore, within the framework of the collaboration, something called fit-for-purpose is applied
schedules. These regulate which information is released from KDB. At the time of disclosure
only the data points defined as necessary for it are left
marketing channel specified at the time of disclosure, for example telephone number at a
telephone sales campaign and address for postal direct marketing. The data points
on which the segmentation is based, is not disclosed.
There is a special possibility for the data subject to request deletion from it
common database. The registered person also has the right to object to
the information is used for telephone sales and postal direct marketing.
Those registered have a direct relationship with one or more affiliated companies.
The users/customers have either visited an affiliated company's website, purchased
products of an affiliated company or have an active digital subscription. Many of
the customers are subscribers who have a long-term relationship with the company that
provides the service or product, and can therefore be considered to have a greater expectation of
that their data is processed. Many readers have a strong commitment to theirs
preference for news media. To a certain extent, customer profiles in KDB belong to piece purchases such as
literature, newspaper and merchandise purchases, where the relationship between customer and supplier may be considered
somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided and that
there are alternative products such as physical newspapers that you can read completely anonymously.
According to Bonnier News AB, the treatment probably does not have a negative effect on it
data subject's interest.
The processing that takes place is within the data subjects' reasonable expectations
of the fact that the individuals who come into contact with the companies do so of their own free will in order to take
part of content on websites, buy services and/or products and that they always have one
customer/user relationship with one or more group companies. Furthermore, the company's
personal data policy's clear information about how customers and users
personal data is processed and shared within the group. The treatment that is carried out
within the framework of the KDB/behavioral database is closely associated with the companies' services and
products, which is likely to have an impact on consumer expectations. That a group of
efficiency reasons coordinate systems and central functions and share certain data torde
nor be unexpected for those registered. Customers who have not signed up to the NIX register
have a reasonable expectation that their contact details may be used for postal purposes
direct marketing or telephone sales. Consumers are used to this type of
marketing.
The group-wide policy provides information on direct marketing and
telephone sales. It states that addresses and telephone numbers can be used by
Bonnierbolagen for direct marketing via mail and telephone sales. It appears
furthermore, that the Bonnier companies can choose segments that they believe are relevant for the current one
the campaign, e.g. "men in the 40-45 age range who live in Stockholm". It appears
also that the Bonnier companies always respect NIX blocks and if anyone has objected
the marketing.
31Only tags categorized with the IAB's taxonomy are collected. 24
3.6.3 IMY's assessment
IMY treats the first two steps in the balancing of interests jointly for them
supplemented and simple behavioral profiles (sections 3.6.4 and 3.6.5). Then
the third and final step is treated separately for the completed behavioral profiles
(section 3.6.6) and the simple behavioral profiles (section 3.6.7).
3.6.4 Is Bonnier News AB's interest in profiling individuals for the purpose of
make data available to affiliated companies for use in telephone sales
and direct mail marketing eligible?
Bonnier News AB's interest in creating profiles to make the data available for
affiliated companies for use in telephone sales and postal direct marketing
is commercial in nature. IMY assesses that the companies' interest is legal, real and
actually with Bonnier News AB and the affiliated companies to which the information is disclosed.
Against this background, IMY assesses that the company's interest in creating profiles to
make data available to affiliated companies for the purpose of being used in telephone sales
and direct mail marketing is eligible.
3.6.5 Is the processing necessary for the interest of profiling individuals for the purpose of
make information available to companies for use in telephone sales and
direct mail marketing?
The requirement of necessity in Article 6.1 f of the data protection regulation must be tested together
with the principle of data minimization in Article 5. The purpose of the processing is to
make information available to companies for use in telephone and postal sales
direct marketing. In the case, it has emerged that Bonnier News AB together with
the other companies have taken steps to minimize the amount of data collected and
limit how long these data are processed and ensure that the databases in which
the data processed is kept separate and that only certain data is transferred
in between. Furthermore, the company has ensured that no more information than is necessary is provided
out to the affiliated companies for use in telephone and postal sales
direct marketing. Against this background, IMY finds that the treatment is necessary
for the legitimate purpose.
3.6.6 Balance of interests for the processing of personal data in supplemented
customer database profiles
Bonnier News AB has emphasized that the affiliated companies have an interest in marketing
its products and services in an efficient and privacy-friendly manner. IMY states
however, that the interest in making information available for use in telephone sales and
postal direct marketing is a commercial interest that does not weigh particularly heavily.
With regard to the assessment of the interests of the data subjects, IMY considers the following.
The profiling that is done on the completed customer database profiles includes
information collected from affiliated companies during purchases and subscriptions (so-called
customer engagement), information obtained from Bisnode Sverige AB as well as information from
the behavioral database (including data collected by the affiliated companies through
cookies). IMY has already stated above that Bonnier News AB should not have larger
opportunity than the affiliated companies to invoke the legal basis of legitimate interest
when processing personal data that the affiliated companies have collected with the help of
cookies. The behavioral data retrieved from the behavioral database if a registered to
KDB is also collected from various companies' websites. IMY considers that they registered
cannot be considered to expect their behavioral data to be collected for marketing purposes
32 See judgment Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48 25
just because they visit a web page. Nor can they be considered to expect that their
behavioral data is combined with data from another purchase situation or obtained
data from other registers for the purpose of being contacted for telephone or postal sales
direct marketing. This is not changed by the privacy-enhancing measure that they
the affiliated companies that carry out the marketing action do not get access to it
collected the behavioral data but only contact details.
From the EDPB's guidelines it appears that the scope to use legitimate interest as legal
basis for profiling depends on how detailed the profile is, how extensive the profile is
are, the consequences of the profiling and the protective measures that are intended to ensure
a fair, non-discriminatory and accurate profiling process.
IMY considers that data subjects' privacy interest is strong due to the nature of
the data because the data enables the mapping of individuals' behavior and
the collection of the data is given special protection in LEK.
IMY further notes that this is the kind of profiling referred to in Article 4.4 i
data protection regulation and that the profiling is extensive as it provides an in-depth
image of the registrant. It is also a question of data collected from different
web pages combined with data retrieved from customer engagement and
statistical data from Bisnode Sweden AB. IMY notes against this background that
the nature of the processing means that the privacy interest of the data subjects weighs heavily.
In a balanced assessment, IMY considers that the data subject's privacy interest
outweighs Bonnier News AB's and affiliated companies' interest in that treatment
of personal data which is based on so-called supplemented customer database profile and
which takes place with the aim of making contact information available to affiliated companies for
telephone sales and postal marketing.
Against this background, IMY notes that Bonnier News AB has treated
personal data without having a legal basis for it according to Article 6.1 i
the data protection regulation by profiling the data subjects based on their
supplemented customer database profiles in order to make contact information available to
affiliated companies for telephone sales and postal marketing.
3.6.7 Balance of interests for personal data without connection to
the behavior database
As IMY stated above in section 3.6.6, Bonnier News AB's interest is primarily one
commercial interest that does not weigh particularly heavily.
Regarding the assessment of data subjects' interests in such processing as
lacks a connection to the behavior database, IMY considers the following. Bonnier News AB has
taken measures to minimize the number of data points both in relation to the principles
about data minimization and storage minimization by not sharing data on
item level, but only on product category, brand and type of packaging.
Profiling also does not include data collected through cookies. Of
the investigation has further revealed that the individual has had the opportunity to object before
the processing and that Bonnier News AB respects the wishes of the data subjects to
avoid marketing that has been noted on national blacklists or with it
personal data controller. Against this background, IMY considers that the treatment is within
the framework of what individuals can reasonably expect because of the information that
is provided and that information is only disclosed to affiliated companies within the group. 26
In a balanced assessment, IMY considers that the interests of the data subjects or
fundamental rights do not outweigh those of Bonnier News AB and the affiliates
the companies' interests for the current treatment.
Against this background, IMY notes that Bonnier News AB has had support for its
processing in Article 6.1 f of the data protection regulation.
3.7 Choice of intervention
3.7.1 Applicable regulations and other general starting points
In the event of violations of the data protection regulation, IMY has a number of corrective measures
powers, including reprimands, injunctions and penalty charges. It follows from
article 58.2 a–j of the data protection regulation. IMY shall impose penalty fees in addition to or
instead of other corrective measures referred to in Article 58(2), depending
the circumstances of each individual case.
If a personal data controller or a personal data assistant, with respect to a
and the same or connected data processing, intentionally or by
negligence violates several of the provisions of this regulation, it may
the total amount of the administrative penalty fee does not exceed the amount determined
for the most serious violation. It appears from Article 83.3 i
data protection regulation.
Each supervisory authority must ensure that the imposition of administrative
penalty charges in each individual case are effective, proportionate and dissuasive. The
stated in Article 83.1 of the Data Protection Regulation. Article 83.2 specifies the factors that must
taken into account in determining whether an administrative penalty fee should be imposed and at
the assessment of the size of the penalty fee.
The EDPB has adopted guidelines on the calculation of administrative penalty fees according to
the data protection regulation which aims to create a harmonized method and principles
for calculation of penalty fees. 33
If it is a question of a minor violation, IMY receives according to reason 148 more
the data protection regulation instead of imposing a penalty charge issue a reprimand
according to Article 58.2 b.
3.7.2 Same or connected data processing
IMY has assessed in three cases above that Bonnier News AB lacked support in Article 6.1 i
data protection regulation for its processing of personal data. IMY assesses that these
treatments, all of which take place in the company's databases through profiling i
marketing purposes, are connected to each other in the manner referred to in
article 83.3 of the data protection regulation.
3.7.3 Penalty fee
IMY has assessed that Bonnier News AB has violated Article 6.1 of the data protection regulation
in its processing of personal data that takes place for the purpose of displaying customized advertisements
and to make contact information available to affiliated companies for telephone sales and
postal direct marketing. IMY does not consider these to be minor violations.
33EDPB's guidelines 8/2020 Guidelines 04/2022 on the calculation of administrative fines under the GDPR (adopted for
public consultation on 12 May 2022). 27
Bonnier News AB must therefore be charged an administrative sanction fee for these
violations.
IMY notes that violations of Article 6.1 of the data protection regulation are covered by
article 83.5 which means that a penalty fee of up to twenty million EUR or four
percentage of the global annual turnover in the previous fiscal year, depending
whichever is higher, may be imposed.
When determining the maximum amount of a penalty charge to be imposed on a company
shall the definition of the concept of company be used as used by the EU Court of Justice
application of Articles 101 and 102 of the TFEU (see recital 150 i
data protection regulation). It appears from the court's practice that this includes every entity
that carries out economic activities, regardless of the legal form of the entity and the way of doing so
financing as well as even if the unit in the legal sense consists of several physical or
legal entities.34
IMY assesses that the company's turnover to be used as a basis for calculation of
the administrative sanction fee that Bonnier News AB can be imposed is Bonnier
News AB's parent company Albert Bonnier AB. From information obtained it appears that Albert
Bonnier AB's annual turnover in 2021 was SEK 23,299,000,000. The highest
penalty amount that can be determined in the case is four percent of this amount, that is
say approximately SEK 931,960,000.
IMY assesses that the following factors are important for the assessment of the infringement
seriousness.
There has been a question of profiling of individuals that took place for profit both when
the profiling took place to show customized ads and when it took place to disclose
contact details for telephone sales and postal marketing.
In those cases, the profiling that took place to display customized ads has data in
the behavioral database on individuals' surfing behavior has been able to be connected to KDB included
browsing history, purchase history and demographic and statistical data. It has been a question
about a violation that has been going on for a long time and affected a large number of registered users
and included a large amount of personal data. However, the data processed constitutes,
as far as has been ascertained, not such special categories of personal data as are set out in
Article 9 of the Data Protection Regulation. In this decision, IMY has assessed that the profiling
through complementary behavioral profiles, has been comprehensive in nature.
Also for the profiling of personal data in KDB where there was a connection to data in
the behavior database, so-called supplemented customer database profiles, IMY has made
the assessment that the profiling was extensive in nature, because it contained
data collected about the individual's surfing behavior obtained from several
websites combined with data from purchases made (customer engagement) as well as
information obtained from Bisnode Sverige AB. However, IMY makes the assessment that current
personal data processing does not entail major consequences for the data subjects. It touches
about the impact which is judged to be moderate.
In both of these cases, IMY considers that the profiling that took place where data could be linked
together in the two databases, complementary behavioral profiles and those
supplementary customer database profiles, has a higher severity level compared to it
34 See Judgment in Akzo Nobel, C-516/15, EU:C:2017:314, paragraph. 48 28
violation relating to the profiling that takes place in the so-called simple behavioral profiles
to display personalized ads. IMY believes that the profiling that takes place in the so-called
simple behavioral profiles to display personalized ads in and of themselves are
grounds for sanctions, but that it has a lower degree of seriousness than the violations
where a connection could be made between the different databases. The reason for that is that it touches
less information about the registered and about indirect personal data. IMY weighs
however, that this violation also includes systematic treatment that has been ongoing
for a long time and affected a large number of registered users.
The measures taken by Bonnier to limit the intrusion were recorded
personal integrity, in the form of set storage deadlines, that information is not registered on
product level, that no more information than necessary is disclosed to affiliated companies, entails
according to IMY that the seriousness of the violations is reduced to a significant extent.
The personal data has also not been disclosed outside the group. IMY has
pointed out that Bonnier News AB has consistently taken measures to
reduce the breach of privacy for those registered in their group-wide cooperation.
This relationship is also taken into account when assessing the seriousness of the violations.
In the light of the above circumstances, IMY assesses that, in total, it concerns
for violations of a low level of seriousness. The starting point for the calculation of
the penalty fee should therefore be low in relation to the current maximum amount.
In addition to assessing the seriousness of the violation, IMY must assess whether it exists
any aggravating or mitigating circumstances that become relevant
the amount of the penalty fee. IMY assesses that there is no further aggravating factor or
mitigating circumstances, in addition to those considered in the assessment of
the degree of seriousness above, which affects the size of the penalty fee.
In light of the seriousness of the violation, aggravating and mitigating circumstances
and the high turnover in relation to the violations found
IMY determines the administrative sanction fee for Bonnier News AB to
SEK 13,000,000. IMY considers this amount to be effective, proportionate and
deterrent.
________________________________________
This decision has been taken by the general manager Lena Lindgren Schelin after a presentation
by lawyer Ulrika Bergström. In the final proceedings, the chief justice also has
David Törngren and unit manager Catharina Fernquist participated.
Lena Lindgren Schelin, 2023-06-26 (This is an electronic signature)
Appendix
Information on payment of penalty fee
Copy to
DSO 29
4. How to appeal
If you want to appeal the decision, you must write to IMY. State in the letter which decision you made
appeals and the change you request. The appeal must have been received by IMY
no later than three weeks from the day you were informed of the decision. If the appeal has been received
In due course, IMY forwards it to the Administrative Court in Stockholm for examination. You can e-
mail the appeal to IMY if it does not contain any privacy sensitive items
personal data or information that may be subject to confidentiality. The authority's
contact details appear on the first page of the decision.
