IMY (Sweden) - IMY-2023 4458
From GDPRhub
| IMY - IMY-2023 4458 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 4 GDPR Article 6 GDPR Article 14 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 22.10.2025 |
| Published: | 23.10.2025 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | IMY-2023 4458 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Swedish |
| Original Source: | IMY (in SV) |
| Initial Contributor: | XZ |
The DPA found that the Moderate Party's national organization unlawfully processed personal data with the distribution of personal video greetings, via SMS or email, ahead of an upcoming election. Amongst other things, the political party failed to inform data subjects about the processing of their data.
English Summary
Facts
Several data subjects lodged a complaint with the Swedish Privacy Protection Authority (IMY) after receiving received personalized video greetings from the Moderate Party’s national organization , the controller, ahead of the 2022 parliamentary elections. The video greetings featured by the party leader, addressing data subjects by their first names and urging them to vote. The controller engaged the company SEEN AS as a data processor to produce and distribute the videos. In total, about 980,000 video greetings were sent.
The controller claimed its legal basis was legitimate interest under Article 6(1)(f) GDPR , arguing it was necessary for political communication and that data subjects' rights did not outweigh this interest. Data subjects were informed about the sender and linked to the controller’s privacy policy, which stated that data was processed based on legitimate interest.
IMY initiated an investigation.
Holding
IMY held that the Moderate Party was the data controller under Article 4(7) GDPR, as they determined the purpose and means of the processing, even though they did not have direct access to the personal data.
IMY found no valid legal basis for the processing. To rely on legitimate interest as a legal basis under Article 6(1)(f) GDPR, three conditions must be met: a legitimate interest, necessity, and a balance of interests. While the controller’s interest in informing voters was considered legitimate, and the processing was deemed necessary for achieving that communication purpose, IMY held that the third condition, the balancing of interests, was not fulfilled.
Sending unsolicited political text messages without prior consent was considered intrusive, and since the data subjects had no prior relationship with the controller and had not provided their data, the processing fell outside reasonable expectations.
IMY also held that the controller violated Article 14 GDPR by failing to provide adequate information to data subjects. The privacy policy did not clearly state the categories of personal data collected, the recipients or sub-processors of the data or the storage period of personal data.
Taking into account that the infringement was minor, involved the processing of a limited amount of personal data, and occurred on a single occasion over a short period of time, IMY issued a reprimand to the controller rather than an administrative fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Swedish Privacy Agency Case number: IMY-2023-4458 6(15) Date: 2025-10-22 The Moderates base their processing on a balancing of interests, where the party has stated that they have a legitimate interest in processing the person's personal data in order to provide them with information about the party's political and organizational activities. Recipients of the video greetings have been given access to the information in different ways depending on how the party collected their personal data, i.e. which category of registered person they belonged to. In addition to the information in the privacy policy, some recipients of the video greetings have also received additional information about the processing in the SMS that was sent. For the recipients who were tipped off to the Moderates, the SMS or email message has contained information about who tipped off to the Moderates. In the event that the recipient's information was obtained from the external database, the SMS sent contained information that their information had been obtained from there and how they could terminate the mailing. The SMS also contained a link to a subpage on the Moderaterna website with information about how the Moderaterna handles personal data in connection with SMS mailings. The text looked as follows: "Hello FIRST NAME, I have recorded a personal video greeting for you https://video.moderaterna.se/v/ovdRz/ Together we can get Sweden in order! Greetings Ulf Kristersson Address source: MIA. Text MSTOP XX to 7XX XX to deregister Questions about your SMS? moderaterna.se/sms". 2 Justification of the decision IMY initially takes a position on whether the Moderaterna is the personal data controller for the current processing of personal data. IMY then examines whether the Moderates have had a legal basis for and provided the data subjects with sufficient information about the processing in the manner required by the Data Protection Regulation. 2.1 Data controller 2.1.1 Applicable provisions According to Article 4(7) of the Data Protection Regulation, a natural or legal person, public authority, institution or other body which alone or jointly with others determines the purposes and means of the processing of personal data. An actor may be considered to be a data controller even if it lacks actual access to the personal data that is being processed.4 2.1.2 IMY's assessment The Moderates have stated that the party is the data controller for the personal data processing that the supervision concerns. The investigation has shown that the Moderates have determined how the personal data shall be processed and for what purposes. IMY therefore assesses that the Moderates are the data controller for the current processing of personal data. 4 See the European Data Protection Board (EDPB) Guidelines 07/2020 on the concepts of controller and processor in the GDPR, paragraph 45 and the judgment of the Court of Justice of the European Union of 5 June 2018, Wirtschaftsakademie, C-210/16, EU:C:2018:388, paragraphs 38 and 39. Integrity Protection Authority Case number: IMY-2023-4458 7(15) Date: 2025-10-22 2.2 Legal basis for the processing 2.2.1 Applicable provisions etc. In accordance with the principle of accountability in Article 5(2) of the GDPR, it is the controller who is responsible for and must be able to demonstrate that the rules of the GDPR are complied with, including that the processing is lawful. For personal data processing to be lawful, at least one of the conditions in Article 6(1) of the GDPR must be met. These conditions are usually referred to as legal grounds. In order for processing to be based on the legitimate interest legal ground (also known as balancing of interests) in Article 6(1)(f) of the GDPR, three conditions must be met. First, there must be one or more legitimate interests pursued by the controller or a third party. Second, the processing must be necessary for the purposes of the legitimate interest. Third, the interests or fundamental rights and freedoms of the data subjects must not outweigh the legitimate interests of the controller or a third party (balancing of interests).5 The legitimate interest must be legitimate, which means that it must not conflict with EU or national law.6 Furthermore, the interest must be clearly and distinctly formulated and relate to a genuine interest which exists at the time of the processing and is not hypothetical.7 In order for the pursuit of such a legitimate interest to enable the processing of personal data on the basis of Article 6(1)(f), the controller must comply with all other obligations under the Data Protection Regulation.8 The case-law of the Court of Justice of the European Union shows that the requirement of necessity is met if the legitimate interest cannot reasonably be achieved equally effectively by other means which are less intrusive in the fundamental rights and freedoms of the data subjects, in particular the right to respect for the privacy of the data subject. for privacy and the right to the protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. It is not enough that the processing is useful for the fulfilment of the legitimate interest, the CJEU has also stated that the processing must be strictly necessary.9 The requirement of necessity must be examined together with the principle of data minimisation under Article 5(1)(c) of the GDPR. This means that the personal data processed shall be adequate, relevant and not excessive in relation to the purposes for which they were collected and for which they are subsequently processed.10 The balancing of interests required by the third condition shall be carried out in the light of the specific circumstances of the case.11 The controller shall 5 See, inter alia, judgment of the Court of Justice of the European Union of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 28, judgment of the Court of Justice of the European Union of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C‑708/18, EU:C:2019:1064, paragraph 40, of 17 June 2021, M.I.C.M., C‑597/19, EU:C:2020:1063, paragraph 106 and of 4 July 2023, Meta Platforms and Others, C-252/21, EU:C:2023:537, paragraph 106. 6 See judgment of the Court of Justice of the European Union of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C-621/22, EU:C:2024:857, paragraph 49. 7 See Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, paragraph 44. 8 See Koninklijke Nederlandse Lawn Tennisbond, C-621/22, paragraph 50. 9 See Meta Platforms and Others, C-252/21, paragraph 126 and EDPB Guidelines 1/2024, paragraphs 28 and 29. Please note that the Guidelines have not been finally adopted by the EDPB at the time of this decision. 10 See, inter alia, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, paragraphs 47 and 48 and Meta Platforms and Others, C-252/21, paragraphs 108 and 109. 11 See, inter alia, Asociaţia de Proprietari bloc M5A-ScaraA, paragraphs 52–58. The Data Protection Authority, Case No.: IMY-2023-4458 8(15) Date: 2025-10-22 in the balancing exercise, identify and take into account the interests, rights and freedoms of the data subject, the impact of the processing on the data subject and whether the data subject can reasonably expect the processing for the purpose in question. In assessing the impact of the processing, the nature of the data processed, whether it concerns sensitive personal data, the context of the processing and other consequences shall be taken into account. Based on these circumstances, a balance shall be made of conflicting rights and interests, which shall include the possibility of additional mitigating measures that go beyond what the controller is obliged to do in order to comply with the rules of the GDPR.12 In the event that the processing is carried out for purposes relating to personalized advertising, the assessment shall also take into account that the legitimate interest in processing the data for such purposes cannot under any circumstances be considered to outweigh the risk that the fundamental rights and freedoms of the data subject will be negatively affected.13 2.2.2 IMY's assessment Legitimate interest The Moderates' interest in informing about the party's political activities has been legitimate, genuine and actual at the time of the processing. IMY therefore concludes that the Moderates have had a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. However, IMY considers that the tipster's interest in a friend receiving information about politics that he or she may be interested in does not constitute a legitimate interest of a third party that can form the basis for processing pursuant to Article 6(1)(f) of the GDPR. This interest will therefore not form the basis for the further assessment. Necessity The processing required to produce and send out the personal video greetings has included information on, among other things, first name, place of residence, email address and telephone number. The production of the personalized video greetings has included several different processing steps, including the personal data being transferred to, stored and processed by a data processor. If a recipient clicked on the link, the data was then used to generate and display the personal film, which resulted in the creation of additional personal data in the form of metadata about the recipient's video greeting. In addition to the time they were processed before the mailing, the personal data have in many cases been stored for a longer period than 30 days after the mailing to the recipients. In the current case, the processing of the data subjects' personal data has been extensive, including ensuring that there has been extensive processing of the personal data and that the data has been stored for a longer period for the purpose of making a single mailing of information. IMY therefore assesses that the Moderate Party has not shown that the purpose of reaching out with the information could not reasonably have been achieved in an equally effective manner by means of less extensive processing of personal data. It is 12 See EDPB Guidelines 1/2024, paragraphs 32–34. 13 See Mousse, C-394/23, paragraph 60. Integrity Protection Authority Case number: IMY-2023-4458 9(15) Date: 2025-10-22 means that the processing of personal data for the purpose of producing and sending out personalized video greetings has not been necessary. Balancing of interests For the reasons mentioned above, IMY already assesses that the Moderate Party lacked a legal basis for the processing. Notwithstanding this, IMY examines the third condition, i.e. whether the interests or fundamental rights and freedoms of the data subjects outweigh the legitimate interests of the data controller or a third party (balancing of interests). IMY notes that sending a political message directly to an individual via SMS or email without the person having requested such information is intrusive. The Marketing Act has introduced particularly strong privacy protection when sending unsolicited advertising via SMS or email. The protection means that such mailings are generally only permitted if consent has been obtained in advance. The primary purpose of the regulation is to protect consumers against particularly intrusive unsolicited advertising.14 The Marketing Act does not apply to political marketing, but the legislator's position on the need for special privacy protection shows that the interests of the data subjects weigh heavily in unsolicited mailings of advertising via SMS and e-mail. According to IMY, this means that the scope for using SMS and e-mail for political advertising to those who are not members or have actively shown interest in the information is extremely limited. This is particularly true in a case like this where a party has used a personalized video greeting in which the party leader directly addresses the data subject by first name and informs them about their political message. Such an address must be considered particularly intrusive. Against this background and taking into account that the data subjects themselves have not provided their personal data or had a previous relationship with the party, IMY considers that the processing cannot be considered to have been within the scope of the data subjects' reasonable expectations. In relevant cases, the recipient has indeed received information about who has tipped off the Moderators about him or her, together with a link to the privacy policy, and has thus become aware that the party is processing his or her personal data. However, the fact that the data controller has provided information in accordance with the regulations in the Data Protection Regulation is not sufficient for the data subject to reasonably expect a certain processing.15 When assessing the data subjects' interests, IMY has also taken into account that the information in the privacy policy has not made clear how the party processes personal data about persons who have not themselves shown an interest in the party, which is further developed in section 2.3 of the decision. The data subjects have thus not been able to read and understand what personal data about them has been processed in this context and how the processing has been carried out. In the balancing of interests, the Moderate Party has taken into account the protective measures the party has taken to limit the infringement of the data subjects' personal integrity, such as obtaining approval in connection with the display of the video greeting. IMY notes that such approval can to some extent be considered a measure to enhance privacy. However, it can be stated that approval was requested only after personal data had already been processed for the purpose of preparing and carrying out the mailing and only if the recipient chose to click on the link sent out. Other security measures, such as 14 See Section 19 of the Marketing Act (2008:486) and Levin, Marketing Act (1942:740) Section 19, Lexino 2025-08-25 (JUNO). 15 See EDPB Guidelines 1/2024, paragraph 53. Integrity Protection Authority Case number: IMY-2023-4458 10(15) Date: 2025-10-22 such as technical security measures and information in SMS messages about the address source, constitute such measures that are within the scope of the obligations incumbent on the personal data controller pursuant to, among others, Articles 14 and 32 of the GDPR. The measures shall therefore not be regarded as such additional protective measures that shall be weighed in the balance of interests.16 In an overall assessment, IMY finds that the interests and fundamental rights and freedoms of the data subjects outweigh the Moderate Party's interest in reaching out with the information in the current manner. It is therefore not demonstrated that the third condition in Article 6(1)(f) is met. Summary assessment In summary, IMY assesses that the Moderates have not been able to base the current processing of personal data on Article 6.1 f of the Data Protection Regulation. It has also not emerged that the Moderates have supported the processing on any of the other legal grounds in Article 6.1 of the Data Protection Regulation. The party has thus processed personal data in violation of Article 6.1 of the Data Protection Regulation in connection with the production and sending of personal video greetings ahead of the 2022 parliamentary elections. 2.3 Information about the processing The Moderates have explained how they have informed each group of data subjects about the processing of personal data and stated the following regarding the groups covered by IMY's assessment. Persons whom the Moderates have been tipped off about The data subjects have received the video greeting via text message or email, depending on what the person who tipped off the Moderates has chosen. In the text message, they were informed that the Moderates were the sender and that information about the Moderates' personal data processing was available on the Moderates' website, among other things. The text message also contained a link to the privacy policy. The text message also contained the first name of the person who tipped off the party about the recipient and how the recipient could stop the mailing. Persons whose information was obtained from MIA All persons in this category have received video greetings via SMS. The text message informed the recipient that the Moderates were the sender and that the personal data was obtained from MIA. The SMS message also contained a link to the Moderates' website, where the recipient could access the privacy policy. 2.3.1 Applicable provisions Article 14 of the GDPR sets out the information that the controller shall provide to the data subject when processing personal data that have not been provided by the data subject. The controller shall, among other things, provide information on the identity and contact details of the controller, the purposes of the processing, the period for which the personal data will be stored, the recipients or categories of recipients to whom the personal data are to be disclosed, and the categories of personal data to which the processing relates. Recital 39 of the GDPR states that any processing of personal data must be lawful and fair. It should be clear and obvious to natural persons how personal data relating to them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that all information and communication relating to the processing of such personal data be easily accessible and understandable and that clear and distinct language be used. That principle applies in particular to the information to data subjects of the identity of the controller and the purposes of the processing, as well as to additional information to ensure fair and transparent processing for the natural persons concerned and their right to obtain confirmation and notification of the personal data relating to them that are being processed. Natural persons should be made aware of the risks, rules, safeguards and rights relating to the processing of personal data and of how they can exercise their rights in relation to the processing. It follows from recital 60 that the principles of fair and transparent processing require that the data subject be informed of the fact that processing is taking place and the purposes of the processing. The controller should provide the data subject with any additional information required to ensure fair and transparent processing, taking into account the specific circumstances and context of the processing. The Article 29 Working Party, now replaced by the European Data Protection Board (EDPB), has developed guidelines on transparency, WP260 rev. 01 (WP260). WP260 states, among other things, that a central part of the principle of transparency is that the data subject should be able to foresee the scope and consequences of the processing and that the data subject should not be surprised at a later stage by how his or her personal data have been handled.17 Regarding the retention period for personal data, the guidelines state that it: […] should be specified in such a way that the data subject, based on his or her own situation, can assess the retention period for specific data/purposes. It is not sufficient for the controller to generally state that the personal data will be kept for as long as is necessary for the legitimate purposes of the processing. Where relevant, different retention periods should be specified for different categories of personal data and/or different processing purposes, including archiving periods where appropriate.18 Regarding information on recipients of personal data, WP260 states that recipients of personal data should be interpreted in accordance with the definition in Article 4(9) of the GDPR. The guidelines clarify that a recipient does not need to be a third party. Furthermore, they clarify that the actual recipients should generally be mentioned by name, so that the data subject knows exactly who has their personal data. This is in line with the principle of fairness. If the controller instead provides information on the categories of recipients, the information should be made as specific as possible by 17 Article 29 Working Party Guidelines 2016/679 on transparency, p. 7. 18 See Article 29 Working Party Guidelines 2016/679 on transparency, p. 40. Integrity Protection Authority Case number: IMY-2023-4458 12(15) Date: 2025-10-22 to indicate the type of recipient, for example by referring to the different activities the recipient performs, within which sector or the recipient's geographical location.19 2.3.2 IMY's assessment of the Moderate Party's information on the processing Categories of personal data According to Article 14(1)(d), the controller shall provide information on the categories of personal data to which the processing applies. The information is required because the data subjects in that case do not know which categories of personal data the controller has received.20 The Moderators have been asked to specifically indicate which sections of the information are relevant to the processing of personal data in connection with the production and sending of the personal video greetings and have referred to sections 2 and 4 of the Privacy Policy. Section 2 of the Privacy Policy contains information on the situations in which the Moderators process personal data. The section is entitled How and why do we process your personal data? The second and third paragraphs of the section indicate that the Moderators process information about membership in the Moderate Coalition Party. The fourth paragraph of the section describes how the Moderates process the group of stakeholders. The fourth paragraph states that the party … processes personal data in certain cases, primarily contact information such as name, address, telephone number and email address, about people who are not or have not yet become members but who have provided such information to us or otherwise shown interest in the party's activities or participated in the party's activities (for example by participating in our events or meetings). Section 4 is entitled What will the data be used for? The section states the Moderators' purpose for the processing. One of the purposes is Contact with members and stakeholders. It is clear that the processing carried out for this purpose is, among other things, Sending out information, fundraising letters... Sending out electronic newsletters Marketing in advertising networks and social channels.... It is further clear that the personal data processed for this purpose is information about First and last name, address information, email address (newsletter), ID number/cookies/, IP addresses from the respective advertising and social platform. IMY believes that it is not sufficiently clear from the information in the privacy policy that the processing of personal data may also apply to data subjects who do not belong to the groups of members or stakeholders. According to IMY, the information gives the impression that the personal data that the party has stated that they process only applies to data subjects who have themselves shown interest in the party or participated in the party's activities. It is not possible to infer from the privacy policy that the party has processed or may collect telephone numbers from external sources. Although the SMS and e-mail messages have contained information about the source of the personal data (MIA or tips from individuals), the messages have not contained information about which data has been obtained from the specified source. IMY therefore assesses 19 See the Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/673, p. 37. 20 See the Article 29 Working Party Guidelines 2016/679 on Transparency, p. 38. Integrity Protection Authority Case number: IMY-2023-4458 13(15) Date: 2025-10-22 that the data subjects cannot be considered to have received sufficiently clear information about which categories of personal data are processed about them. Overall, IMY assesses that the Moderates have not provided information about the processing of personal data as required by Article 14(1)(d) of the GDPR. Information about recipients According to Article 14(1)(e) of the Data Protection Regulation, information shall be provided about the recipients or the categories of recipients who will receive the personal data, where applicable . Section 6 of the privacy policy is entitled Who can access your personal data? The section states that Your personal data may be disclosed for processing to the Moderate Coalition Party's IT suppliers such as system and operation suppliers and to unions, party circles and party associations, in some cases also outside Sweden in order to administer membership or requests for information or to otherwise fulfil commitments to the data subject. The investigation into the case shows that the Moderate Party has disclosed personal data to the data processor SEEN. However, IMY notes that neither the data processor nor the sub-processors involved are mentioned by name in the privacy policy. There is also no support for the data subjects having received any information in any other way that the personal data will be disclosed or has been disclosed to the data processor or sub-processors. IMY believes that the information provided by the Moderates is not specific enough for the relevant groups of data subjects to understand that the Moderates will disclose or have disclosed the personal data to the data processor and its sub-processors. IMY therefore assesses that the information provided by the Moderates about the recipients of the personal data does not meet the requirements of Article 14(1)(e) of the GDPR. Information on the storage period According to Article 14(2)(a), the controller shall provide information on the period during which the personal data will be stored or, if this is not possible, the criteria used to determine this period. Under Section 4 of the Privacy Policy, under the title How long do we store your personal data?, it is stated that Contact information for members is processed for the time you are an active or registered member of the party. Subscribers to electronic newsletters can unsubscribe from the newsletter at any time via a link at the bottom of our mailings. We will delete the personal data upon such unsubscription. For marketing in advertising networks and social channels, data is saved according to the respective network's settings, normally up to one year, or shorter if you choose to unsubscribe in your settings. IMY notes that the privacy policy has not contained any information about how long the data has been stored in connection with the creation and sending of the video greetings. The information has not contained any other time information for the storage of personal data in connection with the current processing. The situations mentioned under the heading How long do we save your personal data cannot be equated with the processing in connection with the production of the video greetings and the time information specified there is therefore not relevant in this context. The investigation has also not shown that the data subjects have received information about the storage time in any other way. IMY thus finds that the Moderates have not provided information on the storage period for personal data or criteria that can be used to determine this period in such a way that the data subjects can understand how long the data in question has been stored. IMY therefore assesses that the Moderates have not provided information to the data subjects on the storage period for personal data as required by Article 14(2)(a) of the GDPR. Summary assessment of the Moderates' information on the processing In summary, IMY assesses that the Moderates have violated Article 14 of the GDPR by not providing sufficient information on the processing of personal data. 3 Choice of intervention It is apparent from Article 58(2) and Article 83(2) of the GDPR that the IMY has the authority to impose administrative fines in accordance with Article 83 for infringements of Articles 6 and 14 of the GDPR. Depending on the circumstances of the case, administrative fines shall be imposed in addition to or instead of the other measures referred to in Article 58(2), such as injunctions and prohibitions. Article 83(2) further specifies the factors to be taken into account when deciding whether to impose administrative fines and when determining the amount of the fine. If the infringement is minor, the IMY may, as stated in recital 148, issue a reprimand in accordance with Article 58(2)(b) instead of imposing a fine. Consideration shall be given to aggravating and mitigating circumstances in the case, such as the nature, severity and duration of the infringement and previous infringements of relevance. The IMY has assessed that the Moderates have lacked a legal basis for the processing of personal data that is the subject of the review. Furthermore, the Moderates have not informed the data subjects about the processing in the manner required by the Data Protection Regulation. In an overall assessment, taking into account, among other things, that the data has been processed on one occasion and thus was not of a systematic nature, IMY considers that this is a minor infringement within the meaning of recital 148 of the Data Protection Regulation. IMY is therefore giving the Moderates a reprimand for the infringement. __________________________ This decision has been made by Director General Eric Leijonram after a presentation by lawyer Sofia Standar. In the final handling of the case, Legal Director David Törngren, Unit Head Catharina Fernquist, Advisor Victor Hagstedt and Departmental Lawyer Maja Welander have also participated. Eric Leijonram Integrity Protection Authority Case number: IMY-2023-4458 15(15) Date: 2025-10-22 How to appeal If you wish to appeal the decision, you should write to IMY. Indicate in the letter which decision you are appealing and the change you are requesting. The appeal must be received by IMY within three weeks of the date you received the decision. If you are a party representing the public, the appeal must be received within three weeks of the date the decision was announced. If the appeal has been received in good time, IMY will forward it to the Administrative Court in Stockholm for review. You can email the appeal to IMY if it does not contain any personal information that is sensitive to privacy or information that may be subject to confidentiality. The authority's contact details are provided on the first page of the decision.
