IMY (Sweden) - IMY-2024-7737
From GDPRhub
| IMY - IMY-2024-7737 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 4(7) GDPR Article 6(1)(f) GDPR Article 12 GDPR Article 14 GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | |
| Decided: | 22.10.2025 |
| Published: | 23.10.2025 |
| Fine: | n/a |
| Parties: | Sweden Democrats |
| National Case Number/Name: | IMY-2024-7737 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | IMY. (in SV) |
| Initial Contributor: | n/a |
The DPA found that the Sweden Democrats unlawfully sent text messages advertising for votes in an upcoming election. Amongst other things, the political party failed to inform data subjects about the processing of their data.
English Summary
Facts
A data subject lodged a complaint with the Swedish Privacy Protection Authority (IMY) after receiving a text message from the Sweden Democrats , the controller, urging it to vote for the party in the 2024 European Parliament elections. IMY initiated an investigation.
The data subject stated that they had not provided its personal data to the party and was unable to unsubscribe or contact the sender, as the sender’s details were hidden.
The Sweden Democrats argued that they were not the controller, claiming an external company handled the mailing. They asserted that the legal basis for processing was legitimate interest to inform eligible voters ahead of the election. The controller determined the content, purpose, and recipient selection (based on postal codes with low party support) and relied on data obtained from public registers through third parties.
Holding
IMY held that the Sweden Democrats were the data controller under Article 4(7) GDPR, as they determined the purpose and means of the processing, even though they did not have direct access to the personal data.
IMY found no valid legal basis for the processing. To rely on legitimate interest as a legal basis under Article 6(1)(f) GDPR, three conditions must be met: a legitimate interest, necessity, and a balance of interests. While the controller’s interest in informing voters was considered legitimate, and the processing was deemed necessary for achieving that communication purpose, IMY held that the third condition, the balancing of interests, was not fulfilled.
Sending unsolicited political text messages without prior consent was considered intrusive, and since the data subject had no prior relationship with the controller and had not provided their data, the processing fell outside reasonable expectations.
IMY therefore concluded that the data subject’s rights and freedoms outweighed the controller’s legitimate interest, and the legitimate interest basis under Article 6(1)(f) GDPR was not satisfied.
IMY also held that the controller failed to facilitate the data subject's exercise of their rights and did not provide sufficient information about the processing, thereby violating Articles 12(2) and Article 14 GDPR, as the text message lacked necessary details about the processing of personal data and the identity of the controller.
Taking into account that the infringement was minor, involved the processing of a limited amount of personal data, and occurred on a single occasion over a short period of time, IMY issued a reprimand to the controller rather than an administrative fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
1(7) COMPLAINT See attachment SUPERVISORY OBJECT The Swedish Democrats Case number: Decision after supervision according to IMY-2024-7737 Date: Data Protection Regulation – 2025-10-22 The Swedish Democrats Decision of the Swedish Data Protection Authority The Swedish Data Protection Authority (IMY) finds that the Swedish Democrats (802018- 1791) has violated Article 6(1) of the Data Protection Regulation by processing the complainant's personal data without a legal basis. IMY finds that the Swedish Democrats have also violated Articles 12(2) and 14 of the Data Protection Regulation by not facilitating the complainant to exercise his rights and by not providing sufficient information about the processing of the complainant's personal data. IMY issues a reprimand to the Sweden Democrats for the violations pursuant to Article 58(2)(b) of the Data Protection Regulation. Statement of the supervision case IMY has initiated supervision against the Sweden Democrats with the aim of investigating a complaint. The following is mainly stated in the complaint. The complainant has received a text message from the Sweden Democrats urging them to vote for the party in the European Parliament elections in 2024. The complainant has not disclosed his personal data to the Sweden Democrats or any organisation linked to the party. It has not been possible to unsubscribe from the mailing or to contact the Sweden Democrats because the sender's details have been hidden. IMY's review of the case concerns whether the Sweden Democrats had a legal basis for the processing of the complainant's personal data when sending the message in question and whether the party has provided the complainant with sufficient information about the processing and the complainant's rights under the Data Protection Regulation. Postal address: Box 8114 The Swedish Democrats have essentially stated the following. The Swedish Democrats are not 104 20 Stockholm the data controller for the processing of personal data to which the complaint relates. Website: www.imy.se The Swedish Democrats have not stored the complainant's personal data but have hired an external company to send the SMS. The party has determined the content of the message E-mail: imy@imy.se 1 Telephone: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with Directive 95/46/EC (General Data Protection Regulation). the free flow of such data and the cancellation of 08-657 61 00 Page 1 of 7Integritetsskyddsmyndigheten Filing number: IMY-2024-7737 2(7) Date: 2025-10-22 and that it would be sent to persons entitled to vote within certain postal code areas and constituencies where the party has low sympathy support, according to, among other things, information on election results obtained from the Election Authority. The company that the Sweden Democrats hired has in turn obtained telephone numbers belonging to persons living within these areas from an external actor that retrieves data from, among other things, the Swedish Tax Agency and operators. The personal data has been stored by the hired company and deleted as soon as the campaign has ended. The party has further stated that the legal basis for the processing of the complainant's personal data is the Sweden Democrats' legitimate interest in disseminating information about its policies and activities, to voters within the relevant postal areas, ahead of the 2024 EU elections. The mailing has been limited to persons entitled to vote. The party has chosen to send SMS messages to reach out with concise information in the quickest and most efficient manner possible. In connection with general elections, it is necessary for the information to reach the recipients, as it is a particularly information-intensive period with a lot of public information disseminated in the public domain. It has therefore been necessary to process the personal data in order to achieve the purpose of the campaign. The Sweden Democrats believe that it should be within the voters' reasonable expectations to be contacted with public information from political parties in connection with general elections. The SMS clearly stated that the Sweden Democrats were the sender of the information. In addition, the party has limited itself to using telephone numbers from publicly available sources. The telephone numbers have not been linked to any other sensitive information about the registered users and have been saved for a very limited time. The infringement of the recipients' privacy is therefore extremely limited. In future mailings of this nature, a clearer reference will be given in the text message to the Sweden Democrats' website, where there is more information about how the party processes personal data and the rights of the registered users. The Sweden Democrats have a function to block registered users who do not want to receive any mailings from the party and the mailing has not been sent to any of these people. The party thus satisfies the rights of the registered users according to the Data Protection Regulation. Overall, the Sweden Democrats assess that the party's legitimate interest in carrying out the current processing outweighs the rights and freedoms of the registered users. The complainant has been given the opportunity to comment on the Sweden Democrats' report but has not returned. Reasons for the decision IMY shall initially decide whether the Sweden Democrats are the data controller for the processing of personal data to which the complaint relates. IMY shall then examine whether the Sweden Democrats had a legal basis for the current processing of personal data and whether the party has provided the complainant with sufficient information about the processing and the complainant's rights under the Data Protection Regulation. Data controller Applicable provisions According to Article 4(7) of the Data Protection Regulation, a natural or legal person, public authority, institution or other body which alone or jointly with others determines the purposes and means of the processing of personal data. An actor may be considered a data controller even if it lacks actual access to the personal data being processed. 2 IMY's assessment The Sweden Democrats have stated that the party is not the data controller for the personal data processing to which the complaint relates. The investigation into the case shows that the Sweden Democrats hired an external company to send out SMS messages with the aim of disseminating information about the party's policies ahead of the EU elections. The Sweden Democrats have decided how and why the message should be sent, what content it should have and the selection of recipients. The Sweden Democrats have thus decided how the processing should be carried out and for what purpose the personal data should be processed. IMY therefore assesses that the Sweden Democrats, despite the fact that the party did not have actual access to the personal data that was processed, is the data controller for the processing to which the complaint relates. Legal basis for the processing Applicable provisions etc. In accordance with the principle of accountability in Article 5(2) of the GDPR, the controller is responsible for and must be able to demonstrate that the rules in the GDPR are complied with, including that the processing is lawful. For personal data processing to be lawful, it must be based on one of the legal bases in the GDPR, which means that at least one of the conditions in Article 6(1) of the GDPR is met. For processing to be based on the legal basis of balancing of interests (also known as legitimate interest) in Article 6(1)(f) of the GDPR, three conditions must be met. Firstly, there must be a legitimate interest of the controller or a third party. Secondly, the processing of personal data must be necessary for the purposes of the legitimate interest. Thirdly, the interests or fundamental rights and freedoms of the data subjects must not outweigh the legitimate interests of the controller or a third party (balancing of interests). 3 The legitimate interest must be legitimate, which means that it must not conflict with either EU or national law. Furthermore, the interest must be clearly and distinctly formulated and relate to a genuine interest which exists at the time of the processing and is not hypothetical. In order for the pursuit of such a legitimate interest to enable the processing of personal data on the basis of Article 6(1)(f), the controller must comply with all other obligations under the GDPR. 6 2See the European Data Protection Board EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, paragraph 45 and the judgment of the Court of Justice of the European Union of 5 June 2018, Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, paragraph 38. 3See, inter alia, the judgments of the Court of Justice of the European Union of 4 May 2017, Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 28, of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 40, of 17 June 2021, M.I.C.M., C-597/19, EU:C:2020:1063, paragraph 106 and of 4 July 2023, Meta Platforms and Others, C-252/21, EU:C:2023:537, paragraph 106. 4See judgment of the Court of Justice of the European Union of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C-621/22, EU:C:2024:857, 5paragraph 49. 6See Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, paragraph 44. See Koninklijke Nederlandse Lawn Tennisbond, C-621/22, paragraph 50. Page 3 of 7Privacy Authority Case number: IMY-2024-7737 4(7) Date: 2025-10-22 The case-law of the Court of Justice of the European Union shows that the requirement of necessity is met if the legitimate interest cannot reasonably be achieved equally effectively by other means which are less intrusive in the fundamental rights and freedoms of the data subjects, in particular the right to respect for private life and the right to the protection of personal data as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. It is not sufficient that the processing is useful for the purposes of the legitimate interest, 7 the Court of Justice of the European Union has also stated that the processing must be strictly necessary. The requirement of necessity must be assessed in conjunction with the principle of data minimisation as set out in Article 5(1)(c) of the GDPR. This means that the personal data processed must be adequate, relevant and not exceed what is necessary in relation to the purposes for which they were collected and for which they are further processed. 8 The balancing of interests required by the third condition shall be carried out in the light of the specific circumstances of the case. The controller shall identify and take into account the interests, rights and freedoms of the data subject, the impact of the processing on the data subject and whether the data subject could reasonably expect processing for the purpose in question. In assessing the impact of the processing, the nature of the data processed as well as the context and other consequences of the processing shall be taken into account. Based on these circumstances, a balance shall be struck between the competing rights and interests, which shall include the possibility of additional mitigating measures going beyond what the controller is required to take in order to comply with the rules of the GDPR. 10 IMY's assessment The Sweden Democrats have stated that the processing of the complainant's personal data has been lawful because the party has had a legitimate interest in providing information about the party's policies and activities ahead of the 2024 EU elections. IMY shall therefore consider whether all three conditions for the processing of personal data based on the legal basis of legitimate interest are met. The Sweden Democrats' interest in disseminating information about their policies to voters ahead of an upcoming general election is lawful, genuine and actual. IMY therefore concludes that the interest in question is a legitimate interest within the meaning of Article 6(1)(f) of the Data Protection Regulation. For the processing to be lawful, it is also required that it is necessary to satisfy the legitimate interest. As mentioned, the necessity requirement shall be examined together with the principle of data minimization. The personal data processing in question has been limited in terms of the amount of personal data about the complainant, telephone number and postal code, and the data has been deleted immediately after the campaign has been carried out. IMY considers that it has not emerged that the purpose could reasonably have been met in an equally effective manner by alternative communication channels that would have required the processing of fewer personal data. Against this background 7 See Meta Platforms and Others, C-252/21, paragraph 126 and EDPB Guidelines 1/2024, paragraphs 28 and 29. Please note that the Guidelines have not been finally adopted by the EDPB at the time of this decision. 8See, inter alia, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, paragraphs 47 and 48 and Meta Platforms and Others, C-252/21, paragraphs 108 and 109. 9See, inter alia, Asociaţia de Proprietari bloc M5A-ScaraA, paragraphs 52-58. 10See EDPB Guidelines 1/2024, paragraphs 32-34. Page 4 of 7Privacy Protection Authority Case number: IMY-2024-7737 5(7) Date: 2025-10-22 IMY finds that the processing of the complainant’s personal data could be considered necessary for the stated purpose. As regards the third condition, the starting point in a balancing of interests shall be the interests and fundamental rights of the complainant, which primarily concern respect for privacy and the right to protection of personal data in the case at hand. As already stated, the processing covers a limited amount of personal data that is processed for a short time for the purpose of making a mailing at one time. However, IMY notes that the sending of a political message directly to an individual via SMS without the person having requested such information can be perceived as intrusive. The Marketing Act has introduced a particularly strong privacy protection when sending unsolicited advertising via SMS or e-mail. The protection means that such mailings are generally only permitted if consent has been obtained in advance. The primary purpose of the regulation is to protect consumers against particularly intrusive unsolicited advertising. The Marketing Act does not apply to political marketing, but the legislator's position on the need for special privacy protection shows that the interests of the data subjects weigh heavily when sending unsolicited advertising via SMS and e-mail. According to IMY, this means that the scope for using SMS for political advertising to those who are not members or have actively shown interest in the information is extremely limited. Against this background and taking into account that the complainant has not himself provided his personal data or had a previous relationship with the party, IMY believes that the processing cannot be considered to have been within the scope of the complainant's reasonable expectations. When assessing the complainant's interests, IMY has also taken into account that the message in question did not contain any information about the processing of the complainant's personal data. The complainant has thus not been able to form an opinion about which personal data have been processed and how the processing has taken place. The complainant has also not been informed of his rights under the Data Protection Regulation or contact details for the controller, and it has not been possible to respond to the message. The lack of such information has affected the complainant in a significant way, as it has made it more difficult to exercise the complainant's rights under the Data Protection Regulation. In an overall assessment, IMY finds that the complainant's interests and fundamental rights and freedoms outweigh the interest of the Sweden Democrats in reaching out with the information in question. Thus, the third condition in Article 6(1)(f) is not met. All conditions for the processing to be based on Article 6(1)(f) are therefore not met. It has also not emerged that the Sweden Democrats have supported the processing in any of the other legal grounds in Article 6(1) of the Data Protection Regulation. This means that the Sweden Democrats have not had a legal basis for the processing of personal data to which the complaint relates. The party has thus processed the complainant's personal data in violation of Article 6(1) of the Data Protection Regulation. 1See Section 19 of the Marketing Act (2008:486) and Levin, Marketing Act (1942:740) Section 19, Lexino 2025-08-25 (JUNO). Page 5 of 7Integritetsskyddsmyndigheten Filing number: IMY-2024-7737 6(7) Date: 2025-10-22 Information about the processing and the possibility of objecting Applicable provisions Article 12(2) of the Data Protection Regulation states that the controller shall facilitate the exercise of the data subject's rights in accordance with Articles 15–22 of the Regulation. Article 14 states what information the controller shall provide to the data subject when processing personal data that has not been provided by the data subject himself. The provision states that the controller shall, among other things, provide information on the identity and contact details of the controller, the purposes of the processing, the legitimate interests of the controller, the existence of the right to request erasure and to object to the processing. IMY's assessment The investigation shows that the message in question did not contain any information about the processing of personal data or who was responsible for it. What was clear about the sender was that the message came from "SD" and that it contained a call to vote for the Sweden Democrats. There was no contact details for the controller and it was not possible to respond to the message. The complainant has also not received information about, for example, the purposes and legal basis for the processing or about his rights under the Data Protection Regulation. Against this background, IMY considers that the Sweden Democrats have not made it easier for the complainant to exercise his rights under the Regulation and have not provided the complainant with sufficient information about the processing in question. The Sweden Democrats have thus processed the complainant's personal data in breach of Articles 12(2) and 14 of the Data Protection Regulation. Choice of intervention It is apparent from Articles 58(2) and 83(2) of the Data Protection Regulation that IMY has the authority to impose administrative sanctions in accordance with Article 83 for the infringements of Articles 6(1), 12(2) and 14 of the Regulation. Depending on the circumstances of the individual case, administrative sanctions shall be imposed in addition to or instead of the other measures referred to in Article 58(2), such as injunctions and prohibitions. Furthermore, Article 83(2) states which factors shall be taken into account when deciding whether to impose administrative penalty fees and when determining the amount of the fee. If the infringement is minor, the IMY may, as stated in recital 148, issue a reprimand in accordance with Article 58(2)(b) instead of imposing a penalty fee. Consideration shall be given to aggravating and mitigating circumstances in the case, such as the nature, severity and duration of the infringement and previous infringements of relevance. The IMY has assessed that the Sweden Democrats have lacked a legal basis for the processing of personal data to which the complaint relates. Furthermore, the Sweden Democrats have not facilitated the complainant to exercise his rights or provided the information required under the Data Protection Regulation. However, the processing in question has concerned a limited amount of personal data, which has been processed for a short time on one occasion and has thus not been of a systematic nature. In an overall assessment, IMY considers that this is a minor infringement in the sense of recital 148 of the Data Protection Regulation. IMY therefore reprimands the Sweden Democrats for the infringement. Page 6 of 7Integrity Protection Authority Case number: IMY-2024-7737 7(7) Date: 2025-10-22 __________________________ This decision has been made by the head of unit Nidia Nordenström after a presentation by departmental lawyer Maja Welander. In the final handling of the case, lawyer Michaela Prieto Ceric and advisor Victor Hagstedt have also participated. Nidia Nordenström Appendix The complainant's personal data How to appeal If you wish to appeal the decision, you should write to IMY. In the letter, state which decision you are appealing and the change you are requesting. The appeal must be received by IMY within three weeks from the date you received the decision. If you are a party representing the public, however, the appeal must be received within three weeks from the date the decision was announced. If the appeal has been received in good time, IMY will forward it to the Administrative Court in Stockholm for review. You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal data or information that may be subject to confidentiality. The authority 's contact details are stated on the first page of the decision. Page 7 of 7
