Kammarrätten i Stockholm - 6027-23

Kammarrätten i Stockholm - 6027-23
Court:	KamR Stockholm (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 10 GDPR Article 85(1) GDPR Article 85(2) GDPR 1 kap. 20 § Fundamental Law on Freedom of Expression 1 kap. 4 § Fundamental Law on Freedom of Expression 21 kap. 7 § Public Access to Information and Secrecy Act
Decided:	13.03.2024
Published:
Parties:	Prolegia Research AB
National Case Number/Name:	6027-23
European Case Law Identifier:
Appeal from:	KamR Stockholm (Sweden) ÅM2023-1596
Appeal to:	Unknown
Original Language(s):	Swedish
Original Source:	Allmanhandling.se (in Swedish)
Initial Contributor:	Johan90

The case concerns the demarcation of the Swedish system with a media license that gives the database constitutional protection (freedom of expression) and the demarcation between the right to take part in public documents and use them in one's corporate activities. The Court of Appeal finds that the company's use of obtaining the documents for background checks because the priority of EU law means that the Swedish regulation should not be applied, and therefore the Public Prosecutor's Office cannot interpret it.

English Summary

Facts

A company Prolegia Research AB has request to take part in records in a criminal case by the constitutional right to access public records in sweden. The company is sericeprovider in are like background checks and consultancy in recruitment. The company has during the process to get access applied for a voluntary certificate of publication that give the entity the same constituinal cover as pappers and TV by the constutition.

The company has calmes that the by the voluntary certificate of publication is useing the data in the records for prupes of journalism and by that not is obligated to enforce the GDPR. The question in the case are if the EU-law by GDPR are to be enforced before the swedish constition and if the the company are processing with the records are for journalism purpes or more for a bussiness purpes.

Holding

The DPA has in a memorandum, IMYRS 2022:2 sayed following as a summery.

According to Article 85 of the Data Protection Regulation, Member States are obliged to national legislation the right to protection of personal integrity and the right to freedom of expression and information. In Sweden, this has taken place through the regulation in ch. 1. Section 7 of the law (2018:218) with provisions adapting to the EU's data protection regulation (data protection act). The first paragraph of the section states that personal data processing that is covered by the constitutional protection in the Freedom of the Press Ordinance (TF) and the freedom of expression fundamental law (YGL) are exempted from the requirements and the data protection regulation if the application of the regulation would come into conflict with the constitutions. In c h. 1 Section 7, second paragraph, exceptions are made with regard to opinion and freedom of information. The exception covers treatments that take place for journalistic purposes purposes or for academic, artistic or literary creation. If the exception is applicable, most provisions of the data protection regulation do not apply.

In the legal position, the following questions concerning concepts are dealt with "journalistic purposes" based on, among other things, case law from the European Court of Justice and Swedish courts. The position statement also contains a number of examples such as guidance for the application.

Comment

This is a question many lawyers in Sweden have seen as a problem where the question has been if the Swedish system is compliant with the EU law. The judgment is the first, but the Supreme Administrative Court of Apple has granted dispensation review in a case in the same ground question (case 4588-23) and also has Attunda District Court in Mars requested a preliminary ruling from the court of justice in the same area (district courts nr T 3743-23).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

BACKGROUND
The Swedish Prosecution Authority decided on 13 July 2023 to reject Prolegia Research AB's request to take part records in criminal case AM-73270-17 and AM-98355-09. As the basis for the decision, it was stated that it could be assumed that the requested data in the records would be processed after disclosure in violation of the EU's data protection regulation 2016/679 (the data protection regulation) and law (2018:218) with supplementary provisions to the EU's data protection regulation (the data protection law ) and that confidentiality according to ch. 21 Section 7 of the Public Access to Information and Secrecy Act (2009:400), OSL, therefore prevented disclosure.

Prolegia appealed to the Court of Appeal in Stockholm, which on 19 September 2023 (case no. 4653-23) remanded the case as the company had brought forward that the company would conduct journalistic activities and the Public Prosecutor's Office had not taken a position on whether this meant that the company's processing of the personal data contained in the requested documents were exempt from the data protection regulation.

In the now appealed decision, the Swedish Prosecution Authority, after taking into account the submitted voluntary release certificate, again rejected Prolegia's request to take part in of records in criminal cases AM-73270-17 and AM-98355-09. The Swedish Prosecution Authority stated in the decision that the journalistic purpose must be the main purpose of the processing of personal data so that the exception for journalistic activities must be applicable when assessing whether the data after disclosure can be assumed to be processed in violation of the EU's data protection regulation or the data protection act. Since it had not emerged that Prolegia, which mainly engages in background checks and consultancy in recruitment, had started any journalistic activities, the requested information was covered according to the Prosecutor's Office by confidentiality according to ch. 21. Section 7 OSL.

CLAIMS, M.M.
Prolegia stands by its request and puts forward, among other things, following. The company has, through a granted publication certificate, a constitutionally protected right to publish its database. The EU's data protection regulation with supplementary Swedish regulations shall not be applied to this part of the company's operations. For the same reason, the data cannot be covered by confidentiality according to ch. 21. Section 7 OSL. The company intends to carry out journalistic activities. It is not a question of maintaining a legal database with search services that contains personal data about individuals. It is not the task of the Swedish Prosecution Authority to assess whether the company's operations are sufficiently journalistic. It is also neither appropriate nor in accordance with current law to give an authority the opportunity to preview and accept, or reject, the explanation provided regarding the relevance of the requested information to the public debate, investigative journalism or broader journalistic purposes. The actions of the Swedish Prosecution Authority involve a circumvention of the rights that follow from a certificate of issuance. The public prosecutor's office has also investigated who requested some of the documents in question and therefore did not carry out the exercise of authority in an objective and impartial manner.

REASONS FOR THE COURT OF COURT'S DECISION

Swedish Prosecution Authority procedure 
The Court of Appeal does not supervise the 
Swedish Prosecution Authority. What Prolegia has brought forward about the authority's proecedure of the case therefore does not entail any action on the part of the Court of Appeal.

Right to take part in public records

The issue in the case Similar to the Swedish Prosecution Authority, the Court of Appeal considers that the requested documents are public records. The question in the case therefore becomes whether there is any provision in OSL, primarily ch. 21. Section 7, which means that the records must not be disclosed to Prolegia anyway. As it has emerged in the case that Prolegia has been granted a so-called voluntary certificate of publication and therefore covered by the same constitutional protection as the traditional mass media, the question arises of the relationship between the data protection regulation and the constitutional protection of freedom of expression in the form of publication of information about prosecution on websites. There are no guiding rulings on the issue.

Legal starting points

EU law

Article 10 of the data protection regulation states, among other things, that the processing of personal data relating to convictions in criminal cases and offenses involving crimes may only be carried out under the control of an authority or when processing is permitted under Union law or the national law of the Member States, where appropriate protective measures for the rights and freedoms of the data subjects are established.

According to Article 85(1) point one of the data protection regulation, the member states must by law combine the right to privacy in accordance with the regulation with the freedom of expression and information, including processing that takes place for e.g. journalistic purposes. From the second point of the article, it appears that the member states, when processing for journalistic purposes, must determine exceptions or deviations from some of the regulation's provisions, if these are necessary to combine the right to privacy with freedom of expression and information. In Article 86, the possibility of exceptions to the publicity of documents is given in order to balance this right with the right to protection of personal data.

In a ruling on 22 June 2021 (Latvijkas Republikas Saeima, C-439/19, EU:C:2021:504), the European Court of Justice has found that the provisions of the Data Protection Regulation may constitute an obstacle to certain national legislation which means that an authority transfers information about offences, covered by Article 10, to economic operators for further exploitation. The Court recalled that the purpose of Article 10 is to ensure enhanced protection against such processing which, by reason of the particular sensitivity of the data, may constitute a particularly serious interference with the fundamental right to respect for private life and protection of personal data in accordance with the Articles 7 and 8 of the EU Charter of Rights. The Court also stated that Union law takes precedence over national provisions, including the Constitution (paragraphs 74, 126 and 135).

The Swedish constitutional protection and the relationship to the data protection regulation

When introducing the Data Protection Act, the legislator considered that the EU data protection regulations continued to provide scope for the provisions on freedom of press and expression in the Swedish constitutions. A disclosure provision was therefore introduced through ch. 1. Section 7 first paragraph of the Data Protection Act, which makes it clear that the Freedom of the Press Act, TF, and the Fundamental Law on Freedom of Expression, YGL, take precedence over the provisions of the Data Protection Ordinance and the Act. From the provision's second paragraph, which has its basis in Article 85(2) of the data protection regulation, it appears that i.a. Article 10 of the Data Protection Regulation shall not be applied to the processing of personal data for journalistic purposes or for academic, artistic or literary creation.

In the so-called the database rule in ch. 1 § 4 YGL is regulated under which conditions provision of information from a database over the internet is covered by YGL. An actor can, upon application, be granted a certificate of issuance and thereby be covered by constitutional protection. This means according to ch. 1 § 7 first paragraph of the Data Protection Act that the Data Protection Ordinance with supplementary Swedish regulations shall not be applied to the constitutionally protected part of the operator's activities, to the extent that it would conflict with TF or YGL.

In the preparatory work for the regulations on certificates of issue, it was established that free access to information as rich as possible and to varying opinions is a prerequisite for the citizens themselves to be able to take a stand on various issues that concern them. Among the civil liberties and rights, freedom of expression therefore occupies a central position which, together with freedom of information, has received specific protection in Swedish law through TF and YGL. When introducing the so-called voluntary issuance certificates, the legislator noted that a risk with having to apply for and be granted such a certificate is that the person who wants constitutional protection must turn to an authority. It was stated that it could not be ruled out that there is a risk that the authority in a tense social situation applies the application rules in such a way that constitutional protection is denied with regard to the expected content of the database. The risk was eliminated by stating the conditions for constitutional protection directly in the constitution, current chapter 1. § 5 YGL (government bill prop. 2001/02:74 pp. 36 and 49).

On January 1, 2019, the possibility was introduced to limit constitutional protection by law regarding certain search services that contain data of a particularly privacy-sensitive nature, e.g. information about sexual orientation and health, with the support of ch. 1 Section 20 YGL. Proposals for corresponding provisions regarding legal violations have been presented on two occasions but not adopted by the Riksdag (Committee terms of reference Dir. 2023:145, pp. 6–7). The Swedish legislation thus lacks the possibility to limit the constitutional protection according to YGL with regard to information about violations of the law through domestic law.

The Court of Appeal's assessment

Prolegia has requested access to certain documents in two criminal cases and stated that they are to be used in journalistic activities and that it is not a question of maintaining a legal database with search services that contain personal data about individuals. Since the processing of the requested documents involves the processing of personal data, including information about violations of the law that include crimes, the processing falls under Article 10 of the Data Protection Regulation.

Such a strict approach as follows from ch. 1. Section 7 first paragraph of the Swedish Data Protection Act, i.e. that the Swedish constitutional protection must always take precedence over the data protection regulation for the holder of a voluntary issuance certificate, is not compatible with the principle of the primacy of Union law. This is especially true in light of the fact that the constitutionally protected part of the business is, according to Swedish law, completely exempt from the provisions of the data protection regulation and that no proportionality assessment is made between, on the one hand, the right to protection of personal data and, on the other hand, the right to protection of freedom of expression and information (Latvijkas Republikas Saeima, p. 105). Taking into account the principle of the primacy of Union law and the practice of the European Court of Justice, the Court of Appeal considers that a balance must be made in each individual case between the privacy protection interest that is expressed by the data protection regulation and the constitutionally protected rights that apply to holders of voluntary issuance certificates and that are found in TF and YGL .

In this context, it can be stated that the examination carried out when issuing voluntary certificates of issue is of a formal nature. There is also no requirement that any actual journalistic activity, regardless of content, must have begun. In addition, it can be noted that Prolegia already operates an established business in recruitment and that information has previously been requested from the Public Prosecutor's Office in order to carry out background checks in recruitment procedures. It was only after Prolegia had been denied access to certain documents that the company came in with a release certificate and stated that it wished to access the information for journalistic purposes. It has not emerged that Prolegia has started any journalistic activities.

Denying an actor who has been granted a release certificate access to documents on the grounds that constitutional protection must give way in favor of the Data Protection Regulation must be done with great care. At the same time, the data protection regulation places clear requirements on the member states to establish appropriate safeguards for the rights and freedoms of the data subjects when it comes to personal data relating to convictions in criminal cases and offenses involving crimes, when the processing of such data is carried out by someone other than an authority. When it comes to the proportionality balance between different interests that must be made, the European Court of Justice has stated that data falling under Article 10 of the Data Protection Regulation relates to behavior that society disapproves of, and that granting access to such data may therefore stigmatize the person concerned and constitute a serious interference in his or her private or professional life (Latvijkas Republikas Saeima p. 75).

Against this background, automatically completely exempting Prolegia from the provisions of the data protection regulation is not compatible with the proportionality assessment that must be made between freedom of expression, public actions and the protection of personal data. The Data Protection Ordinance must therefore be applied when assessing whether Prolegia has the right to access requested documents, despite what is prescribed in the Data Protection Act regarding the primacy of constitutional protection.

The Data Protection Regulation allows certain exceptions to the protection of personal data for activities that have journalistic purposes. The concept of journalistic purposes must be given a broad interpretation, including activities aimed at disseminating information, opinions or ideas to the public, and is applied to all persons engaged in journalistic activities (Satakunnan Markkinapörssi and Satamedia, C-73/07, EU:C:2008 :727 pp. 56, 58 and 61).

In a balance between the data subjects' interest in the protection of their personal data and Prolegia's interest in accessing the current data with the intention of being able to carry out journalistic activities in the future, the data subjects' rights weigh more heavily. In making this assessment, the Court of Appeal has taken into account in particular that the information relates to violations of the law and that disclosure could constitute a serious interference in the individual's private or professional life. Prolegia also has, with regard to its already established recruitment activities, an interest in obtaining the data, which currently appears to be the actual purpose of the processing of the requested personal data.

Against this background, it can be assumed that the information in the requested documents will, after disclosure, be processed in violation of the data protection regulation. The information is therefore covered by confidentiality according to ch. 21 Section 7 OSL. The appeal must therefore be dismissed