Kammarrätten i Stockholm - Mål nr 4413-22: Difference between revisions

Latest revision as of 14:52, 25 April 2023

Kammarrätten i Stockholm - Mål nr 4413-22

Court:	KamR Stockholm (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 15(1) GDPR Article 15(1)(c) GDPR Brottsdatalagen 4 kap. 3 §
Decided:	04.04.2023
Published:
Parties:	Polismyndigheten
National Case Number/Name:	Mål nr 4413-22
European Case Law Identifier:
Appeal from:	Förvaltningsrätten i stockholm (Sweden)
Appeal to:	Pending appeal
Original Language(s):	Swedish
Original Source:	Kammarrätten i Stockholm (in Swedish)
Initial Contributor:	n/a

The Stockholm Administrative Court of Appeals ruled that the Police Authority had not provided sufficient information to the data subject regarding the processing of the data subject's personal data in both ongoing and archived criminal investigations.

English Summary

Facts

The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases.

The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities.

The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed.

The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data subject, and that 2) the Police had indeed informed the data subject about the purposes of the processing activities.

Holding

Firstly, the Court established that 1) according to Chapter 4, Section 3 of the Swedish Criminal Data Act, the data controller must inform the person who requests it, without undue delay, provide written information on whether personal data concerning him or her is being processed. Secondly, the Court established that 2) Article 15 GDPR includes essentially equivalent regulations.

The Court assessed if the Police had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and Article 15 GDPR, as applicable. The Court viewed that the GDPR applies to processing in archived criminal investigations, and that the Swedish Criminal Data Act applies to processing in ongoing criminal investigations.

The Court held, that Article 15(1)(c) GDPR must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means that the controller is required to provide the data subject with information of the actual identity of the recipients, unless an exemption under Article 12(5) GDPR applies. The Court viewed that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients under the Swedish Criminal Data Act.

Firstly, the Court stated that the information provided by the Police was too general, as the Police has provided only information on the categories of personal data normally processed in those kind of criminal investigation cases. The Court ruled that the Police had therefore not fulfilled the requirements of Article 15 GDPR or the Chapter 4 Section 3 of the Swedish Criminal Data Act. Secondly, The Court did not question the Police’s argument that, with regard to archived criminal investigations, they don't have information about the actual identities of recipients of the data.

With regard to the ongoing criminal investigation activities, the Court viewed that the Police did not indicate any reason why they only provided information on the prospective recipients and not the actual recipients. The Court decided that the Police had not fulfilled its obligations either in this respect under Chapter 4, section 3 of the Criminal Data Act and Article 15(1) GDPR, but that the Police had provided sufficient information about the purposes of processing.

The Court annulled the lower courts' decision in the aforementioned parts, and the case was returned to the Police for a new assessment.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Judgments and decisions Here you can read about what to do when you want to take part in public documents.
Here you will also find links to the supreme courts that publish judgments on their own websites, and to other collections of judgments.

@@ Line 7: / Line 7: @@
 |Court_Original_Name=Kammarrätten i Stockholm
 |Court_English_Name=The Administrative court of Appeals of Stockholm
-|Court_With_Country=Kammarrätten i Stockholm (Sweden)
+|Court_With_Country=KamR Stockholm (Sweden)
 |Case_Number_Name=Mål nr 4413-22
@@ Line 53: / Line 53: @@
 |Party_Link_3=
-|Appeal_From_Body=Förvaltningsrätt
+|Appeal_From_Body= Förvaltningsrätten i stockholm (Sweden)
 |Appeal_From_Case_Number_Name=
 |Appeal_From_Status=
@@ Line 66: / Line 66: @@
 }}
-The Administrative Court of Appeals ruled that the Police had not provided sufficient information to the data subject about the processing in the criminal investigation activities and archived investigations, nor access to the personal data.
+The Stockholm Administrative Court of Appeals ruled that the Police Authority had not provided sufficient information to the data subject regarding the processing of the data subject's personal data in both ongoing and archived criminal investigations.
 == English Summary ==
 === Facts ===
-The data subject (DS) had made an access request to the Police Authority to receive information on how their personal data is processed by the National Operations Department. The Police had provided certain information of personal data relating to criminal investigation cases and archived criminal investigation cases. The Police refused to provide any further information on how the DS’s data was processed. The Police justified the refusal that such provision of further information on what personal data exactly of the DS was processed, could jeopardise ongoing investigations, other police actions or future activities.
+The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases.
-The DS appealed against the decision to the Administrative Court, which rejected the appeal. The DS took the case before the Administrative Court of Appeals in Stockholm.
+The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities.
-The DS stated that they only received a summary of the processing activities, but did not receive access to their personal data. The DS gave as an example that they did not receive information on a) what name was she referred to in different cases, and b) who had provided information about her to the Police. The DS viewed that the Swedish Criminal Data Act (brottsdatalagen, whereby the EU's criminal data directive, 2016/680, has been implemented in Swedish law) is not applicable to closed cases. The DS argued, firstly, that under [[Article 15 GDPR#1c|Article 15(1)(c) GDPR]] they have a right to receive information on the actual recipients of personal data, and secondly, that the information received should be as accurate as possible. The DS also argued that the Police did not indicate the purposes of the various processing activities to which the DS was subject to.
+The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed.
-The Police considered that the appeal should be dismissed, and argued that the GDPR does not provide the DS with the right to obtain a copy of the information if the right to information can be ensured by other means. The Police represented that it did not have the information of actual recipients regarding the DS’s cases in archived criminal investigations. Therefore, the Police represented that it could only provide the DS with information about the categories of recipients which the Police argued to be sufficient under the GDPR.  The Police also stated that the DS does not have a right to know who provided the data as that data would be personal data about those persons who have provided such information. The police argued it had indeed informed the DS about the purposes of processing the DS’s personal data.
+The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data subject, and that 2) the Police had indeed informed the data subject about the purposes of the processing activities.
 === Holding ===
-Firstly, the court established that the GDPR applies to the processing of personal data which does not fall under the Swedish Criminal Data Act. The Court viewed that the Swedish Criminal Data Act is applicable with regard to criminal investigation activities and GDPR to archived criminal investigations.
+Firstly, the Court established that 1) according to Chapter 4, Section 3 of the Swedish Criminal Data Act, the data controller must inform the person who requests it, without undue delay, provide written information on whether personal data concerning him or her is being processed. Secondly, the Court established that 2) [[Article 15 GDPR]] includes essentially equivalent regulations.
-As regards to the part of the Police’s refusal where the Police based its refusal on secrecy under the Swedish Public Access to Information and Secrecy Act (offentlighets- och sekretesslagen), the court viewed that it should have been the first instance for the appeal in that sense, in the first place. Therefore, the court set aside the corresponding part of the case and established a separate case, where it will resolve the issue for that part of the case.
+The Court assessed if the Police had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and [[Article 15 GDPR]], as applicable. The Court viewed that the GDPR applies to processing in ''archived'' criminal investigations, and that the Swedish Criminal Data Act applies to processing in ''ongoing'' criminal investigations.
-The Court assessed if the Police Authority had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and [[Article 15 GDPR|Article 15 GDPR]], as applicable. The Court agreed with the Police Authority that data related to a cancelled investigation can be processed until the crime becomes statute-barred.
+The Court held, that [[Article 15 GDPR#1c|Article 15(1)(c) GDPR]] must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means that the controller is required to provide the data subject with information of the actual identity of the recipients, unless an exemption under [[Article 12 GDPR#5|Article 12(5) GDPR]] applies. The Court viewed that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients under the Swedish Criminal Data Act.
-The Court cited a CJEU decision from 12 January 2023 (C-154/21) and represented that the CJEU has held that [[Article 15 GDPR#1c|Article 15(1)(c) GDPR]] must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means - where the data has been disclosed or is to be disclosed to recipient(s) - that the controller is required to provide the data subject with information of the actual identity of recipients, unless it is impossible to identify the recipients, or that the controller demonstrates that the data subject's request for access is manifestly unfounded or unreasonable within the meaning of [[Article 12 GDPR#5|Article 12(5) GDPR]].
+Firstly, the Court stated that the information provided by the Police was too general, as the Police has provided only information on the categories of personal data normally processed in those kind of criminal investigation cases. The Court ruled that the Police had therefore not fulfilled the requirements of [[Article 15 GDPR]] or the Chapter 4 Section 3 of the Swedish Criminal Data Act. Secondly, The Court did not question the Police’s argument that, with regard to archived criminal investigations, they don't have information about the actual identities of recipients of the data.
-The Court represented firstly, that a fundamental purpose of the right to be informed in writing is to enable a data subject to be aware of the personal data and verify that they are being processed correctly in order to be able to use any rights in relation to the processing of the personal data. Secondly, that a summary in an intelligible form may be sufficient to fulfil the requirements, and that therefore, it does not have to be a copy of the data or of the exact document in which the personal data are contained.
+With regard to the ongoing criminal investigation activities, the Court viewed that the Police did not indicate any reason why they only provided information on the prospective recipients and not the actual recipients. The Court decided that the Police had not fulfilled its obligations either in this respect under Chapter 4, section 3 of the Criminal Data Act and [[Article 15 GDPR#1|Article 15(1) GDPR]], but that the Police had provided sufficient information about the purposes of processing.
-The Court represented that the Police had provided information on the categories of personal data that are normally processed in these cases. The Court stated that the DS has a right to know what the data is and to have access to it under [[Article 15 GDPR|Article 15 GDPR]] and the Criminal Data Act. The Court also said that the DS has a right to know the source of the data. The Court ruled that the information provided by the Police was therefore too general and that the Police had not fulfilled the requirements of [[Article 15 GDPR|Article 15 GDPR]] or the Swedish Criminal Data Act.
-Additionally, the Court noted that there is an exception of the requirement to provide the identity of the actual recipients under Article 15(c) GDPR. The exception applies when it is impossible to identify the recipient(s). The Court ruled that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients in the Swedish Criminal Data Act. The Court did not question the Police’s statement that, with regard to archived criminal investigations, there is no information about the actual identities of any recipients of the DS’s personal data. However, with regard to the criminal investigation activities, the Court viewed that the Police’s decision did not indicate any reason why information is provided only about the prospective recipients and not about the actual recipients of disclosed data. The Court ruled that the Police authority had not fulfilled its obligations in respect of the decision either in this respect under Chapter 4, section 3 of the Criminal Data Act and [[Article 15 GDPR#1|Article 15(1) GDPR]].
+The Court annulled the lower courts' decision in the aforementioned parts, and the case was returned to the Police for a new assessment.
-The Court did consider that the Police Authority has provided sufficient information about the purposes for which the DS’s personal data is processed.
-the Court ruled that 1) the Police had not provided sufficient information about the processing of personal data relating to the DS in the criminal investigation activities and neither in archived investigations, nor has the DS been given access to the data, and that 2) the information provided to the DS was also insufficient with regard to the criminal investigation activities in terms of who the recipients of the personal data are.
-The lower courts' decision was annulled in the aforementioned parts and the case was returned to the Police for a new assessment. The Court added that if, in that second review, the Police comes to the conclusion that certain information cannot be disclosed due to confidentiality it must be stated in the decision itself.
 == Comment ==