SAC - 6193-22: Difference between revisions

From GDPRhub
No edit summary
Line 68: Line 68:
}}
}}


The Swedish Supreme Administrative Court ruled that the DPA's decision not to investigate or act on complaints can be appealed.
The Swedish Supreme Administrative Court ruled that the DPA's decision not to investigate a complaint can be appealed.


== English Summary ==
== English Summary ==

Revision as of 12:13, 21 November 2023

SAC - 6193-22
Courts logo1.png
Court: SAC (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 78(1) GDPR
GDPR Recital 141
GDPR Recital 143
The Swedish Data Protection Act Chapter 7, § 3, first paragraph
Decided: 17.11.2023
Published: 17.11.2023
Parties: The Swedish DPA IMY
National Case Number/Name: 6193-22
European Case Law Identifier:
Appeal from: IMY
Unknown
Appeal to: Appealed - Confirmed
Original Language(s): Swedish
Original Source: The Swedish Supreme Administrative Court (in Swedish)
Initial Contributor: Rie Aleksandra Walle

The Swedish Supreme Administrative Court ruled that the DPA's decision not to investigate a complaint can be appealed.

English Summary

Facts

A data subject filed a complaint against a bank with the Swedish DPA IMY, claiming he was denied access to his personal data. The DPA chose to close the case, explaining that they had informed the bank about the complaint to allow them to evaluate their own processing and rectify any shortcomings.

The data subject appealed to the Administrative Court (Förvaltningsrätten) in Stockholm, but the appeal was dismissed. The court stated that the DPA's decision not to act on his complaint doesn't impact him in a way that qualifies for an appeal.

Subsequently, the data subject took his appeal to the Administrative Court of Appeal (Kammarrätten), which also rejected it. The court argued that the decision did not significantly affect the data subject and was, therefore, not eligible for an appeal under the relevant legal criteria.

Ultimately, the case reached the Supreme Administrative Court (SAC). In their ruling, the SAC cited Article 78(1) GDPR, which pertains to the right to an effective remedy against legally binding decisions made by a DPA. They referred to Recitals 141 and 143, highlighting that a data subject should have access to effective legal remedy at the competent national court against a DPA's decision that legally impacts them. The SAC noted an example from Recital 141, including cases where the DPA dismisses or rejects a complaint, either wholly or partially.

The SAC determined that a decision indicating the DPA's refusal to take the action requested in a complaint should be viewed as a legally binding decision, which is appealable under Article 78(1) GDPR. Therefore, since the data subject's complaint did not result in the desired actions, he is entitled to appeal.

Holding

The Supreme Administrative Court (SAC) overturned the decisions of the Administrative Court of Appeal and the Administrative Court, and referred the case back to the Administrative Court for reconsideration.

Comment

From initial contributor RAW: IMY has only noted that they'll review the cases in detail.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

1 (5)


                      HIGHEST

                      ADMINISTRATIVE COURT

                      JUDGMENT


                                                                              Objective No
                                                                              6193-22




                      announced in Stockholm on 17 November 2023


                      COMPLAINT
                      AA

                      COUNTERPART
                      The Swedish Privacy Protection Authority
                      Box 8114

                      104 20 Stockholm

                      APPEAL AGAINST A DECISION
                      The Court of Appeal in Stockholm's judgment on 17 October 2022 in case no. 2327-22


                      THE THING
                      Rejected appeal in case of personal data processing

                      ___________________


                      DECISION OF THE SUPREME ADMINISTRATIVE COURT



                      The Supreme Administrative Court overrules that of the Court of Appeal and the Administrative Court
                      rulings and refers the case back to the administrative court for new processing.



                      BACKGROUND


                1. The EU's data protection regulation aims to protect the data of natural persons

                      fundamental rights and freedoms, especially their right to protection of

                      personal data. Anyone who considers that a processing of personal data that

                      refers to her or him contravening the regulation has the right to file a





4
6 Visiting address Opening hours Postal address E-mail
2 Birger Jarls torg 13 Monday–Friday Box 2293 hogstaforvaltningsdomstolen@dom.se
. Telephone 09:00–12:00 103 17 Stockholm Website
o 13:00–16:00
D 08-561 676 00 www.hogstaforvaltningsdomstolen.se 2 (5)

     HIGHEST Goal no
     ADMINISTRATIVE COURT JUDGMENT 6193-22




                         complaint to a regulatory authority. According to the regulation, everyone must also have

                         right to an effective remedy against the supervisory authority's legal binding

                         decision or if the supervisory authority e.g. fails to process a complaint.


                   2. In Sweden, the Data Protection Authority is the supervisory authority in data protection

                         the area. The authority's decision according to the EU's data protection regulation may be appealed

                         to the general administrative court.


                   3. AA has made a complaint to the Swedish Privacy Protection Agency against some

                         officials at a bank who, according to him, have refused to give him statements like him

                         have the right to according to the EU data protection regulation. The Swedish Privacy Protection Authority

                         decided to close the case. In the decision it was stated that the authority sent
                         information about the complaint to the bank in order to give the bank the opportunity to itself

                         review its processing of personal data and correct any deficiencies.



                   4. The administrative court in Stockholm rejected AA's appeal there. As a reason for

                         the decision stated that the Data Protection Authority's decision not to take any
                         action in respect of the complaint does not affect him in such a way that

                         it is appealable.



                   5. AA appealed the rejection decision to the Court of Appeal in Stockholm.
                         The Court of Appeal rejected the appeal and stated the following. Applicable

                         provisions do not contain any explicit regulation of which decisions of

                         the supervisory authority in complaint cases that must be subject to appeal. The question about

                         appealability may therefore be assessed in each individual case with an application of
                         Section 41 of the Administration Act (2017:900). Decisive are the actual effects

                         the decision gets for the person concerned. The decision has no actual effects in it

                         meaning that it can be perceived as binding in some respect with the consequence that it

                         can have effects according to its content and influence other decision-making bodies or

                         the actions of individuals. The decision therefore does not have the required impact
                         in accordance with section 41 of the Administrative Act in order for it to be appealable. It can't
3
6
2
.
O
D 3 (5)

    HIGHEST Goal no
    ADMINISTRATIVE COURT JUDGMENT 6193-22




                        rather is perceived as a legally binding decision that actualizes the right to a

                        effective remedy under the EU Data Protection Regulation.



                        CLAIMS, M.M.


                  6. AA pursues its claim.



                  7. The Privacy Protection Authority considers that the appeal should be rejected.


                        THE REASONS FOR THE DECISION



                        The question in the case


                  8. The question in the case is about the Data Protection Authority's decision not to investigate one

                        further complaints are appealable.



                        Legal regulation, etc.


                  9. From Article 78.1 of Regulation (EU) 2016/679 of the European Parliament and of the Council on

                        protection of natural persons with regard to the processing of personal data and

                        on the free flow of such data and on the repeal of directives
                        95/46/EC (General Data Protection Regulation), the EU's data protection regulation, follows that

                        every natural or legal person shall have the right to an effective remedy against a

                        legally binding decisions concerning them issued by a supervisory authority.


                  10. In ch. 7 Section 3 first paragraph of the Act (2018:218) with supplementary provisions

                        to the EU's data protection regulation, the Data Protection Act, states that supervisory authorities

                        the authority's decision according to the EU's data protection regulation may be appealed to the public

                        administrative court.



3
6
2
.
O
D 4 (5)

     HIGHEST Goal no
     ADMINISTRATIVE COURT JUDGMENT 6193-22




                         The Supreme Administrative Court's assessment



                   11. The EU Data Protection Regulation came into force on 25 May 2018 and replaced

                         hence the Personal Data Act (1998:204). There are provisions in the Data Protection Act
                         which on a general level supplements the regulation.



                   12. In the preparatory work for the Data Protection Act, the issue of the regulation was discussed

                         presupposes that the individual must have a general right to appeal against supervisory
                         the authority's decision to e.g. not take any action due to one

                         complaint. The government considered that it was unclear whether the regulation means that it

                         data subjects have the right to appeal the supervisory authority's decision not to act

                         any action in response to a complaint. Regardless of how the regulation should
                         interpreted in this respect, however, no constitutional measures were required i

                         Swedish law. It was instead left to the courts to, through an interpretation

                         of the Administrative Act's general provisions on appeals, take a position in

                         the question of whether Swedish jurisprudence is still relevant or whether the regulation has

                         changed the legal situation (prop. 2017/18:105 p. 164 f.).


                   13. The right to an effective legal remedy according to Article 78.1 of the EU data protection

                         regulation applies in respect of legally binding decisions issued by a

                         supervisory authority. It appears from recitals 141 and 143 in the preamble to the regulation
                         that the data subject should have the right to an effective legal remedy with the competent authority

                         the national court against a decision of a supervisory authority that has legal

                         consequences for this person. Examples include decisions where supervisory

                         the authority rejects or rejects a complaint in whole or in part.


                   14. According to the Supreme Administrative Court, this means that a decision whose meaning

                         is that the Privacy Protection Authority will not do what is requested in one

                         complaint must be considered a legally binding decision that is subject to appeal

                         according to Article 78.1 of the EU Data Protection Regulation.

3
6
2
.
O
D 5 (5)

    HIGHEST Goal no
                                                      JUDGMENT
    ADMINISTRATIVE COURT 6193-22



                  15. AA's complaints to the Swedish Privacy Agency have not led to those of him

                        the requested measures. It follows from the foregoing that AA has the right to appeal

                        The Privacy Protection Authority's decision. The Court of Appeal and the Administrative Court

                        the rulings must therefore be annulled and the case referred back to the administrative court

                        for new processing.






                        _______________________ _______________________




                        _______________________ _______________________




                        Justice Henrik Jermsten, Thomas Bull,

                        Marie Jönsson and Magnus Medin.



                        The rapporteur has been the Secretary of Justice Max Uhmeier.























3
6
2
.
O
D