Svea Hovrätt - T 10711-21
| Svea Hovrätt - T 10711-21 | |
|---|---|
 | |
| Court: | Svea Hovrätt (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 15(3) GDPR Article 57(1)(f) GDPR Article 78 GDPR Article 79(1) GDPR Article 47 EU Charter of Fundamental Rights 10 kap. 19 § rättegångsbalken |
| Decided: | 07.10.2022 |
| Published: | 07.10.2022 |
| Parties: | Swedbank AB WN |
| National Case Number/Name: | T 10711-21 |
| European Case Law Identifier: | |
| Appeal from: | Stockholms tingsrätt T 14908-20 |
| Appeal to: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | Svea hovrätt (in Swedish) |
| Initial Contributor: | S.donner |
A data subject can choose to bring their case to civil court even if they have not filed a complaint with the supervisory authority. Data subjects have a right to get access to a voice recording of their own voice. A transcript will not suffice.
English Summary
Facts
The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead.
Holding
The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case.
Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR.
According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data.
In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other rights in the GDPR to apply, for example the right to erasure. A transcript of phone conversations - which they had already obtained - cannot satisfy the right in this regard. Therefore, the data subject had the right to obtain a copy of the bank's recordings of their voice.
Unlike the District Court, the Court of Appeal ruled that there are conditions for obliging the bank to hand over the parts of the audio recordings where the man's voice was heard, but not the parts where the employees' voices were heard. The second person's voice did not in itself constitute personal data with respect to the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
