Svea Hovrätt - T 10711-21

From GDPRhub
Revision as of 14:46, 13 October 2022 by Kk (talk | contribs) (they/them pronouns instead of he/him/his, need to consistently use terms as controller or data subject; added a more detailed description of the facts; corrected the formatting of GDPR Articles: Article 15(3) GDPR instead of 'Article 15.3 of the GDPR')
Svea Hovrätt - T 10711-21
Courts logo1.png
Court: Svea Hovrätt (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 15(3) GDPR
Article 57(1)(f) GDPR
Article 78 GDPR
Article 79(1) GDPR
Article 47 EU Charter of Fundamental Rights
10 kap. 19 § rättegångsbalken
Decided: 07.10.2022
Published: 07.10.2022
Parties: Swedbank AB
WN
National Case Number/Name: T 10711-21
European Case Law Identifier:
Appeal from: Stockholms tingsrätt
T 14908-20
Appeal to: Unknown
Original Language(s): Swedish
Original Source: Svea hovrätt (in Swedish)
Initial Contributor: S.donner

A data subject can choose to bring their case to civil court even if they have not filed a complaint with the supervisory authority. Data subjects have a right to get access to a voice recording of their own voice. A transcript will not suffice.

English Summary

Facts

The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead.

Holding

The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case.

Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR.

According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data.

In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other rights in the GDPR to apply, for example the right to erasure. A transcript of phone conversations - which they had already obtained - cannot satisfy the right in this regard. Therefore, the data subject had the right to obtain a copy of the bank's recordings of their voice.

Unlike the District Court, the Court of Appeal ruled that there are conditions for obliging the bank to hand over the parts of the audio recordings where the man's voice was heard, but not the parts where the employees' voices were heard. The second person's voice did not in itself constitute personal data with respect to the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.