1(4)
Smartphoto Nordic AB
Östergatan 39
211 22 Malmö
Our ref.:
DI-2020-11216, IMI no. 155145 Supervision under the GDPR –
Date: Smartphoto Nordic AB
2021-06-16
Final decision of the Swedish Authority for
Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that Smartphoto Nordic AB
has processed personal data in violation of
Articles 12(3) and 17(1) of the General Data Protection Regulation (GDPR)1
by not until August 2019 erasing the personal data that the complainant has
requested erasure of 27 August 2018, and thereby not without undue delay,
and
Article 6(1) of the GDPR by having made a direct-addressed mailing to the
complainant in August 2019 without a legal basis for the processing.
The Swedish Authority for Privacy Protection (IMY) issues Smartphoto Nordic AB a
reprimand in accordance with Article 58(2)(b) of the GDPR.
Report on the supervisory matter
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Smartphoto Nordic AB (the company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as responsible supervisory authority pursuant to
Article 56 of the GDPR, from the supervisory authority of the country where the
complaint has lodged (Finland).The handover has been made in accordance with the
provisions of the Regulation on cooperation in cross-border processing.
The complaint is essentially the following. On 27 August 2018, the complainant
Postal address:
Box 8114 requested that the company erase her personal data because she had stopped being
104 20 Stockholm a customer (the first request).The company didn't answer. On 18 May 2019, the
Sweden complainant requested a new deletion (the second request).The company then
Website: responded that its IT department would handle the request. In August 2019, the
www.imy.se complainant received a direct marketing letter from the company and therefore
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the processing of
Telephone: personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection
+46 (8) 657 61 00 Regulation).
Swedish Authority Our ref.: DI-2020-11216, IMI no. 155145 2(4)
for Privacy Protection Date: 2021-06-16
assumes that the company has not deleted her personal data. The company has not
provided any information about the measures taken.
Smartphoto Nordic AB has mainly stated the following.
The company handled the first request as a customer complaint. The company
responded with a follow-up question if the complainant wanted compensation in the
form of a new order of inducing images completely free of charge. This is part of the
company’s Satisfaction Guarantee where the company wants to make sure customers
are satisfied with their order. The complainant did not respond to this request. In
anticipation of response, the company waited to delete the account, as a new order is
not possible after the account has been deleted.
When the complainant again made contact through the second request, deletion
began two days later on 20 May 2019. The complaint received information about this
the same day. The e-mail message stated, among other things, that this process can
take up to 30 days before it is fully executed. After these 30 days, the complainant has
not received any more mailings from the company except for an addressed direct
mailing in the summer of 2019. These mailings are carried out a maximum of 2 times
per year. The extract of addresses for the preparation of the mailing began during the
30 days where the process of erasing the complainant’s information had begun but
has not been fully executed. This meant that the complainant’s account was still active
regarding address and customer information when excerpts of addresses were made.
Therefore, the complainant’s address information was included as one of the recipients
of the mailing. The company will review its procedures for excerpts of addresses when
mailings so that it will not be repeated, so that accounts where deletion has begun
shall not receive mailings.
The investigation has been carried out in written form. In the light of cross-border
processing, IMY has used the mechanisms for cooperation and consistency contained
in Chapter VII of the GDPR. The supervisory authorities concerned have been the data
protection authorities in Finland, Norway and Denmark. The complaint is essentially
the following.
Justification of the decision
Applicable provisions, etc.
In order for the processing of personal data to be legal, a legal basis for processing is
required in Article 6 of the GDPR.
According to Article 12(3), the individual’s request to exercise his or her rights shall be
handled without undue delay and in any event no later than one month after the
request has been received. The deadline of one month may be extended by an
additional two months if the request is particularly complicated or the number of
requests received is high. If the period of one month is extended, the controller must
notify the data subject of the extension. The notification of the extension of the
deadline shall take place within one month of receipt of the request. The controller
must also indicate the reasons for the delay.
According to Article 17(1)(a), the data subject shall have the right to have their
personal data erased by the controller without undue delay and the controller shall be
obliged to erase personal data without undue delay if it is no longer necessary for the
Swedish Authority Our ref.: DI-2020-11216, IMI no. 155145 3(4)
for Privacy Protection Date: 2021-06-16
purposes for which they were collected or otherwise processed. Article 17(3) contains
an exhaustive list of the exceptions to this right.
The assessment of the Authority for Privacy Protection (IMY)
IMY holds that it was clearly stated by the complainant‘s first request of 27 August
2018 that she wanted her personal data to be erased. The company was therefore
obliged to delete the data unless there was a valid exception. Article 17(3) of the
GDPR does not include any exceptions to offer, as the company has done, the data
subject’s compensation instead of deleting the data. Since there was no valid
exception, the company was obliged to erase the data, which the company did not do
until August 2019. The company has thus not erased the complainant’s personal data
without undue delay in the sense referred to in Articles 12(3) and 17(1). Against this
background, there is no reason to decide on the measures taken by the company due
to the second request of 18 May 2019.
Since the company was obliged to erase the data, the company has processed the
complainant’s personal data in violation of Article 6(1) of the GDPR by having made a
direct-addressed mailing in August 2019 to the complainants without having a legal
basis for the processing.
Choice of corrective measure
Articles 58(2) and 83(2) of the GDPR states that IMY has the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the individual case, administrative fines shall be imposed in addition to or instead of
the other measures referred to in Article 58(2), such as injunctions and prohibitions.
Furthermore, Article 83(2) lists which factors should be taken into account in deciding
whether to impose an administrative fine and on the amount of the fine. If it is a minor
infringement, IMY may, as stated in recital 148 instead of impose an administrative
fine, issue a reprimand pursuant to Article 58(2)(b). Consideration shall be taken to
aggravating and mitigating circumstances in the case, such as the nature of the
infringement, severity and duration as well as previous relevant infringements.
IMY notes that Smartphoto Nordic AB has deleted the data and that the company has
reviewed its routines for direct-addressed mailings. The company has not previously
received any corrective measure for infringement of data protection rules. In an overall
assessment of the circumstances, IMY considers that there are minor violations in the
sense referred to in Recital 148 and that Smartphoto Nordic AB should be issued a
reprimand in accordance with Article 58(2)(b) of the GDPR for the stated
infringements.
The case is closed.
This decision has been made by Head of Unit after presentation
by legal advisor .
Swedish Authority Our ref.: DI-2020-11216, IMI no. 155145 4(4)
for Privacy Protection Date: 2021-06-16
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protection’s (IMY) decision 2021-06-16, no. DI-2020-11216. Only the Swedish version
of the decision is deemed authentic.