1(2)
Our ref.:
DI-2021-7331 Final decision in IMI case register
Date: 134972
2021-09-10
Decision of the Swedish Authority for Privacy
Protection
The case will be closed without further action.
Background
A complaint was lodged with the UK SA on 20 September 2019. The complainant had
bought a product in 2017 from a company that was later purchased by Irootfor
(hereinafter the company). On three occasions in August 2019 (2nd, 4th and 20th), the
complainant received marketing SMS from the company. In order to unsubscribe, the
complainant had to text a non-UK number that would charge a fee according to the
complainant. The complainant instead sent out a tweet (on Twitter) on 4 August which
the company did not respond to. The complainant sent out another tweet on 20th
August informing the company about potential fines for GDPR breaches. On 20th
September 2019, the complainant received a fourth marketing text and sent out
another tweet which the company responded to and offered removing the
complainant’s number from their database. The complainant requested that the
company removed everyone’s numbers and would otherwise file a complaint. The
company informed the complainant that they have removed all numbers and would
stop sending marketing SMS. On the question (from the UK SA complaint form) on
what else the company could do in order to resolve the complaint, the complainant
answered that the company should remove information of all customers who have not
consented to receiving marketing SMS and issue a public apology.
Findings
Firstly, we note that the complainant has used an informal way to contact the company
Postal address: (by a tweet on Twitter). It is understandable the complainant did not want to pay a fee
Box 8114 in order to object to the marketing SMS but at the same time it is also understandable
104 20 Stockholm that the company did not give a formal response through Twitter directly. Most likely,
Sweden
there were other ways to contact the company (such as email) other than SMS.
Website: Secondly, we note that when the company responded to the complainant, they
www.imy.se
apologised for the text messages and removed the complainant’s number. They also
E-mail: followed the complainant’s request and removed all numbers in order to stop sending
[email protected]
text messages. Accordingly, the issue seem to have been resolved and was probably
Telephone: due to a lack of communication in the contact through Twitter. In respect of the
+46 (8) 657 61 00
Swedish Authority Our ref.: DI-2021-7331 2(2)
for Privacy Protection Date: 2021-09-10
complainant’s requirement of a public apology, that is not something the GDPR
regulates. We would also like to inform you that direct marketing by electronic
communication is regulated by the Swedish Marketing Act (SFS 2008:486) over which
the competent supervisory authority is the Swedish Consumer Agency. The
demarcation between the Marketing Act and GDPR is yet not clear which means that
there is the possibility that we are not even competent to handle the case.
Other remarks
Direct marketing by electronic communication is regulated by the Swedish Marketing
Act (SFS 2008:486) over which the competent supervisory authority is the Swedish
Consumer Agency. The demarcation between the Marketing Act and GDPR is yet not
clear which means that there is the possibility the issue falls without the scope of our
competency.
Conclusion
The Swedish SA considers the subject matter of the complaint investigated to the
extent appropriate and that no further action is required. Accordingly, the case should
be closed.
___________________________
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protections (IMY) decision 2021-09-10, no. DI-2020-7331. Only the Swedish version of
the decision is deemed authentic.