1(3)
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
(IMY) decision 2022-05-25, no. DI-2021-313. Only
the Swedish version of the decision is deemed
authentic.
Registration number:
Decision under the General Data
DI-2022-313, IMI. Case no.
366312, FD no.402830
Protection Regulation– Tappa
Date of draft decision:
Service AB
2022-05-25
Decision of the Swedish Authority for Privacy
Protection (IMY)
The case is dismissed from further procedure.
Report on the supervisory report
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Tappa Service AB (the company) due to a complaint. The complaint has been
submitted to IMY, as responsible supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation (GDPR) 1 from the
supervisory authority in the Ireland where the complainant has lodged their complaint
in accordance with the Regulation’s provisions on cooperation in cross-border
processing.
In the complaint, the company claims that Tappa Service AB’s website organises
virtual step and activity competitions for companies. On this website, the complainant
registered his name and place of work, as well as the number of steps taken by the
complainant. The complainant states that the website does not advocate that the
complainant should use an alias or informed about the processing of personal data on
the website, which is why the complainant’s name, workplace, number of colleagues
and number of steps taken were published on www.tappa.de.
The company has mainly stated the following. Tappa Service AB as stated that they
are not the data controller for the personal data processing described in the complaint.
It is Personalentwicklungsgesellschaft GmbH is the data controller and Tappa Service
Postadress: AB is the data processor for this processing.
Box 8114
104 20 Stockholm
The investigation in the case has been carried out through correspondence. In the light
Webbplats: of a complaint relating to cross-border processing, IMY has used the mechanisms for
www.imy.se
cooperation and consistency contained in Chapter VII GDPR. The supervisory
E-post:
[email protected]
1 Regula ion (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: DI-2022-313 2(3)
Datum: 2022-04-14
authorities concerned have been the data protection authorities in in Germany, Norway
and Denmark.
Justification of the decision
Applicable provisions, etc.
Pursuant to Article 4.7 of the GDPR, ‘controller’ means the natural or legal person,
public authority, agency or other body which, alone or jointly with others, determines
the purposes and means of the processing of personal data; where the purposes and
means of such processing are determined by Union or Member State law.
Assessment of the Swedish Authority for Privacy Protection
(IMY)
Tappa Service AB as stated that they are not the data controller for the personal data
processing described in the complaint. There has not been any reason to call into
question the company’s information.
Against this background, the case is dismissed from further procedure.
This decision has been approved by the specially appointed decision-maker
after presentation by legal advisor
Integritetsskyddsmyndigheten Diarienummer: DI-2022-313 3(3)
Datum: 2022-04-14
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.