1(7)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY) decision
2022-07-20, no. DI-2022-1687. Only the Swedish version of
the decision is deemed authentic.
Ref no:
DI-2022-1687, IMI case no. Final decision under the General Data
155158
Protection Regulation – If
Date of decision:
2022-07-20 Skadeförsäkring AB
Date of translation:
2022-07-20
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection finds that If Skadeförsäkring AB has
processed personal data in breach of:
• Article 12(3) of the General Data Protection Regulation (GDPR)1 by not,
without undue delay, handle the complainant’s request of access under Article
15 in accordance with the complainant’s request of 31 October 2018.
• Article 15 by not giving the complainant additional information on the
processing pursuant to Article 15(1) and 15(2) of the GDPR when the
complainant received a copy of a transcribed telephone call on 26 February
2019.
The Authority for Privacy Protection issues If Skadeförsäkring AB a reprimand
pursuant to Article 58(2)(b) of the GDPR for the infringement of Article 12(3) and 15 of
the GDPR.
Report on the supervisory report
The Authority for Privacy Protection (IMY) has initiated supervision regarding If
Skadeförsäkring AB (If Skadeförsäkring or the company) due to a complaint. The
complaint has been submitted to IMY, as responsible supervisory authority for the
company’s operations pursuant to Article 56 of the GDPR. The handover was made
from the supervisory authority of the country where the complainant has lodged their
complaint (Norway) in accordance with the Regulation’s provisions on cooperation in
cross-border processing.
Postal address:
Box 8114
104 20 Stockholm The investigation in the case has been carried out through correspondence. In the light
Website:
of a complaint relating to cross-border processing, IMY has used the mechanisms for
www.imy.se cooperation and consistency contained in Chapter VII GDPR. The supervisory
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Our ref: DI-2022-1687 2(7)
Date:2022-07-19
authorities concerned have been the data protection authorities in Finland and
Norway.
The complaint
The complaint states the following. On 31 October 2018, the complainant contacted
the company and requested to obtain a copy of all the documentation relating to two
leak damages in the residential property in which the complainant have their
apartment. The water damage was reported to have been caused by the complainant’s
apartment. In addition, the complainant requested access to a recorded telephone call
between the complainant itself and the company from 5 October 2018.
On 7 December 2018, the complainant received a reply from the company and only
obtained documentation relating to the damage from 2013 but not the damage from
2015.
The complainant and the company had further contact via telephone and e-mail during
December 2018 and January 2019. On 22 February 2019, the complainant contacted
the company again by telephone and made clear that they wished to have access to
documentation relating to the water leak from 2015. On 25 February, the complainant
reminded the company by e-mail of what had been agreed during the last telephone
call. On 26 February, the complainant received an e-mail from the company containing
parts of the telephone conversation in a transcribed form. However, the transcription
was full of spelling errors, which made it impossible to understand what was said. The
e-mail contained no documents relating to the water leak from 2015.
What If Skadeförsäkring has stated
If Skadeförsäkring has mainly stated the following. If Skadeförsäkring is the data
controller for the processing to which the complaint relates through its Norwegian
branch If Skadeforsikring NUF, which has organisation number 981 290 666 in the
Norwegian Business Register. If Skadeförsäkring's branches in Finland, Denmark and
Norway do not have their own national management and operations are governed by
the Nordic organisation.
On 31 October 2018 the complainant requested to get access to all documentation
relating to the complainant's apartment that was linked to the water damages. The
complainant also requested a recording of a telephone call between the complainant
and a damage adviser on 5 October 2018.
It is the condominium association in which the complainant lives, that is the
policyholder (insured) and that in 2013 and 2015 reported damages regarding water
leakage in the association. The insurance claim from 2013 contains information related
the complainant, while the 2015 insurance claim does not contain any information that
can be linked to the complainant.
The company did not perceive the complainant’s request of 31 October 2018 for
access to documentation relating to the water leak and the complainant’s apartment as
a request under Article 15 of the GDPR. The complainant submitted the request by e-
mailing the company’s Norwegian property damage department.
On 7 December 2018 the company informed the complainant that he has the right to
access only documents relating to him or her. Documents containing information which
may be linked to the complainant were enclosed in the e-mail. The complainant
received a transcript of the recorded call on 26 February 2019. The reason why it took
Privacy Protection Authority Our ref: DI-2022-1687 3(7)
Date:2022-07-19
until 26 February 2019 before the complainant received the transcription is that the
company did not perceive the complainant’s request as a request for access under
Article 15 of the GDPR and therefore did not handle it according to the company’s
privacy practices. The case was submitted on 27 November 2018 to the department
dealing with requests for access to telephone calls. One factor that further contributed
to the delay was that it was a long conversation to transcribe.
If the complainant was dissatisfied with the transcript, it was possible to visit one of the
company’s offices to listen to the recording. Nowadays, data subjects can also receive
access to recorded phone calls via a web-based solution.
In view of the way in which the complainant formulated its request, to obtain
documentation on the damages and a recorded telephone call, together with the
complainant’s choice of communication channel, the company also did not perceive
the complainant’s request as a request for access to additional information under
Article 15 of the GDPR. No such information was therefore provided. The company
also notes that the complainant, in their complaint to the Norwegian Data Protection
Authority did not mention the that absence of additional information under Article 15
constituted a deficiency in the company's handling of the complainant’s request.
Justification of the decision
Applicable provisions
To anyone who requests a data controller is obliged to provide information about
whether or not their personal data is being processed. If such data is processed, the
controller shall, in accordance with Article 15 of the General Data Protection
Regulation, provide the data subject with supplementary information and a copy of the
personal data processed by the controller. It follows from Article 15(1) and (2) what
additional information is to be provided to the data subject. Article 15(3) requires the
controller to provide the data subject with a copy of the personal data being processed.
EDPB Guidelines 01/2022 on data subjects’ rights — Right of access state:
“The obligation to provide a copy is not to be understood as an additional right of the
data subject, but as modality of providing access to the data. It strengthens the right of
access to the data and helps to interpret this right because it makes clear, that access
to the data under Art. 15(1) comprises complete information on all data and cannot be
understood as granting only a summary of the data.”2
According to recital 63, the data subject should have the right of access to personal
data processed in order to be aware that processing is taking place and verify the
lawfulness of the processing.3
“…the purpose of the right of access is to make it possible for the data subject to
understand how their personal data is being processed as well as the consequences
of such processing, and to verify the accuracy of the data processed without having to
justify their intention. In other words, the purpose of the right of access is to provide the
individual with sufficient, transparent and easily accessible information about data
processing, regardless of the technologies used, and to enable them to verify different
2 Guidelines 01/2022 on data subject rights - Right of access, para 23.
3 See Judgement of 7 May 2009, Rijkeboer, C-533/07, EU:C:2009:293, paragraph 50-54.
Privacy Protection Authority Our ref: DI-2022-1687 4(7)
Date:2022-07-19
aspects of a particular processing activity under the GDPR (e.g. lawfulness,
accuracy).4
The right of access provided for in Article 15 does not constitute a broad right of
access to all the documents in which a data subject’s personal data are present. The
purpose of the right is instead to ensure that a data subject has access to information
about the processing and a copy of the personal data processed in order to be able to
verify the accuracy of the data and whether they are processed in accordance with the
provisions of the Regulation.5
According to Article 12(3), a request for access must be handled without undue delay
and in any event no later than one month after the request has been received. The
time limit of one month may be extended by an additional two months if the request is
particularly complicated or the number of requests received is high.
If the period of one month is extended, the controller must notify the data subject of the
extension. The notification of the extension of the time limit shall take place within one
month of receipt of the request. The controller must also specify the reasons for the
delay.
Assessment of the Authority for Privacy Protection (IMY)
Did the company have an obligation to handle the complainant’s request as a request
for access under Article 15 of the GDPR?
On the basis of the complaint at hand, IMY has to decide whether the company should
have understood the complainant’s request as a request for access under Article 15 of
the GDPR and whether it in such case handled the request in accordance with the
provisions of the Regulation.
The investigation has shown that the complainant contacted the company on 31
October 2018 with two requests. First, a request for access to all the documents
relating to two damages on the complainant’s residential property and, second, a
request for access to a recorded telephone call between the complainant and an
employee of the company.
The GDPR does not regulate the form in which a request for access is to be made.
However, it is generally sufficient for a data subject to express their wish to obtain
access to personal data processed or that they wish to have access to information
about themselves held by the controller for a request to be regarded as a request for
access within the meaning of Article 15.6
As regards the complainant’s request to obtain a copy of the telephone conversation
that took place between themselves and the insurance company, IMY notes that the
company should have understood the complainant’s request for the recorded
telephone call as a request under Article 15. In particular having regard to the fact that
4 Guidelines 01/2022 on data subject rights - Right of access, adopted for public consultation 18 January 2022, para
10.
5 See the Court of Appeal Gothenburg Judgement of 2019-09-19 case no. 1677-19 and YS v. Minister voor
Immigratie, Integratie en Asiel, and Minister voor Immigratie, Integratie en Asiel v. M, S, Joined Cases C-141/12 and
C-372/12, European Union: Court of Justice of the European Union, 17 July 2014.
6 See Guidelines 01/2022 on data subject rights - Right of access, para 50.
Privacy Protection Authority Our ref: DI-2022-1687 5(7)
Date:2022-07-19
what the complainant requested access to, the recorded call, constitutes personal data
in the form of the complainant’s voice recording.
As regards the complainant’s request to obtain all the documentation relating to two
insurance cases, IMY notes that the complainant did not state in its request that they
wished to have access to personal data. The request was instead expressed as a wish
to have access to all documentation relating to the damages. In view of the fact that
the documents referred to by the complainant mostly contain information other than
personal data and that the complainant has not stated that the request relates to
access to personal data, IMY considers that it cannot be perceived as a request for
access to personal data. The company has therefore not been required to deal with
the complainant’s request for access to all documentation in the insurance case as a
request for access under Article 15.
Has the company handled the complainant’s request for access without undue delay?
Since the complainant’s request for access to the recorded telephone call above was
found to be a request for access under Article 15 of the GDPR, IMY has to consider
whether the company handled the complainant’s request and whether it was done
without undue delay.
The complainant submitted its request by e-mail to the company on 31 October 2018.
The company provided the recorded call in transcribed form on 26 February 2019,
almost four months after the complainant’s request. IF Skadeförsäkring AB has
therefore acted in breach of Article 12(3) by not dealing with the complainant’s request
for access without undue delay.
The company also states that it did not provide the complainant with additional
information pursuant to Article 15(1) and (2). IMY considers that, by failing to provide
the complainant with the information referred to in Article 15(1) and (2), the company
failed to fulfil the complainant's request for access under Article 15. By failing to
provide the additional information, IF Skadeförsäkring AB has acted in breach of
Article 15.
The company's argument that the complainant did not request additional information
on the processing under Article 15(1) and (2) does not change IMY's assessment. The
right of access shall be regarded as one coherent right which is satisfied by the
fulfilment of all elements. The company has not made sure that the complainant
wished to limit their request to only a copy of the personal data pursuant to article
15(3) and that the complainant did not wish to receive the supplementary information
to which the complainant was entitled.
The complainant states that the transcription received of the telephone call contained
many spelling errors and was therefore impossible to understand. Regarding the fact
that the company has stated that it was possible for the complainant to listen to the
recorded conversation in one of the company's offices and that it is now possible for
the complainant to access the recording via a web-based solution, IMY finds no reason
to further examine this question
Choice of corrective measure
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the
power to impose administrative fines in accordance with Article 83. Depending on the
Privacy Protection Authority Our ref: DI-2022-1687 6(7)
Date:2022-07-19
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) provides which factors are to be taken into
account when deciding on administrative fines and in determining the amount of the
fine. In the case of a minor infringement, as stated in recital 148, IMY may, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Factors to consider is
the aggravating and mitigating circumstances of the case, such as the nature, gravity
and duration of the infringement and past relevant infringements.
IMY notes the following relevant facts. The infringement only affected on data subject
and the company partially satisfied the complainant’s request for access. The
company has not previously been subject to any corrective measures for infringement
of data protection regulations.
Against this background IMY considers that it is a minor infringement within the
meaning of recital 148 and that If Skadeförsäkring AB must be given a reprimand
pursuant to Article 58(2)(b) of the GDPR.
This decision has been made by the specially appointed decision-maker
after presentation by legal advisor .
Privacy Protection Authority Our ref: DI-2022-1687 7(7)
Date:2022-07-19
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.