1(15)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision
Our ref.: 2023-12-04, no. IMY-2022-6656. Only the Swedish
IMY-2022-6656 version of the decision is deemed authentic.
Date:
2023-12-04
Decision under the General Data
Protection Regulation – Nobina
Europe AB
Content
Decision of the Privacy Protection Authority ...................................................................2
Presentation of the supervisory case ..............................................................................2
The case, process and scope of supervision ........................................... 2
Nobina’s response.................................................................................... 3
Statement of reasons for the decision ............................................................................4
Lawfulness of the processing .............................................................................. 4
Legal Regulation ...................................................................................... 4
IMY’s assessment .................................................................................... 6
Principles of data minimisation and storage limitation ...................................... 11
Information to data subjects on the retention period ......................................... 13
Choice of intervention ....................................................................................... 13
How to appeal ...............................................................................................................15
Postal address:
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected]
Telephone:
+46 (8) 657 61 00
Swedish Authority Our ref.: IMY-2022-6656 2(15)
for Privacy Protection Date: 2023-12-04
Decision of the Privacy Protection Authority
The Privacy Protection Authority finds that Nobina Europe AB processes personal data
in breach of Article 5(1)(e) of the GDPR1 by storing personal data in a form that
enables the identification of the data subjects for a longer period than is necessary for
the purposes for which the personal data is processed.
The Privacy Protection Authority gives Nobina Europe AB a reprimand pursuant to
Article 58(2)(b) of the GDPR.
On the basis of Article 58(2)(d) of the GDPR, the Privacy Protection Authority orders
Nobina Europe AB to take measures to ensure that the storage period for personal
data processed through “the Green Journey” (DGR) amounts to a maximum of three
months. The measures must be taken no later than four weeks after this Decision has
become final.
Presentation of the supervisory case
The case, procedure and scope of supervision
The Privacy Protection Authority (IMY) has initiated supervision of Nobina Europe AB
(Nobina or the company) due to information from a complaint from the Norwegian
trade union Yrkestrafikkforbundet (YTF) concerning personal data processing in the
context of Nobina’s project DGR .
The complaint has been submitted to IMY, as the lead supervisory authority under
Article 56 GDPR, by the Norwegian supervisory authority where the complaint was
lodged. The processing was carried out by exchange of letters. In view of the cross-
border complaint, IMY has used the cooperation and consistency mechanisms
provided for in Chapter VII of the GDPR. The relevant supervisory authorities have
been the data protection authorities of Norway, Spain, Denmark, Austria, Finland and
Hungary.
IMY’s supervision has aimed to investigate whether the personal data processing in
question includes data on breaches of law. Furthermore, the IMY has assessed in the
context of the case whether the personal data processing in question has legal support
in one of the legal bases of the GDPR in Article 6 and whether the processing
complies with the provisions on data and storage minimisation in Article 5. The
supervision has also covered the question of whether the company informed the data
subjects of the retention period in accordance with Article 13.
The complaint
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2022-6656 3(15)
for Privacy Protection Date: 2023-12-04
In the complaint, YTF essentially states the following. Nobina has initiated the project
“The Green Journey” (DGR) with the aim of establishing a safer, more customer-
friendly and more environmentally friendly driving behaviour. The initiative involves
monitoring employees while driving, through a device that records, among other
things, each bus driver’s speed, energy consumption and usage of brakes. The data is
sent to Nobina’s database, where it is stored centrally. The information is also
available to business managers who will monitor and talk to non-compliant bus drivers.
YTF considers the project to be too intrusive, as the aim of the project can be achieved
by using other and less restrictive methods. YTF considers that Nobina’s interest in the
processing by DGR does not weigh enough to undermine the interests of employees in
the protection of their personal data. Furthermore, YTF considers that the processing
is too extensive in relation to the purpose, contrary to the principle of data
minimisation. The bus drivers’ right of access and information may also be questioned
because they do not have information about the period during which the personal data
will be stored.
Nobina’s response
In its responses to IMY, Nobina stated, inter alia, the following on DGR.
The implementation of DGR began in 2013, after which the concept has been updated
and implemented in larger parts of the Nobina Group. A relaunch of DGR took place in
2017, after which a regular review of the processing of data took place in 2020, 2021
and 2022. DGR collects data on fuel consumption, use of brakes, idling and driving
distances. The data is compiled to obtain a value that is then measured against
Nobina’s thresholds. This is the basis for the share of “green” environmental driving.
Through DGR, the company does not process data on infringements of the law either
by measuring or monitoring speed. A so-called crossing indicator lights up when the
bus’s speed exceeds 90 kilometres per hour. However, this is only a measurement of
the fuel consumption of the bus, and does not mean that the speed is recorded in
relation to the current speed limits. It may be mentioned that Nobina Sverige AB has
made an application to IMY for a permit to process data relating to criminal convictions
and offences (case no DI-2022-253).
The purpose of the data processing in DGR is to increase the proportion of
environmental driving in order to achieve Nobina’s environmental goals. The
processing of data is done to, among other things, reduce emissions from fuels and
use energy resources efficiently and thus work towards a more environmentally
sustainable society. Climate change and lack of natural resources are a major problem
in the world and therefore environment and sustainability are one of the most important
issues right now. Nobina strives to contribute to a sustainable society by transporting
passengers as environmentally as possible. The company also has environmental
requirements to comply within contractual contexts. One example is the agreement
between Nobina and Region Stockholm (SL). In addition, Nobina, as a public transport
company with high environmental objectives, has a self-interest in being an
environmentally sustainable company. With increased fuel costs and electricity prices,
Swedish Authority Our ref.: IMY-2022-6656 4(15)
for Privacy Protection Date: 2023-12-04
there is also an economic aspect to consider as reduced energy consumption leads to
reduced costs.
Measuring the driver’s driving behaviour through DGR is one of the most effective
factors in reducing energy consumption and increasing comfort for drivers and
travellers. Dgr needs to be measured at the individual level because it is not effective,
long-term and durable to follow up and change behaviors at the group level. Data from
DGR is only used to develop drivers towards a more environmentally friendly driving
mode, through conversations and training, and not to in any way provide retaliation if
results deviate from the set limit values.
Under the sections Lawfulness of the processing, The principles of data minimisation
and storage limitation and Information to the data subjects about the retention period,
there are further descriptions of what the company has stated in relation to the
respective substantive issues.
Miscellaneous
Nobina Sverige AB has been granted a permit (case no. DI-2022-253) with the
conditions of the IMY to process personal data relating to criminal convictions and
offences in the context of the processing of data on measurement of speed as
described in that case.
Statement of reasons for the decision
Is personal data relating to criminal convictions and offences
being processed?
YTF’s complaint submits that Nobina records, inter alia, data on the speed of the
drivers. In regards to those circumstances, IMY inquired whether Nobina processes
data relating to criminal convictions and offences pursuant to Article 10 of the GDPR.
Nobina has replied that the company does not process such data. The speed indicator
that lights up when the bus’s speed exceeds 90 kilometres per hour only measures the
bus’s fuel consumption and does not mean that data on the speed is recorded in
relation to the applicable speed limits.
IMY’s assessment
IMY does not question Nobina’s claim that the company does not process data on
speeding offences within DGR.
Lawfulness of the processing
Legal Basis
In order for Nobina’s personal data processing through DGR to be permitted,
Swedish Authority Our ref.: IMY-2022-6656 5(15)
for Privacy Protection Date: 2023-12-04
compliance with the provisions of the General Data Protection Regulation is required.
This means, among other things, that Nobina must have a legal basis for the
processing. Nobina has stated that processing of personal data is necessary for the
purposes of the company’s legitimate interests pursuant to Article 6(1)(f) of the GDPR.
Article 6(1)(f) GDPR states that the processing of personal data is lawful if it is
necessary for the purposes of the legitimate interests of the controller or of a third
party, unless the interests or fundamental rights and freedoms of the data subject
outweigh the processing of personal data.
That provision thus lays down three cumulative conditions which must be met in order
for the processing of personal data to be permitted.2
The first condition is that the interests which the processing intends to protect must
constitute the legitimate interests of the controller or a third party. A legitimate interest
is an interest which, in general, enjoys the protection of the legal order or is otherwise
regarded as legitimate, ethical or justifiable. For example, an interest protected by EU
legislation or relevant national legislation must be regarded as justified.3 A legitimate
interest must be sufficiently clear to be balanced against the interests and fundamental
rights of the data subject. The interest at stake must also be an interest that the
controller wants to achieve. This implies a requirement of genuine and actual interest,
which corresponds to the current business or the benefits expected shortly. The
interest must not be too vague or speculative.4 If a controller acts not only in his own
legitimate interest (e.g. their business interest), but also in the interests of society as a
whole, this interest generally outweighs that interest.5
The second condition is that the processing is necessary for a purpose relating to the
legitimate interest. This means that the legitimate interest cannot reasonably be
protected as effectively by other means which less prejudice the fundamental rights
and freedoms of data subjects, in particular the right to privacy and the right to the
protection of personal data as enshrined in Articles 7 and 8 of the Charter of
Fundamental Rights of the European Union (EU Charter of Rights).6 At the same time,
it follows from the case-law that the criterion of necessity can be regarded as satisfied
if it contributes to efficiency.7 It also follows from the case-law that the necessity
requirement must be examined in conjunction with the principle of data minimisation
laid down in Article 5(1)(c) of the GDPR, which provides that the personal data
collected must be adequate, relevant and not excessive in relation to the purposes for
which they are processed.8
2
see judgment of the Court of Justice of the European Union, M.I.C.M., C-597/19, EU:C:2021:492, paragraph 106.
3
See Öman, General Data Protection Regulation (GDPR) etc. (JUNO ed. 2A), the comment on Article 6(1)(f), under
the heading ‘Eligible interests’.
4
Opinion 6/2014 of the European Data Protection Board (EDPB) on the concept of the controller’s legitimate interests
in Article 7 of Directive 95/46/EC, WP 217, adopted on 9 April 2014, p. 25.
5
EDPB Opinion 6/2014, p. 37.
6
Judgment of the Court of Justice of the European Union in Case C-708/18 TK, paragraph 47.
7
Judgment of the Court of Justice of the European Union in Case C-524/06 Huber, paragraph 62.
8
Judgment of the Court of Justice of the European Union in Case C-708/18 TK, paragraph 48.
Swedish Authority Our ref.: IMY-2022-6656 6(15)
for Privacy Protection Date: 2023-12-04
The third premise is that the fundamental rights and freedoms of data subjects (the
interest of privacy) do not outweigh the legitimate interest the processing intends to
protect.
First, in order to carry out the balancing assessment, it is important to determine the
nature and source of the legitimate interest and whether the processing is necessary
to satisfy that interest and, on the other hand, the consequences of the processing for
data subjects. This initial assessment should consider the measures, such as
increased transparency or limited data collection, that the controller intends to adopt.9
Furthermore, the position of the controller and the data subject shall be considered,
including the balance of power between the data subject and the controller.10 Other
important factors to consider are the nature of the data and the additional safeguards
taken by the controller. These may include technical and organisational measures to
ensure that data cannot be used to make decisions or take other measures relating to
individuals (“function separation”), extensive use of de-identification methods,
aggregation of data, privacy by design and increased transparency.11
In addition, account must be taken of the nature and specific nature of the processing
of personal data, taking into account, in particular, the number of persons who have
access to the personal data and the forms of access thereto.12 The balance between
the privacy interest and the legitimate interest of the controller shall also take into
account the reasonable expectations of the data subject at the time and in connection
with the processing of its personal data.13
Individuals have a fundamental right to the protection of personal data relating to them.
This follows, inter alia, from Article 8(1) of the EU Charter of Rights. Restrictions,
taking into account the principle of proportionality, may only be imposed if they are
necessary and genuinely meet objectives of general interest recognised by the Union
or the need to protect the rights and freedoms of others (Article 52(1) of the EU
Charter of Rights).
IMY’s assessment
Does Nobina have a legitimate interest in reducing emissions from fuels and using
energy resources efficiently?
Nobina has stated that the purpose of the processing of personal data through DGR is
to increase the share of environmental driving. This is to achieve the company’s
environmental objectives to reduce emissions from fuel and use energy resources
efficiently and thus work towards a more environmentally sustainable society. IMY
9
EDPB Opinion 6/2014, p. 53.
10
See also the Opinion of the European Data Protection Board (EDPB) e2/2017 on the processing of personal data in
the workplace, WP 249, adopted on 8 June 2017, p. 23.
11
EDPB Opinion 6/2014, p. 54.
12
Judgment of the Court of Justice of the European Union in Case C-708/18 TK, paragraph 57.
13
Recital 47 of the GDPR and CJEU judgment in Case C-708/18 TK, para. 58.
Swedish Authority Our ref.: IMY-2022-6656 7(15)
for Privacy Protection Date: 2023-12-04
considers that environmental work and sustainability is a legitimate interest provided
that it is an actual interest and not an interest that is fictitious or speculative.
Nobina has explained, among other things, the following. Climate change and lack of
naturalresources are a major problem in the world and therefore environment and
sustainability are one of the most important issues right now. Nobina strives to
contribute to a sustainable society by moving residents as environmentally as possible.
The company also has environmental requirements to comply with in contractual
contexts. One example is the agreement between Nobina and Region Stockholm (SL).
In addition, Nobina, as a public transport company with high environmental objectives,
has a self-interest in being an environmentally sustainable company. With increased
fuel costs and electricity prices, there is also an economic aspect to consider as
reduced energy consumption leads to reduced costs.
Against this background, IMY considers that Nobina has an actual legitimate interest in
reducing emissions from fuels and using energy resources efficiently.
Is the processing necessary?
The question then is whether Nobina’s processing of personal data through DGR is
necessary to achieve the company’s environmental objectives of reducing emissions
from fuels and using energy resources efficiently. Nobina has presented alternative
and less intrusive measures that the company has considered, including training and
processing of data at group level.
Nobina submits, inter alia, the following. Economical, sustainable and environmental
driving is today fundamental in driving licence training and a module within the CPCs
required to carry out passenger transport. Dgr needs to be measured and saved at the
individual level and followed up by the driver’s closest manager because it is not
effective, long-term and durable to change behaviour if only the driver sees his
information or if data is saved at group level. Without the immediate manager gaining
insight into how environmentally a driver drives, there is no way to follow up and
influence the proportion of environmental driving by encouraging training. Using group
level alone does not provide good visibility as driver groups can be as large as more
than 100 people. Since its inception, Nobina’s work with DGR has resulted in a
measurable reduction of 85 734 tonnes of CO2 equivalent or equivalent to the annual
emissions of 30 000 cars. Nobina has always had environmental work, but such clear
improvements have not been achieved until the methodology of training, coaching and
measurement that DGR entails was introduced.
To use DGR only as a time-limited project, Nobina is not able to achieve the objective
of effectively, long-term and lastingly reducing the company’s impact on the
environment. There is also no basis for following the NobinaGroup’s environmental
performance as a whole and during the same periods. Carrying out the processing of
data within DGR on a voluntary basis has not been considered to be sufficiently
effective as those likely to consent are not the ones most in need of encouragement to
increase their share of environmental driving. Nobina further believes that it is
Swedish Authority Our ref.: IMY-2022-6656 8(15)
for Privacy Protection Date: 2023-12-04
important that DGR is applied to the entire company. It is also difficult to use consent
as a basis for processing because it can be seen as non-real consent due to the
uneven balance of power between employer andemployee.
IMY considers that the investigation in the case provides support that the purpose of
the processing of the data cannot reasonably be achieved in an equally effective
manner through alternative measures. Furthermore, as IMY notes below on the
principle of data minimisation, the processing is limited to personal data that are
adequate, relevant and not too extensive in relation to the purpose of the processing.
Against this background, IMY assesses that the processing of personal data through
DGR is necessary for the purposes of legitimate interests in reducing emissions from
fuels and using energy resources efficiently.
Balancing of interests
The IMY will then examine whether the data subject’s fundamental rights and
freedoms (the privacy interest) outweigh Nobina’s legitimate interest in achieving
environmental objectives by reducing emissions of fuels. Thus, IMY goes on to assess
the factors which, according to the Court of Justice of the European Union, affect the
gravity of the infringement and, on the other hand, the legitimate interest which the
processing is intended to protect.
IMY notes that the purpose of the processing of the data is to ensure that drivers
increase their share of environmental driving. The information about drivers’ driving
patterns is stored and can be read by the driver’s closest manager, who will also
review the information from DGR during regular follow-up conversations with drivers.
Although Nobina states that the information provided by DGR is not used in any way to
provide retaliation if results deviate from the set limit values, IMY notes that the regular
follow-up of drivers’ journeys may nevertheless lead to concerns among drivers about
possible consequences. This is due to the general imbalance between workers and
employers. Theprocessing of personal data by DGR can thus constitute a significant
infringement of the driver’s privacy. The processing of the data can lead to stress,
concerns about possible negative consequences and a feeling of being under
supervision during working hours. The complaint from YTF shows, among other things,
that the drivers experience DGR as distracting and stressful, and that they are
concerned that the information may be misused and lead to negative consequences
for them. Those factors suggest that the interest in the protection of the personal data
of individual drivers weighs heavily in the balancing of interests to be carried out.
However, IMY notes that Nobina has stated that, since the introduction of DGR, it has
reduced emissions by equivalent to the annual emissions of 30 000 cars. Furthermore,
Nobina has described that the company has contractual obligations to achieve certain
specific environmental objectives. IMY further notes that environmental and
sustainability issues are interests that benefit society at large14. Against this
14
CF. EDPB Opinion 6/2014, p. 25 and p. 37.
Swedish Authority Our ref.: IMY-2022-6656 9(15)
for Privacy Protection Date: 2023-12-04
background, IMY considers that Nobina’s legitimate interest in reducing emissions
from fuels and using energy resources effectively weighs heavily.
IMY has concluded that Nobina has a legitimate interest in achieving environmental
objectives by reducing emissions from fuel. However, the fact that the personal data
processed by Nobina in the context of that purpose constitute a marked interference
with the privacy of the individual drivers, together with the fact that there is an unequal
relationship between the employed drivers and the employer, weighs heavily in the
second balance.
In its observations, Nobina has provided a detailed description of how the company
handles personal data within the framework of DGR. The company has, among other
things, described the following.
DGR data is only loaded for the purpose of “green driving”. Data published by DGR
can thus only be used to monitor green driving. For example, DGR does not contain
data that can be used to check whether employees fulfil their employment contract.
The information provided by DGR does not contain any information on possible
infringements. The information does not contain data that can be used to see if the
employee has driven where they should or if they arrive on time, nor does it contain
any data on for instance customer care or mobile phone use.
Access to DGR information at driver level is strictly regulated. This means that only the
closest manager, instructor and senior manager (usually a HR manager) for each area
of activity can see to what extent the individual driver is driving environmentally
friendly. There is no other information that can be used to check whether drivers have
fulfilled their obligations or not. It is possible to see which bus the driver has driven and
at what time. However, it is not possible to see where the bus has gone or any other
information on the driving, except if the driving style is red, yellow or green within the
specified time interval, with the color coding only being linked to the proportion of
environmental driving.
Nobina Norway also has a specific agreement on the use of DGR, which shows that
DGR data may not be used in any context in connection with a termination. The
purpose of DGR is to improve driving behaviour and not to use it in connection with
personnel issues.
All managers receive introduction and training on DGR when they start at Nobina.
Managers receive information on the purpose of DGR, how DGR may be used and on
divisions of responsibilities.
Only managers who need to use the personal data to follow up and evaluate the
environmental driving programme have access to the information. Access is limited
through a role-based authorisation system, as well as established processes for
assigning and deleting user permissions, to ensure that only authorised persons have
access to the personal data. Since the authorisation assignment is based on Nobina’s
Swedish Authority Our ref.: IMY-2022-6656 10(15)
for Privacy Protection Date: 2023-12-04
personnel register, the assignment is removed when a staff member with authorisation
leaves Nobina or changes his post.
The collected personal data is encrypted to protect it against unauthorised access and
when transferring from the respective bus to Nobina’s IT environment. Pseudo-
anonymisation is used as an additional protection as far as possible during processing
(through employment number) and the direct link to an employee only occurs when
results on the share of green driving are shared with the respective employee and
team manager. All access and use of personal data is logged to enable monitoring and
detection of unauthorised access, and the technical and organisational security-
measures are regularly updated. If unauthorised use is detected, steps are taken to
correct it and prevent it from being repeated.
IMY believes that it is clear from Nobina’s descriptions how personal data is processed
within the framework of DGR. Among other things, Nobina states which persons are
authorised to access the personal data in question, including their roles within the
organisation. It appears that the data is not shared to more than is necessary for the
purpose. Furthermore, it is clear from the investigation that essentially only the driver
can monitor how his or her driving mode affects the proportion of environmental driving
in real time. It is only during a driver’s training in environmental driving, when a so-
called “environmental instructor” accompanies the driver on the bus, that someone
else can follow the driver’s driving during the journey. This is only possible when the
instructor is physically next to the driver.
IMY also finds that it is clear from Nobina’s descriptions that it has taken both
organisational and technical measures to ensure that the personal data processed by
DGR is not used for purposes other than evaluating the proportion of environmentally
friendly driving, within the framework of its objective of reducing emissions of fuel.
IMY further finds that drivers can reasonably expect in regards of their training and
employment contracts that their personal data will necessarily be processed by Nobina
for the purpose of increasing the share of environmentally friendly driving. The
limitation of drivers’ right to the protection of their personal data appears proportionate
and responds to a recognised public interest in reducing emissions that are hazardous
to the environment (compare with Article 52(1) of the Charter of EU Fundamental
Rights).
Overall, IMY considers that Nobina’s legitimate interest in reducing emissions and
energy consumption outweighs the interests of the individual drivers interest of
protection of their personal data. Therefore Nobina is lawfully processing the personal
data in order to reduce emissions.
The question is therefore whether Nobina also otherwise processes the personal data
in accordance with the provisions of the General Data Protection Regulation.
Swedish Authority Our ref.: IMY-2022-6656 11(15)
for Privacy Protection Date: 2023-12-04
Data minimisation and storage minimisation principles
Principle of data minimisation
The principle of data minimisation is set out in Article 5(1)(c) of the GDPR. It states
that personal data shall be adequate, relevant and not excessive in relation to the
purposes for which they are processed.
The documents in the file show, in essence, the following: During a drive, Nobina
collects data on fuel consumption, use of brakes, idle running, speed over 90
kilometres per hour and the distance driven. The data is compiled to obtain a value
that is then measured against the thresholds set by Nobina. These values form the
basis for the share of “green” environmentally friendly driving. The information on the
share of “green” driving data is then linked to the employee and is presented together
with name, employment ID, place of employment and driver’s group membership.
IMY’s assessment
In an overall assessment of the findings of the case, IMY considers that the personal
data that Nobina processes within the framework of DGR is adequate, relevant and not
too extensive in relation to the purpose of increasing the proportion of environmentally
friendly driving. Nobina has justified why data on fuel consumption, brake use, idle
running, speed over 90 kilometres per hour and distance driven are relevant to the
purpose as these factors affect the amount of fuel consumed. Furthermore, the
information on employees linked to the driving mode is justified and not too extensive
in relation to Nobina’s purpose.
The principle of storage minimisation
The principle of data minimisation is closely linked to the principle of dataminimisation,
as set out in Article 5(1)(e) of the GDPR. It states that personal data may not be kept
in a form that allows the data subject to be identified for a longer period than is
necessary for the purposes for which the personal data are processed. Personal data
may be stored for longer periods to the extent that thedata are processed solely for
archiving purposes in the public interest, scientific or historical research purposes or
statistical purposes in accordance with Article 89(1), provided that the appropriate
technical and organisational measures required by this Regulation are implemented to
safeguard the rights and freedoms of the data subject.
The personal data collected through DGR is stored for 13 months.
In that regard, Nobina submits, in essence, as follows. Storage is motivated by being
able to see positive and negative trends over a year and to compare with the same
time in the previous year to see a possible seasonalbehaviour as driving differs
between seasons. Storage time of 13 months is the least intrusive method that still
meets a purpose that balances the yearly variations in weather impact, the annual
employee evaluations and the need for continuity for long-lasting behavioral changes.
Swedish Authority Our ref.: IMY-2022-6656 12(15)
for Privacy Protection Date: 2023-12-04
The main purpose of DGR is to achieve a long-term and continuous improvement
within sustainability. It is necessary to follow a driving pattern over time to bring about
real improvements through behavioral change that leads to continuous upward trends.
It is not possible to obtain the same effects from the sustainability work without
maintaining a continuous individual development of the drivers. There are clear
examples of how the driving trends are affected by a lack of follow-ups with a good
comparative basis. In its measurements Nobina sees that this primarily happens by the
deterioration of the driving performance over time if the initial contribution is not
continuously worked on on the basis of individually measurable trends.
IMY’s assessment
IMY makes the following assessment as to whether the retention for 13 months of the
personal data in question complies with the principle of storage minimisation.
The purpose of the personal data processing is to ensure that drivers increase their
share of environmental driving. For that purpose, information about drivers’ driving
patterns needs to be measured and saved at the individual level, as a basis for regular
follow-up conversations with drivers in order for drivers to adjust their driving behaviour
towards a more environmental driving. It is clear from the file that the follow-up with the
driversbased on their collected data is ongoing; through conversations and training
with the drivers. This allows driving patterns to be continuously evaluated. In the light
of the investigation in the case, IMY therefore considers that a retention period of the
employees’ data for as long as 13 months is not necessary to achieve the purpose of
the processing. According to IMY, it can only be considered justified to keep the data
in question in a form which allows the data subject to be identified for a maximum
period of three months.
Nobina has further described a need for a storage period for 13 months in order to see
positive and negative trends in driving patterns over a year and to compare with the
same time in the previous year to see possible seasonal behaviour because driving
differs between seasons, and to follow the Nobina Group’s environmental driving as a
whole over time. IMY notes that it is possible to save data on driving patterns that
cannot be directly or indirectly linked to a natural person for a long period of time to
follow patterns in driving modes based on different seasons, and to follow the Group’s
driving behaviour during different periods. Therefore, IMY does not see a need to save
data at the individual level for a long period of time. Thus, according to IMY’s
assessment, Nobina’s purpose with regard to the processing in question can be
achieved equally effectively by less intrusive means, that is to say, by a shorter
retention period of personal data.
In an overall assessment, IMY therefore considers that, through DGR, Nobina retains
personal data for a longer period than is necessary for the purposes for which the
personal data are processed.
IMY therefore notes that Nobina’s processing of personal data in this regards is
contrary to Article 5(1)(e) of the GDPR.
Swedish Authority Our ref.: IMY-2022-6656 13(15)
for Privacy Protection Date: 2023-12-04
Information to data subjects on the retention period
In its complaint, YTF also claims that Nobina did not inform data subjects of the period
of storage of their personal data in the context of DGR.
Have the data subjects been informed of the retention period?
Article 13 of the GDPR requires that the data subject shall be provided with certain
information when the personal data is collected from the data subject, such as
information on the period for which the data will be stored (Article 13(2)a).
Nobina has stated that the data subjects have received information about the retention
period when they received information about Nobina’s privacy policy at the time of their
respective employment. According to the company the policy is updated on an ongoing
basis and is available to the data subjects throughout the period of employment. The
Privacy Policy, from which Nobina’s opinions to IMY included clipboards, includes
information about the storage time of DGR data.
Nobina has stated that when the company hires new staff, information meetings about
DGR for future drivers take place. Training for new drivers includes information that
Nobina monitors the share of environmental driving, how DGR works and how the
driver sees his/her own information linked to DGR. In connection with the employment,
the employee receives employment contracts and information about Nobina’s
processing of personal data. This information is available throughout the period of
employment. Furthermore, Nobina informs how the company works with follow-ups
between the employee and their immediate manager and that they will have feedback
conversations about DGR. All drivers have access to Nobina’s driver manual, which
includes information on DGR.
IMY’s assessment
In the light of the investigation in the case, IMY finds no reason to question Nobina’s
claims that the data subjects have been informed about the retention period in
accordance with the provisions of the GDPR. Therefore IMY finds that it has not been
established that the company has breached Article 13 of GDPR.
Choice of intervention
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the
power to impose administrative fines pursuant to Article 83. Depending on the
circumstances of the case, administrative fines shall beimposed in addition to or in
place of the other measures referred to in Article 83(2), such as injunctions and
prohibitions. In addition, it is clear from Article 83(2) which factors must be taken into
account when imposing administrative fines and in determining the amount of the fine.
In the case of a minor infringement, the IMY may, as stated in recital 148, instead of
imposing a pecuniary penalty, issue a reprimand under Article 58(2)(b). Account must
Swedish Authority Our ref.: IMY-2022-6656 14(15)
for Privacy Protection Date: 2023-12-04
be taken of aggravating and mitigating circumstances of the case, such as the nature,
gravity and duration of the infringement and previous relevant infringements.
IMY has found that Nobina has infringed Article 5(1)(e) of the GDPR by storing
personal data of drivers in a form that allows the identification of data subjects for a
longer period than is necessary for the purposes for which the personal data are
processed. An infringement of that provision may give rise to a fine.
IMY notes the following relevant circumstances. The processing of data concerned
workers who are in a position of dependence because of the general imbalance
between workers and employers. In addition, the processing of data has involved a
large number of employees and has been going on for several years. There has also
been a relatively large amount of personal data linked to the driving behaviour of
employees. However, IMY takes into account that the company has taken into account
appropriate technical and organisational measures regarding e.g. authorisation
management and logging. Nobina has also reviewed the storage period earlier,
reducing it from two years to 13 months, which indicates that the company has had
procedures for evaluating and following up on the processing of itsdata.
In an overall assessment of the facts, in particular in view of the difficult balance
between the fundamental rights and freedoms at issue, IMY considers that there is
such a minor infringement within the meaning of recital 148 that it is necessary to
refrain from imposing a fine on Nobina for the infringements found.
Therefore, on the basis of Article 58(2)(b) ofthe GDPR, Nobina should instead be
reprimanded for the breach found.
According to IMY, it is important that Nobina takes steps to ensure that the personal
data processed through DGR is not stored for longer than three months. It is therefore
necessary, on the basis of Article 58(2)(d) of the GDPR, to order Nobina to take
measures to ensure that the retention period is up to a maximum of three months. The
measures must be taken no later than four weeks after this Decision has become final.
This decision was taken by Head of Unit following a presentation
by legal counsel .
Copy to
Data Protection Officer, Nobina Europe AB
Swedish Authority Our ref.: IMY-2022-6656 15(15)
for Privacy Protection Date: 2023-12-04
How to appeal
If you want to appeal the decision, write to the Privacy Protection Authority. Please
indicate in the letter the decision you are appealing and the amendment you are
requesting. The appeal must have been received by the Swedish Integrity Protection
Authority no later than three weeks from the date on which you received the decision.
If the appeal has been received in due time, the Swedish Integrity Protection Authority
will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Privacy Protection Authority if it does not contain any
privacy-sensitive personal data or information that may be covered by confidentiality.
The authority’s contact details are shown in the first page of the decision.