Privacy protection 1(3)
B/Br B/• Authority
Resursforum Sverige AB
Registration
number:
Decisions following supervision under the
IMY-2023-8429 General Data Protection Regulation –
Date: 2023-10-
31 Resursforum Sverige AB
Decision of the Privacy Protection Authority
The Privacy Protection Authority (IMY) notes that, on 15 July 2022, Resursforum Sverige AB
(556706-7607) has processed personal data in breach of Article 12(4) of the GDPR1 by not
informing the complainant of the reason why Resursforum Sverige AB rejected the complainant’s
request for rectification pursuant to Article 16 of the GDPR and by not providing the complainant
with information about its ability to lodge a complaint with the responsible supervisory authority for
judicial review of the refusal.
IMY gives Resursforum Sverige AB a reprimand pursuant to Article 58(2)(b) GDPR for breach of
Article 12(4) GDPR.
Presentation of the supervisory case
IMY has initiated supervision against Resursforum Sverige AB in response to a complaint.
The complaint shows, in essence, the following: The complainant requested rectification of his
personal data on 21 June 2022. On 15 July 2022, Resursforum Sverige AB rejected the
complainant’s request without justification. In connection with the refusal, Resursforum Sverige AB
has not provided information to the complainant about the possibility of filing a complaint with the
lead supervisory authority for judicial review of the refusal.
In its opinion on 27 June 2023, Resursforum Sverige AB stated the following.
Resursforum Sverige AB has not informed the complainant of the reasons for the refusal and of the
right to lodge a complaint with the lead supervisory authority for judicial review of the refusal.
Resursforum Sverige AB has taken steps for new routines regarding the handling of similar cases
and wrote a non-conformity report.
The complaint has been submitted to IMY, as the lead supervisory authority under Article 56 GDPR,
Postal address: by the supervisory authority in Denmark where the complaint was lodged. In view of the cross-
Box 8114 border complaint, IMY has made use of the mechanisms for cooperation and consistency in:
104 20 Stockholm
Website: Regulation (EU) 2016/679 of the EuropeanParliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
www.imy.se the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection
E-mail: Regulation).
[email protected]
Telephone:
08-657 61 00
Privacy Protection Authority
Registration number: IMY-2023-8429 2(3)
Date: 2023-10-31
chapter VII of the GDPR. The supervisory authority concerned has been the data
protection authority in Denmark.
Statement of reasons for the decision
Legal Regulation
If the controller fails to act upon the data subject’s request, the controller shall inform
the data subject without delay and no later than one month after receiving the request
of the reason for the non-action and of the possibility to lodge a complaint with a
supervisory authority and to seek judicial redress pursuant to Article 12(4) GDPR.
The Privacy Protection Authority’s assessment
Has there been a breach of the GDPR?
Resursforum Sverige AB states that it has not informed the complainant of the reasons
for rejecting the complainant’s request for rectification and of the possibility of lodging a
complaint with the lead supervisory authority for judicial review of the refusal. IMY
considers that Resursforum Sverige AB has thereby processed personal data in
breach of Article 12(4) of the GDPR.
Choice of intervention
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the power
to impose administrative fines pursuant to Article 83. Depending on the circumstances
of the case, administrative fines shall be imposed in addition to or in place of the other
measures referred to in Article 58(2), such as injunctions and prohibitions. In addition, it
is clear from Article 83(2) which factors must be taken into account when imposing
administrative fines and in determining the amount of the fine. In the case of a minor
infringement, the IMY may, as stated in recital 148, instead of imposing a pecuniary
penalty, issue a reprimand under Article 58(2)(b). Account must be taken of
aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement and previous relevant infringements.
IMY notes the following relevant circumstances. The violations have occurred to a
registered person. Resursforum Sverige AB has stated that it has taken measures for
new procedures for handling similar cases. Resursforum Sverige AB has not previously
received any corrective action for breach of the General Data Protection Regulation. In
those circumstances, IMY considers that there are such minor infringements within the
meaning of recital 148 and that it is therefore appropriate to refrain from imposing a
fine on Resursforum Sverige AB for the infringements found. IMY gives Resursforum
Sverige AB a reprimand pursuant to Article 58(2)(b) GDPR for breach of Article 12(4)
GDPR.
This decision was taken by Head of Unit following a presentation by
the lawyer .
, 2023-10-31 (This is an electronic signature)
Privacy Protection Authority Registration number: IMY-2023-8429 3(3)
Date: 2023-10-31
How to appeal
If you want to appeal the decision, write to the Privacy Protection Authority. Please
indicate in the letter the decision you are appealing and the amendment you are
requesting. The appeal must have been received by the Swedish Integrity Protection
Authority no later than three weeks from the date on which you received the decision. If
the appeal has been received in due time, the Swedish Integrity Protection Authority
will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Privacy Protection Authority if it does not contain any
privacy-sensitive personal data or information that may be covered by confidentiality.
The authority’s contact details are shown in the first page of the decision.