**IMY** Integritetsskydds myndigheten
1(28)
Notice: This document is an unofficial translation of the Swedish Authority for Privacy Protection's draft decision in case with national reference number, DI-2019-11737. Only the Swedish version of the decision is deemed authentic
**Registration number:**
DI-2019-11737
**Date:**
2023-06-26
# Decision under the General Data Protection Regulation –Bonnier News AB
## Content
1. Decision of the Authority for Privacy Protection...3
2. Presentation of the supervisory case...3
2.1 Description of the group common processing of personal data...4
2.1.1 Description of the processing of personal data contained in the behavioural database...5
2.1.2 Description of the processing of personal data stored in KDB...6
3. Statement of reasons for the decision ...8
3.1 IMY's competence ...8
3.1.1 Circumstances at issue ...8
3.1.2 Applicable provisions, etc...8
3.1.3 IMY assessment...9
3.2 Bonnier News AB's responsibility for the data processing...9
3.2.1 Circumstances at issue and Bonnier News AB's position...9
3.2.2 Applicable provisions, etc...9
3.2.3 IMY assessment...10
3.3 What constitutes personal data?...10
3.3.1 Circumstances at issue and Bonnier News AB's position...10
3.3.2 Applicable legal provisions other legal sources ...11
3.3.3 IMY's position...12
3.4 The processing constitutes profiling...13
3.4.1 Applicable provisions ...13
3.4.2 IMY's position...13
3.5 Legal basis for processing for the purpose of displaying personalised advertisements based on data in the behavioral database...13
3.5.1 Circumstances at issue and Bonnier News AB's position...13
**Postal address:**
Box 8114
104 20 Stockholm
**Website:**
www.imy.se
**E-mail:**
[email protected]
**Telephone:**
08-657 61 00
2
3.5.2 Applicable provisions, etc...15
3.5.3 Basic principles for IMY's assessment...17
3.5.4 Legitimate interest...19
3.5.5 Is the processing necessary for the legitimate interest? ...19
3.5.6 Balancing test test for the processing of personal data in
supplemented behavioural profiles ...19
3.5.7 Balance of interests for the processing of personal data in simple
behavioural profiles...21
3.6 Legal basis for processing for the purpose of making contact information
available for telemarketing and postal direct marketing...22
3.6.1 Applicable provisions, etc...22
3.6.2 Circumstances at issue and Bonnier News AB's position...22
3.6.3 IMY's assessment...24
3.6.4 Legitimate interest...24
3.6.5 Is the processing necessary for the legitimate interest? ...24
3.6.6 Balance of interests for the processing of personal data in
supplementary customer database profiles ...24
3.6.7 Balance of interests for personal data not linked to the behavioural
database ...25
3.7 Choice of corrective measure ...26
3.7.1 Applicable provisions etc...26
3.7.2 Same or interconnected data processing operations...26
3.7.3 Administrative fine...27
## 1. Decision of the Authority for Privacy Protection
The Swedish Authority for Privacy Protection notes that Bonnier News AB during the period from 7 November 2019 to 11 June 2020 has processed personal data without having a lawful basis pursuant to Article 6(1) of the GDPR¹ by:
a) processing personal data for the purpose of profiling the data subjects based on their behavioural data in so-called supplemented behavioural profiles and making those profiles available to affiliated companies for the purpose of displaying targeted advertisements;
b) processing personal data for the purpose of profiling the data subjects based on their behavioural data in so-called simple behavioural profiles and making those profiles available to affiliated companies for the purpose of displaying targeted advertisements;
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
3
c) processing personal data by profiling the data subjects based on their supplemented customer database profiles in order to make contact information available to affiliated companies for telemarketing and postal marketing;
Pursuant to Articles 58(2) and 83 of the GDPR, the Swedish Authority for Privacy Protection decides that Bonnier News AB shall pay an administrative fine of SEK 13 000 000 (thirteen million).
## 2. Presentation of the supervisory case
In a supervision of Bonnier Magazine and Brands AB (ref. DI-2019-6523), the Swedish Authority for Privacy Protection (IMY) has found that Bonnier News AB, together with other companies within the Bonnier Group, processes personal data for, amongst other, marketing purposes based on the lawful basis legitimate interest pursuant to Article 6(1)(f) of the GDPR. IMY has initiated supervision against Bonnier News AB in order to investigate whether Bonnier News AB complies with the GDPR requirements for the processing of personal data that takes place for marketing purposes.
Within the framework of the supervision, Bonnier News AB has been given the opportunity to give its opinion on seven complaints addressed to IMY concerning various marketing measures taken by companies within the Bonnier Group of companies.² According to Bonnier News AB those marketing actions mentioned in the complaints have not happened due to withdrawals from the group wide/group common databases. Bonnier News AB has therefore stated that they are not the controller for the processing of the complainants' personal data regarding marketing. In the light of the above, IMY does not find it appropriate to further investigate these complaints within the context/scope of this supervision/case.
Within the scope of the supervision, IMY has examined whether Bonnier News AB has a lawful basis pursuant to Article 6 of the GDPR for the processing of personal data in the group-wide/group common databases for marketing purposes. The supervision covers the processing of personal data conducted through creating profiles and making it available to affiliated companies to be used to display personalized advertisements. It also covers the processing of personal data, the creation of profiles and the making available of data to affiliated companies in order to be used by affiliated companies in telemarketing and postal direct marketing. IMY has not taken a position on whether Bonnier News AB's personal data processing otherwise complies with the General Data Protection Regulation.
The supervision was initiated with an inspection on 7 November 2019. In connection with IMY sending the inspection report to Bonnier News AB, IMY asked the company supplementary questions on 20 December 2019. Bonnier submitted its point of view on the inspection report and replied to IMY's questions on 14 February 2020. On 15 May 2020, IMY submitted further supplementary questions to Bonnier News AB, to which it replied on 11 June 2020. Due to Bonnier News AB's update of its personal data policy, the company submitted additional information on 21 July 2020.
Bonnier News AB has given its opinion on IMY's draft decision on 13 April 2023.
² DI-2018-22602, DI-2019-10121, DI-2019-10513, DI-2019-11057, DI-2019-7484, DI-2019-8104 and DI-2019-9556
4
As the case concerns cross-border processing, IMY has made use of the cooperation and consistency mechanisms provided for in Article 56 and Chapter VII of the GDPR. The concerned supervisory authorities have been the authorities of Denmark, Germany, Finland and Norway.
## 2.1 Description of the group common processing of personal data
The following circumstances have emerged during the inspection and subsequent exchange of documents. Within the Bonnier Group of companies there is a collaboration between Bonnier News AB and a number of affiliated companies that are part of the group of companies (the affiliated companies). Which companies are affiliated changes over time. At the time of the inspection, there were 15 affiliated companies, which decreased to 8 during the spring of 2020. The processing of personal data that takes place within the framework of the cooperation is limited to the affiliated companies customers on the Swedish market. The affiliated companies collect personal data from their customers and people who visit the company's websites. The data collected is transferred into two group common databases, one customer database (KDB) and one behavioural database (the behavioural database). These databases generate profiles of individuals. The profiles are also linked to information obtained from Bisnode Sverige AB.
Bonnier News AB has stated that it stores collected data in the group common databases in order to use for the following purposes:
To establish a customer register for affiliated companies with good data quality, which includes compiling customer and user data and to verifying the accuracy, relevancy and appropriateness of the data
To offer the customers of the affiliated companies an easy way to exercise their rights and an opportunity to ask questions about personal data to the joint customer service
To make available personal data to affiliated companies in order to:
- Use the contact details of other affiliated companies to enable marketing to the affiliated companies of its own products and services through postal direct marketing and telemarketing.
- Display personalised content and ads in the affiliated companies digital services, based on customer and user's customer profile and behaviour on the affiliated companies sites.
- Perform analysis of customer data to gain customer insight in order to conduct customer communications, marketing of its own products, services and customer service.
- Perform analysis of customer data in order to improve and develop existing services and products.
The personal data processing that takes place for the purpose of adapting the advertisements of affiliated companies is based on data stored in the behavioural database. The personal data processing that takes place to disclose personal data to affiliated companies for use in telemarketing and postal direct marketing is based on data in KDB.
5
### 2.1.1 Description of the processing of personal data contained in the behavioural database
The inquiry in the case shows the following.
The data stored in the behavioural database is processed for the purpose of displaying personalised content and personalised advertisements in the digital services of the affiliated companies.
When an individual visits an affiliated company's website, the affiliated company collects information about the individual's browsing pattern. This is enabled through a script on the affiliated company's website requesting to save a text file (cookie) on the visitor's computer, tablet or mobile phone. The information contained in the cookie can be used to track the user's browsing pattern on the website. The data (behavioural data) collected when the individual browses and is then transferred to the behaviour database and added to the individual's profile is:
- Information on the URL (the visited webpage), its category and a content tag$^{3}$.
- Information on the user's device in which the webpage view took place, the browser type and the part of the user's IP address identifying the country;
Information on the behaviour in terms of the time spent on and time stamp for the page view;
Information on a unique, randomly generated cookie value ('cookie identifier');
Information on whether the page view took place in log-in mode.
Bonnier News AB erase the cookie identifier after 30 days and as of day 31, the generated behavioural data is no longer used for personalised advertisements to private individuals.
Data in the behavioural database and in KDB may in some cases be linked together.
Where the data in the behavioural database cannot be linked to KDB data, the behavioural profile of the data subject consists only of the data listed above, a profile which for the purposes of this decision will be referred to as "simple behavioural profile".
Where data in the behavioural database and data in KDB can be linked together in the behavioural database, data from KDB is added regarding the purchase history, gender, age, car ownership of the household and postal code, as well as statistical variables based on the private individual's residential area such as life phase, purchasing power and housing form to the behavioural database. For the purpose of this decision, these profiles will continue to be referred to as "supplemented behavioural profile".
The process of making data available to affiliated companies is done through a search tool that is linked to the behavioural database where the affiliated company can order a
³ A content tag is a description of the content that has been consumed in the services of the participating companies. Bonnier News AB collects two types of tags, predefined according to IAB's (The Interactive Advertising Bureau) standard and tags produced by the affiliated companies' editorial boards.
6
segment of customer data based on its chosen variables. An administrator will review whether the order meets the cooperation specific criteria. If this is the case, the affiliated company will gain access to a code that enables it to target ads at users included in the segment.
The affiliated companies can only retrieve data from the behavioural database based on behavioural data that has been collected from the company's own digital services. This applies regardless of whether it is a simple or supplementary behavioural profile. Regarding the supplemented behavioural profile however, it may contain purchase history from other affiliated companies as well. In KDB, data is erased after two years upon which data older than that cannot be linked to the behavioural database or disclosed to affiliated companies.
### 2.1.2 Description of the processing of personal data stored in KDB
The inquiry in the case shows the following.
The information about private individuals contained in KDB is processed for the purpose of being used by affiliated companies for the marketing of their own products and services through postal direct marketing and telemarketing.
In connection with an individual making a purchase or signing up to a subscription, the affiliated company that has a contractual relationship with the customer collects data from the customer. A portion of this data is transferred to KDB. In KDB, information is linked to a profile. In KDB, the customer profile is assigned a KDB ID. If the affiliated company's customer is already registered in KDB, the existing customer profile is updated/supplemented with the new engagement. In the absence of a pre-existing customer profile, a new customer profile is created with a new KDB ID. The data stored in KDB collected from the customer's contact with the affiliated company is the name, address, telephone number, national identification number national identification number, e-mail address and information related to the customer's purchase, such as product category, brand, type of packaging (whether it is a digital or traditional product and whether it is a free or paid product). It is also registered in the KDB if the customer has objected to its data in the KDB being used for marketing purposes and information whether the customer has registered in the so-called NIX register. There are limitations for the following categories of data:
- The e-mail address is not disclosed to affiliated companies for the purpose of telemarketing and postal direct marketing.
- The national identification number is only used to verify whether the customer has signed up to object to marketing measures in the NIX register (NIX-spärr) and to check that the customer is not deceased.
- The national identification number is not made available to the affiliated companies.
In addition to the data collected by the affiliated companies, Bonnier News AB collects data from Bisnode Sverige AB in order to control and supplement the contact details of individuals, as well as to provide statistical data such as life phase, purchasing power and form of housing. Furthermore, data on car ownership and deceased persons are collected as well as information on a so-called GEDI ID (which is a unique identifier in the form of a pseudonymized ID).
Data in KDB and the behavioural database may in some cases also be linked in KDB. The profile then constitutes what in this decision hereinafter will be referred to as supplemented customer database profile. This is done by a customer of an affiliated
7
company visiting the company's website and logging into his account. The behavioural data that has been collected regarding the customer and which is linked to a cookie identifier can under certain conditions be linked to the customer's KDB ID. In cases where the customer's KDB ID and the value of the cookie can be linked together, the KDB profile is supplemented with data collected in the last 30 days from the behavioural database. The data collected is information about which websites the customer has visited, which section of the website the customer visited (so-called content tags), and what device type the customer have used for browsing. Bonnier News AB has limited the type of content tags on which companies other than the one whose website the individual have accessed can base their profiling on for the purposes of telemarketing and postal direct marketing.⁴
When a person ceases to be a customer of an affiliated company, KDB is notified that the customer's engagement has ended and the customer is flagged as a passive customer. The customer's data will then be deleted in KDB after two years. Data collected from the behavioural database is deleted after 30 days. Any NIX blocking is always activated when making contact information in KDB available to other affiliated companies' customers and contact details of their own customers when they have been passive for 12 months.
The data is made available to affiliated companies upon request through an application in KDB. In KDB, a sample file is created based on the criteria specified by the affiliated company. Within the framework of the cooperation, something called purpose-adapted schemes is applied. These regulate what information is disclosed from KDB. At the point of disclosure, only the data points defined as necessary for the marketing channel indicated at the time of disclosure are provided, i.e. telephone numbers at a telemarketing campaign and addresses used for postal direct marketing. The data points on which the segmentation was based are not disclosed. The data is made available through an interface in KDB to the affiliated company.
It is possible for the data subject to request erasure from KDB. The data subject also has the right to object to the use of their data for telemarketing and postal direct marketing.
Bonnier News AB has stated that all affiliated companies are majority owned by Bonnier Group AB and are subject to the Bonnier Group's framework for processing personal data and that only a small part of the profiles in question could be linked to data in the behavioural database.
### 3. Statement of reasons for the decision
### 3.1 IMY's competence
### 3.1.1 Circumstances at issue
Part of the personal data processed within the group common cooperation has been collected through affiliated companies having placed a cookie on the visitor's computer, surf tablet or mobile phone. Bonnier News AB has stated that the collection is made through the websites of affiliated companies. The affiliated companies then transfer this data to the behavioural database and in some cases the data is also linked to profile information in KDB. Bonnier News AB has stated that the obligations arising from the provisions of the Electronic Communications Act (2003:389) and the
⁴ Only tags categorised with IAB's taxonomy are collected.
8
since adopted Electronic Communications Act (2022:482) on Electronic Communications (LEK), aimed at affiliated companies and not Bonnier News AB because it is the affiliated companies that are responsible for the processing that is the actual collection of the data.
### 3.1.2 Applicable provisions, etc.
Pursuant to Article 95 of the GDPR, the GDPR shall not impose any additional obligations on natural or legal persons that process personal data within fields that are already subject to obligations under the so-called ePrivacy directive⁵. The ePrivacy directive has been implemented in Swedish law through LEK, where, inter alia, the collection of data through cookies is regulated.
Pursuant to Chapter 9, Section 28 of the LEK, data may be stored in or gained from a subscriber's or user's terminal equipment only if the subscriber or user has access to information about the purpose of the processing and has given his consent to it. Furthermore, it follows that this does not prevent the storage or access necessary to transmit an electronic message over an electronic communications network or which is necessary for the provision of a service expressly requested by the user or subscriber. Prior to August 1st 2022, when the LEK entered into force, corresponding requirements were made pursuant to Chapter 6, Section 18 of the Electronic Communications Act (2003:389). The Swedish Post and Telecom Agency (PTS) is the supervisory authority pursuant to the LEK (Chapter 1, Section 5 of Ordinance [2022:511] on electronic communications).
The EDPB has stated in its opinion on the interplay between the ePrivacy directive and the General Data Protection Regulation⁶. It follows, inter alia, that the national supervisory authority appointed under the ePrivacy directive is solely competent to oversee compliance with the directive. However, according to the GDPR, the supervisory authority is the competent supervisory authority for the processing which is not specifically regulated in the ePrivacy directive. If only part of the processing falls within the scope of the ePrivacy directive, this does not limit the supervisory authority's power to examine other parts of the processing pursuant to the GDPR.⁷
This means, inter alia, that the data protection authority under the GDPR is competent under the GDPR to assess the lawfulness of the processing of personal data that takes place after the data has been retrieved from the individual's terminal equipment, such as the storage of collected data and the analysis of data for purposes of online behavioural advertising.⁸
### 3.1.3 IMY assessment
The data supplied to the behavioural database has been collected by the affiliated companies through cookies. The processing of personal data that is under investigation in this supervisory case is Bonnier News AB's subsequent processing of personal data in the behavioural database. Said processing is not covered by the regulations in the LEK or the previously applicable regulation in the Electronic
⁵ Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communica ions sector (Directive on privacy and electronic communications).
⁶ Opinion 5/2019 on the interaction between the ePrivacy Directive and the general public General Data Protection Regulation, in particular as regards the competences, tasks and powers of data protection authorities, adopted on 12 March 2019
⁷ See paragraphs 68 and 69 of the opinion.
⁸ See paragraph 75 of the opinion.
9
Communications Act (2003:389). This means that the GDPR applies to the processing and that IMY is the competent supervisory authority.
### 3.2 Bonnier News AB's responsibility for the data processing
#### 3.2.1 Circumstances at issue and Bonnier News AB's position
It is Bonnier News AB's position that Bonnier News AB and each affiliated company have a joint controllership and responsibility for the processing that takes place in KDB and the behavioural database for the purposes set out above as common.
Furthermore, Bonnier News AB has stated that Bonnier News AB and its affiliated companies share a joint view of the purposes and means and that Bonnier News AB has entered into the Joint Data Controller Agreement with the affiliated companies pursuant to Article 26(2) of the GDPR.
Bonnier News AB has stated that each affiliated company has its own independent ("local") controller responsibility for its own collection of the data. Bonnier News AB has further stated that it has no joint controller responsibility for the personal data processing carried out at the point after which the data has been disclosed to affiliated companies from the group common databases. It is the affiliated company that retrieves the data that is responsible for the processing carried out by this company after collection.
#### 3.2.2 Applicable provisions, etc.
Pursuant to Article 4(7) of the GDPR, the controller is the person who alone or jointly with others determines the purposes and means of the processing of personal data. The fact that the purpose and means can be determined by more than one actor means that several actors can be controllers for the same processing.
Pursuant to Article 4(2) of the GDPR, processing is a measure or combination of measures involving personal data or sets of personal data.
The Court of Justice of the European Union has held in the Fashion-ID judgement that a website owner who uses social network plug-ins on its website may become a joint controller with the social network. This applies to the processing of collection and disclosure by transmission of the personal data of website visitors using the social network plug-in. The Court also held that each party is responsible only for those parts of the processing chain for which it actually determined the purpose and means.⁹
In Wirtschaftsakademie, the Court of Justice held that joint controller responsibility for processing does not necessarily mean that the various actors involved in the processing of personal data have the same responsibility.¹⁰ On the contrary, those actors may be involved at different stages of the processing of personal data and to different degrees, for which each actor's level of responsibility must be assessed in the light of all the relevant circumstances of the individual case.
#### 3.2.3 IMY assessment
Bonnier News AB provides two databases, the KDB and the behavioural database, from which data from affiliated companies are merged into profiles of private individuals. Subject to the conditions determined by Bonnier News AB and the
⁹ See judgment in Fashion-ID, C-40/17, EU:C:2019:629, paragraph 64-85
¹⁰ See judgment in Wirtschaftsakademie, C-210/16, EU:C:2018:388, paragraph 43
10
companies, the information is made available to Bonnier News AB and affiliated companies.
IMY notes that, in addition to making the databases available to the affiliated companies, Bonnier News AB has together with the companies decided the framework for the processing in various ways.
In light thereof, IMY makes the assessment that Bonnier News AB is joint controller of the data along with the affiliated companies for the part of the personal data processing that takes place for the common purposes of making personal data available, through profiling of private individuals' data, to affiliated companies to display personalised advertisements and for use in telemarketing and postal direct marketing. This includes the collection of data to the databases, the storage in the databases and the profiling, the collection of additional data from Bisnode Sverige AB, the interconnection that occurs between the behavioural database and KDB, and the transfer of data between the databases. Furthermore, Bonnier News AB is jointly responsible for personal data with the affiliated companies for the actions that take place before and upon a disclosure to an affiliated company.
### 3.3 What constitutes personal data?
#### 3.3.1 Circumstances at issue and Bonnier News AB's position
Under the section titled "Description of the group common personal data processing" the processing is described as a variety of data collected from private individuals are processed in KDB and the common behavioural database. Bonnier News AB considers that what is referred to in this decision as supplemented behavioural profile constitutes personal data. However data in the behavioural database – which cannot be linked to data in KDB – constitute anonymous behavioural data according to Bonnier News AB. This is because they cannot be linked to a person either via KDB ID, customer ID, IP address or any other identifier of a person. Bonnier News AB therefore considers that the behavioural profiles referred to in this decision as simple behavioural profiles do not constitute personal data. The segmentation made on these simple profiles is, according to Bonnier News AB, only based on the affiliate's own collected information in the behavioural database (a company can, for example, choose to adapt sports-related content and advertisements to the data recorded via a cookie in the last 30 days).
#### 3.3.2 Applicable legal provisions other legal sources
Pursuant to Article 4(1) GDPR, personal data is any information relating to an identified or identifiable natural person (i.e. the data subject). From the same provision, it follows that an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or online identifiers or one or more factors specific to the natural person's physical, physiological, genetic, mental, economic, cultural or social identity.
According to Recital 26 of the GDPR, the principles of data protection should apply to all information relating to an identified or identifiable natural person. Personal data which have undergone pseudonymisation which could be attributed to a natural person by the use of additional information should be considered as information on an identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all means, such as singling out which, either by the controller or by another person, may reasonably be used to identify the natural person directly or indirectly. In order to determine whether means are reasonably likely
11
to be used to identify the natural person, account should be taken of all objective factors, such as the costs and duration of identification, taking into account both the available technology at the time of processing and technological developments. The principles of data protection according to recital 26 should not apply to anonymous information that does not relate to an identified or identifiable natural person, or to personal data rendered anonymized in such a way that the data subject is no longer identifiable. The Regulation therefore does not concern the processing of such anonymous information, which includes information for statistical or research purposes.
According to recital 30 of the GDPR, natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as IP addresses, cookie identifiers or other identifiers, such as radio frequency identifications tags. This may leave traces that, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of natural persons and identify them.
An opinion of the Article 29 Working Party,$^{11}$ which contains an analysis of the concept of personal data, shows that a natural person in a group is considered to be ‘identified’ when he or she can somehow be ‘singled out’ from other persons.$^{12}$ The European Data Protection Board (EDPB) has stated in its guidelines on targeting users through social media advertising that even persons who use a social media service without having created an account or profile with the social media service may constitute data subjects within the meaning of Article 4(1) of the GDPR if the person is directly or indirectly identified or identifiable.$^{13}$ In that regard, the EDPB refers to the concept of ‘singling out’ in recital 26 of the GDPR and to the abovementioned opinion of the Article 29 Working Party.
The Article 29 Working Party’s opinion on online behavioural based advertising further develops what it means to be identifiable:
The Article 29 Working Party states that behavioural based advertising often leads to the processing of personal data. Behavioural based advertising typically includes the collection of IP addresses and the processing of unique identifiers (through the web cookie). The use of such functions with a unique identifier makes it possible to track users of a particular computer even if dynamic IP addresses are used. In other words, such functions make it possible to “singled out” individual data subjects, even if their names are not known. In addition, the information collected in behavioural advertising relates to (i.e. is about) a person’s characteristics or behaviour and is used to influence that particular person. This approach is further reinforced by taking into account the possibility that profiles can be linked at any time to directly identifiable information provided by the data subject, such as information provided when registering on a website. Other scenarios that may lead to identification include mergers, data losses and the growing availability of personal data linked to IP addresses on the Internet.$^{14}$
$^{11}$ The so-called Article 29 Working Party was an advisory and independent working group composed of representatives of the supervisory authorities of the EU and the EEA. The task of the group was to contribute, inter alia, to the uniform application of the Data Protection Directive through recommendations. The Working Party has been replaced on 25 May 2018 by the EDPB.
$^{12}$ See WP 136. Article 29 Working Party Opinion 4/2007 on the concept of personal data, adopted on 20 June 2007, p 12(f)
$^{13}$ See EDPB Guidelines 8/2020 on Targeted Advertising in Social Media Version 2.0, adopted 13 April 2021, p 19
$^{14}$ See WP 171, Opinion 2/2010 of the Article 29 Working Party on behavioural advertising on the Internet, adopted on 22 June 2010, p. 9(f)
12
### 3.3.3 IMY's position
IMY notes that the supplemented behavioural profiles (i.e. behavioural profiles linked to KDB) contain data relating to identified or identifiable natural persons. The supplementary behavioural profiles are therefore personal data.
With regard to the simple behavioural profiles (i.e. behavioural profiles not linked to KDB), IMY makes the following assessment.
In order for a data to be classified as personal data, it is necessary, first, that the data refers to a natural person. This requirement is met with regard to simple behavioural profiles because the data describe how the individual has surfed with a number of different parameters.
Furthermore, the natural person is required to be identified or identifiable. According to Article 4(1) of the GDPR, it is sufficient for a person to be identified indirectly for this requirement to be met. The provision further states that identification may be made by reference to an online identifier. Recital 30 of the Regulation lists cookies ("cookie identifiers" in the English language version) as an example of online identifiers. Identification within the meaning of Article 4(1) may therefore be carried out by means of unique web cookie values used in the behavioural database.
IMY further notes that from recital 26 of the GDPR it becomes apparent that singling out is a means of identifying a natural person. This means that one person can be identified by being distinguished from other persons.¹⁵ Thus, it is not required that the person be identified by name or national identification number. Such separation or screening occurs when the information being processed makes it possible to identify, draw conclusions or take specific action in relation to a user. In the behavioural database, the information is linked to a unique identifier, a unique cookie value, which is linked to a specific browser or app, which in turn is connected to a device such as a computer or phone. One of the purposes of the processing of the data is to target users through marketing based on the users previous behaviour in an identified browser or app on the basis of the user's behaviour. The purpose of the processing is thus to draw conclusions about the individual by creating a profile and based on this affect the individual. Thus, IMY notes that even the simple behavioural profiles not linked to KDB mean that individuals are identifiable.
Against this background, IMY considers that the simple behavioural profiles constitute personal data.
### 3.4 The processing constitutes profiling
### 3.4.1 Applicable provisions
Profiling is defined in Article 4(4) of the GDPR as any form of automated processing of personal data that consists of the use of personal data to assess certain personal characteristics of a natural person, in particular to analyse or predict that natural person's performance at work, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements.
¹⁵ See WP 136.f Opinion 4/2007 of the Article 29 Working Party on the concept of personal data, adopted on 20 June 2007 p. 12
13
### 3.4.2 IMY's position
IMY notes that the processing, both of personal data based on simple behavioural profiles and supplemented behavioural profiles that take place for the purpose of making the data available to affiliated companies for the purpose of displaying personalised advertisements includes profiling of data subjects as defined in Article 4(4) of the GDPR. This is because it concerns the automatic processing of personal data aimed at categorising the data subjects according to their previous behavioural patterns, which in turn makes it possible to assess some of their personal characteristics.
IMY further notes that the processing of personal data for the purpose of making available contact details for telemarketing and postal direct marketing includes profiling of data subjects as defined in Article 4(4) of the GDPR. This is because it involves automated processing of personal data for the purpose of categorising data subjects based on their purchase history and, in some cases, also behavioural patterns.
### 3.5 Legal basis for processing for the purpose of displaying personalised advertisements based on data in the behavioral database
### 3.5.1 Circumstances at issue and Bonnier News AB's position
Bonnier News AB has stated that the activities within the Group has been coordinated in order to achieve a better data collection and make it possible to process the customers' and users' personal data for specified purposes in a cost-effective and integrity-friendly manner. Bonnier News AB uses profiling of private individuals to make data available to its affiliated companies for the purpose of displaying personalised advertisements, on collected behavioural data that cannot be linked to KDB, and on behavioural data which can be connected to the KDB and where additional personal data is added to the data subject's profile. Bonnier News AB relies on the legal basis of Article 6(1)(f) of the GDPR for this processing of personal data.
Legitimate interest
Bonnier News AB has stated the following.
The Company has a legitimate interest which consists in a need to understand its customers and users wishes and needs in order to achieve relevance in content and advertising targeted at customers and users and through it be able to offer competitive products/services and attractive advertising spaces. Many of the affiliated companies also engage in journalistic operations. Today, publishers' business model consists of revenue streams from reader and advertising income. The group common personal data processing is important for the financing of the companies' journalistic operations. Bonnier News AB has also pointed out the protection of freedom and diversity of the media in Article 11 of the EU Charter of Fundamental Rights.
Necessary processing
Bonnier News AB has stated that the processing of personal data is necessary in order to achieve the purposes of making available private individuals' profiles to affiliated companies in order to display personalised advertisements. The company, along with the other companies, has taken steps to minimise the number of data collected as well as to limit the duration of the processing of the data and to ensure that the databases are kept separate and that only certain data are transferred between them.
14
### *Balancing of interests*
Bonnier News AB has stated the following.
Bonnier News AB’s interest overrides the private individual’s interest in the protection of their personal data.
The processing of personal data in order to display personalised advertisements based on the private individual’s profile is an essential condition for journalists and publishers to earn revenue and by extension be able to conduct journalism.
There is a possibility to object to the profiling that is based on behavioral data. According to the information that private individuals receive in Bonnier News AB’s personal data policy, the private individual can object to information about their online behaviour being processed in the group common customer database.$^{16}$ The result is that the connection between the private individual’s customer data and their browsing behaviour is removed.
The data subjects have a direct relationship with one or more affiliated companies. Users/customers have either visited an affiliated company’s website, purchased products from an affiliated company or have an active digital subscription. Many of the customers are subscribers who have a long-term relationship with the company providing the service or product and can therefore be considered to reasonably expect that their data will be processed. Many readers have a strong commitment to their preferred type of news media. Customer profiles in KDB contains, to some extent, to unit-purchases such as literature, newspaper and goods. In these cases, the relationship between customer and supplier may be considered somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided and there are alternative products such as printed newspapers that private individuals can view completely anonymously.
It is unlikely that the processing will have a negative impact on the data subject’s interest. Private individuals’ interaction with affiliated companies is voluntary and it is in their interest that the companies’ services are as relevant as possible. Furthermore, Bonnier News AB has referred to the fact that the Article 29 working party has stated that targeted marketing based on simple customer profiles, such as gender, age, place of residence and general interests (e.g. “fashion”) typically has no significant impact on private individuals. Furthermore, Bonnier News AB has taken steps to ensure that a minimum of data is processed in relation to the purposes as well as to reduce privacy risks in other respects. Among other things, the personal data is not shared with companies other than the affiliated companies within the group and all of these companies are subject to the Bonnier Group’s framework for processing of personal data.$^{17}$
The processing at issue falls within the data subject’s reasonable expectations because the private individuals who come into contact with the companies do so out of their own free will in order to access content on websites, purchase services and/or products and that they always have a customer/user relationship with one or more companies within the group. The companies’ privacy policies contain easy to understand information about how the processing of customers’ and users’ personal
$^{16}$ The version of Bonnier News AB’s personal data policy filed on 21 July 2020, see under the heading “How to access and control your personal data”, file annex 20.1.
$^{17}$ Further measures taken are set out in the opinion submitted on 14 February 2020 Annex 13, Annex O
15
data is conducted within the group. The processing carried out within the scope of the KDB and the behavioural database is closely related to the companies' services and products, which should indicate what the consumers can expect. The fact that many of the companies' products and services are provided online and, in many cases, free or funded through advertising should lead to a certain expectation and acceptance of certain personal data processing for, inter alia, the adaptation of content and advertising. Today, many digital products that are consumed by a very large proportion of consumers in society are adapted to the individual and it is Bonnier News AB's point of view that today's consumers expect that the digital products and services they consume to some extent will be adapted to the private individual.
### 3.5.2 Applicable provisions, etc.
Personal data shall be processed in a lawful, fair and transparent manner in relation to the data subject, pursuant to Article 5(1)(a) GDPR. The lawful processing of the data means, inter alia, that at minimum one of the conditions set out in Article 6(1) is fulfilled.
Consent pursuant to Article 6(1)(a), is one of the legal bases a controller can rely upon for the processing of personal data. Another legal basis pursuant to Article 6(1)(f) is legitimate interest, which requires that the following three cumulative conditions are met. There must be (i) a legitimate interest of the controller or of the third party to whom the data is disclosed, (ii) the processing of personal data must be necessary for the legitimate interest pursued by the controller and (iii) the data subject's interest in the protection of his or her personal data must not outweigh the interest of the controller.¹⁸
According to recital 47 of the GDPR, a legitimate interest may exist, for instance, where there is a relevant and appropriate relationship between the data subject and the controller, for example if the data subject is a customer of the controller. It is stated that the processing of personal data for direct marketing purposes may be regarded as a legitimate interest. Furthermore, it is stated that a legitimate interest requires a careful pre-assessment, including if the data subject can reasonably expect, at the time and in connection with the collection of personal data, that processing for the specified purpose may take place. The interests and fundamental rights of the data subject could, in particular, triumph that of the controller if personal data are processed in circumstances where the data subject cannot reasonably expect any further processing.
Pursuant to Chapter 9, Section 28 of the LEK, which implements Article 5(3) of the ePrivacy Directive in Swedish law, data may be stored in or retrieved from the user's or subscriber's terminal equipment only if the subscriber or user has access to information about the purpose of the processing and consents to it. This does not prevent the storage or access necessary to transmit an electronic message over an electronic communications network or that is necessary to provide a service explicitly requested by the user or subscriber. Similar requirements previously applied in accordance with Chapter 6, Section 18 of the Electronic Communications Act (2003:389).
The EDPB Guidelines on processing personal data in the context of connected vehicles and mobility related applications show that data collected on the basis of consent pursuant to Article 5(3) of the ePrivacy Directive or subject to the exceptions
¹⁸ See, Fashion ID, C-40/17, EU:C:2019:629, paragraph. 95.
16
in Article 5(3) of that Directive can only be further processed for another purpose, if the controller requests further consent or is supported by Union or Member State law.¹⁹ The EDPB further states that such further processing cannot be based on a compatibility test pursuant to Article 6(4) GDPR, as it would undermine the protection of the ePrivacy Directive. Furthermore, the EDPB states that consent must, when required by the ePrivacy Directive, be specific and informed, meaning that data subjects must be made aware of each one of the purposes for processing and have the right to refuse such specific purposes. Should further processing on the basis of a compatibility test under Article 6(4) GDPR be possible, the very principle of consent requirements of the current Directive would be circumvented.²⁰
In the EDPB Guidelines on the targeting of social media users, personal data are divided into categories of data that the data subject actively and knowingly has provided to the controller, observed data provided by the data subject through his or her use of the service or entity and derived and inferred data created on the basis of the data provided by the data subject.²¹ According to the EDPB, there are two lawful bases that could be considered for processing such data that the data subject has actively and knowingly provided, those being consent under 6.1(a) and legitimate interest under 6.1 f GDPR. Regarding data collected through observed data provided by the data subject through the use of a service or entity, including data collected through cookies, the EDPB states that Article 6(1)(f) cannot provide a lawful basis for targeted advertising where private individuals are tracked across websites and locations.²² Furthermore, the EDPB states that for such processing, consent is probably the most appropriate lawful basis in Article 6 GDPR. The assessment should also consider the fact that the processing includes activities that the EU legislator has opted to provide additional protective measures.²³
In its guidelines on consent under Regulation 2016/679, the EDPB has stated that if controllers choose to rely on consent as lawful basis for any part of the processing, they must be prepared to respect this choice and stop this part of the processing if a private individual withdraws their consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. The EDPB further states that, for instance, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent. Because of the requirement to disclose the lawful basis, which the controller is relying upon at the time of collection of personal data, controllers must have decided in advance of collection what the applicable lawful basis is.²⁴
According to an opinion of the Article 29 Working Party on the notion of the controller's legitimate interest in Directive 95/46/EC, when carrying out the balancing of interests test, account should be taken of the nature of the controller's legitimate interest, the damage to the controller if the data were to not be processed, the nature of the data, the way data are being processed, the status of the data controller and data subjects., the reasonable expectations of the data subjects as to what will happen to
¹⁹ See Guidelines 01/2020 on the processing of personal data in connection with connected vehicles and mobility-related applications, Version 2.0, Adopted on 9 March 2021, para. 53
²⁰ See previous note
²¹ See EDPB Guidelines 8/2020 on Targeted Advertising in Social Media Version 2.0, adopted 13 April 2021, para. 40
²² See previous note, paragraph 77
²³ See previous note paragraph 78
²⁴ See EDPB Guidelines 05/2020 on consent under Regulation (EU) 2016/679, Version 1.1, adopted on 4 May 2020, paras 122-123
17
their data and the consequences for the data subjects. If, after analyzing the above factors, the outcome of the balancing of interests' test is still unclear, the design of so-called additional safeguards may be decisive for the outcome of the balancing of interests' test.²⁵
The Article 29 Working Party guidelines on automated individual decision-making and profiling, provide guidance when profiling can be based on legitimate interests under 6.1(f). According to the Guidelines, the following elements are relevant:
- The level of detail in the profile.
- The comprehensiveness of the profile.
- The impact of the profiling.
- The safeguards aimed at ensuring fairness, non-discrimination and accuracy in the profiling process.
In several opinions, the Article 29 Working Party has repeated its position that it is difficult to rely on Article 6(1)(f) GDPR for profiling that takes place for marketing or advertising purposes when private individuals are tracked across multiple websites, locations, entities, services or for data brokerage activities.²⁶
### 3.5.3 Basic principles for IMY's assessment
Bonnier News AB processes personal data for the purpose of making individuals' profiles available to affiliated companies in order to display personalised advertisements based on the lawful basis legitimate interest pursuant to Article 6(1)(f) of the GDPR. Before IMY examines whether the lawful basis may constitute the basis for Bonnier News AB's processing, IMY finds reason to consider how the processing relates to certain statements made in the EDPB guidelines.
According to the EDPB's guidelines on the targeting of social media users, regarding data that the data subject has actively and knowingly provided, both consent and legitimate interest may constitute a lawful basis for the processing. However, the guidelines show that for data collected through observation (e.g. through cookies), legitimate interest cannot serve as an appropriate lawful basis when targeted advertising is based on tracking individuals across websites and locations.
IMY points out that Bonnier News AB collects data for its behavioral database from several different websites, but an affiliated company can only retrieve data based on behavioural data collected from the company's own digital services. This applies regardless of whether it is a simple or supplementary behavioral profile.
The EDPB Guidelines on processing personal data in the context of connected vehicles and mobility related applications state that data collected on the basis of consent pursuant to 5.3 of the ePrivacy Directive can be further processed for another purpose only if the controller requests further consent or the processing is supported by EU or national law. The EDPB guidelines on consent in its section on interplay between consent and other lawful bases in Article 6 also addresses the situation when
²⁵ See Article 29 Working Party Opinion 6/2014 on the notion of the controller's legitimate interests in Article 7 of Directive 95/46/EC
²⁶ See the Opinion of the Article 29 Working Party on Automated Individual Decision-Making and Profiling under Regulation (EU) 2016/679, adopted on 3 October 2017, p. 15 and Opinion 6/2014 of the Article 29 Working Party on the concept of the controller's legitimate interest in Article 7 of Directive 95/46/EC, adopted on 9 April 2014, p. 47, and the examples of pp. 59-60 and EDPB Guidelines 8/2020 on targeted advertising in social media Version 2.0, adopted on 13 April 2021 p. 77
18
the data subject is informed that data will be processed on the basis of consent, while actually some other lawful basis is relied on, is fundamentally unfair to individuals.
IMY notes that the situation in the supervisory case differs to some extent from that described in these guidelines. In the supervisory case, it is the affiliated companies that collect the data in pursuant to 5.3 of the ePrivacy Directive and are therefore subject to the requirement of consent in said provision. The affiliated companies have to ensure that they have legal support for their processing under the ePrivacy Directive and the General Data Protection Regulation. The processing of personal data by the affiliated companies is not covered by this supervision.
It is not Bonnier News AB that collects the data on the basis of consent under the national provisions implementing Article 5(3) of the ePrivacy Directive. It is only when the affiliated companies enter the personal data into the behavioral database and KDB that Bonnier News AB's processing begins. Bonnier News AB therefore does not change lawful basis from consent to legitimate interest.
At the same time, IMY points out that Bonnier News AB is part of the same Group of companies as the affiliated companies and that Bonnier News AB is a joint controller with the affiliated companies for the processing of personal data in the databases. The establishment of group common databases should not mean that data subjects receive a lower level of protection than if the processing took place only at the group company that collected the personal data. In other words, Bonnier News AB should not have greater opportunities to process personal data on the lawful basis of legitimate interest than that of the affiliated companies. Therefore, according to IMY, the guidelines set out above should have an impact on the assessment of the possibility of using legitimate interest as a lawful basis in the supervisory case.
It can be inferred from the above stated that, pursuant to Article 6(1)(f) of the GDPR, the scope for further processing of data collected on the basis of consent under the LEK is very limited. At the same time, the GDPR does not prohibit the use of Article 6(1)(f) as the lawful basis for the type of processing in question. IMY therefore proceeds and examines whether the processing is based on Article 6(1)(f) of the GDPR. IMY's assessment of whether Bonnier News AB can rely its processing on Article 6(1)(f) of the GDPR is based on the three conditions that must be fulfilled under the provision:
(i) Is there a legitimate interest of the controller or of the third party to whom the data are disclosed?
(ii) Is the processing of personal data necessary for the legitimate interest pursued?
(iii) Does the data subject's interest in protecting his or her personal data outweigh the controllers?
IMY deals with the first two steps of the balancing of interests test jointly for the supplemented and simple behavioural profiles (sections 3.5.3 and 3.5.4). The third and final steps are then dealt with separately for the supplemented behavioural profiles (section 3.5.5) and the simple behavioural profiles (section 3.5.6).
19
### 3.5.4 Legitimate interest
There is a commercial aspect to Bonnier News AB's interest in creating profiles to make data available to affiliated companies in order to display personalised ads. The commercial aspect of an interest does not preclude that the interest is justified, but determines whether that interest is lawful, specific and represent a real and present interest.27
Bonnier News AB's and affiliated companies' interest is lawful, real and present. IMY therefore notes that Bonnier News AB's interest in creating profiles for making available as well as the affiliates' interest in processing personal data in order to display personalised advertisements based on customer and user customer profiles and behavioural profiles is legitimate.
### 3.5.5 Is the processing necessary for the legitimate interest?
The necessity requirement laid down in Article 6(1)(f) of the GDPR must be examined in conjunction with the principle of data minimisation set out in Article 5(1)(c).28 The purpose of the processing is to make data available to affiliated companies in order to display personalised advertisements based on private individual profiles. The supervisory case has shown that Bonnier News AB, together with the affiliated companies, has taken steps to minimise the number of data collected and limit how long this data is processed, as well as to ensure that the databases in which the data are processed are kept separate and that only certain data are transferred in between the two databases. In light thereof, IMY considers that the processing described in this Decision is necessary for the stated purpose.
### 3.5.6 Balancing test test for the processing of personal data in supplemented behavioural profiles
Bonnier News AB's interest in creating profiles to make data available to affiliated companies in order to display personalised advertisements can, according to the company, benefit the private individual either through higher revenues allowing for free or cheaper services or that the individual is provided with offers that they are interested in. Bonnier News AB has also emphasised that many of the affiliated companies are engaged in journalistic operations and that publishers' operating model of today consists of income streams from reader and advertising revenue and that the group common processing is important for the financing of the companies' journalistic operations. In those circumstances, the company considers that its interest is particularly important.
As IMY has already stated, the interest in displaying personalised advertisements is justified pursuant to and within the meaning of Article 6(1)(f) GDPR. On the question of the significance of this interest, IMY points out that the interest is not in itself journalistic, but of a commercial nature. Through profiling, knowledge about customers and potential customers is achieved, which enable revenue from personalised advertising. IMY considers that Bonnier News AB's and its affiliated companies' commercial interest does not weigh as heavily as Bonnier News AB claims.
As regards the assessment of the interests of data subjects, IMY considers the following.
27 See Article 29 Working Party Opinion 6/2014 on the notion of he controller's legitimate interests in Article 7 of Directive 95/46/EC
28 See judgment in Asociatia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48
20
As pointed out above, Bonnier News AB collects personal data in the behavioural database that was originally collected by the affiliated companies through cookies. The consent requirement under Chapter 9, Section 28 of the LEK for the collection provides a high level of privacy protection and a possibility for data subjects to control the use of the collected data.²⁹ This protection, as stated by the EDPB in several of its guidelines, risks being undermined if the personal data collected are processed on the basis of other lawful bases, such as legitimate interest pursuant to Article 6(1)(f) GDPR. As IMY already has stated, Bonnier News AB should not have more possibilities than the affiliated companies to use the lawful basis, legitimate interest, for processing the personal data, than the affiliated companies which collect them by cookies. IMY therefore considers that the nature of the data implies that the interest of the data subjects should be given great weight in the balancing of interests test.
Furthermore, IMY considers that the possibility for using Article 6(1)(f) GDPR as the lawful basis for profiling based on observed data is limited (see EDPB Guidelines 8/2020 on targeted social media advertising p. 77-78). IMY notes that the nature of the processing also means that the privacy interest of the data subjects weighs heavily.
Bonnier News AB has pointed out that profiling and personalised advertisements can benefit the data subject by enabling higher revenues for the affiliated companies, which in turn enables them to offer free or cheaper services. It can also benefit the data subject by providing them with offers that they are interested in. IMY does not question that the processing may partly benefit the data subjects, but believes that the overall interest in profiling is to create advertising that is as accurate as possible in order to get customers and potential customers to buy goods or services and to receive revenue from such advertising.
In cases where behavioral data can be linked to KDB for the purpose of displaying personalised ads (the so-called “supplementary behavioral profiles”), IMY considers the following in its assessment. While data for profiling are not collected from different websites, which, according to the EDPB guidelines, would render the lawful basis in Article 6(1)(f) GDPR as appropriate, the profiling includes data collected from other contexts such as previous purchases, collected demographic data and statistical data. IMY considers that profiling is extensive in its nature and that such profiling is not something a data subject can expect without having consented to such processing of personal data.
In conclusion, IMY considers that the data subject’s privacy interest outweighs the interests of Bonnier News AB and its affiliated companies.
In light thereof, IMY concludes that Bonnier News AB has processed personal data in breach of Article 6(1) GDPR in order to profile the data subjects based on their behavioural data in a so-called supplemented behavioural profile and make the profiles available to affiliated companies in order to display personalised advertisements.
### 3.5.7 Balance of interests for the processing of personal data in simple behavioural profiles
As IMY previously stated in section 3.5.5, Bonnier News AB’s interest to create profiles to make data available to affiliated companies to show personalised ads is a commercial interest that does not weigh as heavily as Bonnier News AB claims.
²⁹ The same requirements under Chapter 6, Section 18 of the Electronic Communications Act (2003:389) applied at the time in the case.
21
Regarding the assessment of the interests of data subjects, IMY takes into account the following.
Bonnier News AB has taken measures to minimise the number of data collected, implemented privacy-enhancing rules in segmentation, introduced rules of deletion and ensured that data collected from an affiliated company can only be used by that company. Thus, profiling takes place only on a company's "own visitors".
Furthermore, Bonnier News AB, through its integrity policy, informs about the processing.
What has been stated above must be weighted against the fact that the collection and profiling of simple behavioural profiles allows for the mapping of individuals through observed data that entails a greater infringement of privacy than when the data were collected through the involvement of the data subject. IMY considers that the privacy interest of data subjects is of great significance due to the nature of the data (the fact that special protection in LEK is given to the collection of the data). As IMY has already stated, Bonnier News AB should not have greater possibility than the affiliated companies to base their processing on legitimate interest than the affiliated companies which collected the personal data using cookies. Furthermore, IMY believes that when private individuals surfing behaviour is monitored to display personalised advertising, this can give the data subject the feeling of loss of control over their data and the feeling of being monitored. This may result in private individuals being affected in the choice of what they see on a website.
In conclusion, IMY considers because the processing enables profiling of individuals, that the data subject's privacy interest outweighs the interests of Bonnier News AB and affiliated companies when processing personal data in simple behavioural profiles
In light thereof, IMY notes that Bonnier News AB has processed personal data without having a lawful basis pursuant to Article 6(1) GDPR in order to profile the data subjects based on their behavioural data in so-called simple behavioural profiles and make the profiles available to affiliated companies for the purpose of displaying personalised advertisements.
### 3.6 Legal basis for processing for the purpose of making contact information available for telemarketing and postal direct marketing
### 3.6.1 Applicable provisions, etc.
In order to be able to rely on Article 6(1)(f) GDPR, as explained above, the three conditions set out in the article must be fulfilled. There must be a legitimate interest of the controller or of the third party to whom the data are disclosed, the processing of personal data must be necessary for the legitimate interest pursued and the interest of the data subject in the protection of his or her personal data must not prevail that of the controller.30
The Guidelines of the Article 29 Working Party and the EDPB on profiling and the application of Article 6 have been set out in Section 3.5.
30 Judgment of the Court of Justice of the European Union Fashion ID, C-40/17, EU:C:2019:629, para. 95.
22
### 3.6.2 Circumstances at issue and Bonnier News AB's position
Bonnier News AB has stated that it has coordinated its activities in order to achieve a better data base and enable the personal data of customers and users to be processed for specified purposes in a cost-effective and privacy-friendly manner. Bonnier News AB creates profiles on individuals in order to make contact information available for telemarketing and postal direct marketing. The profiling that this entails is partly based on data in KDB collected from affiliated companies during purchases and subscriptions (so-called customer engagements), and partly on data collected from Bisnode Sverige AB and, for a small part of the profiles, data from the behavioural database. Bonnier News AB relies its processing on Article 6(1)(f) GDPR.
# Legitimate interest
Bonnier News AB has stated that the affiliated companies have a legitimate interest in marketing their products and services in an efficient and privacy-friendly way.
# Necessary treatment
Bonnier News AB has stated that they together with the affiliated companies have taken steps to minimise the number of data collected, how long data is being processed and, in order to comply with the data minimisation principle, kept the databases separated and only transferred certain data. Furthermore, Bonnier News AB has taken steps to ensure that no more information than is needed is disclosed to the affiliated companies. At the time of disclosure, only the data points defined as necessary for the marketing channel indicated at the time of disclosure are provided, i.e. telephone numbers in a telemarketing campaigns and postal direct marketing address. The data points on which segmentation was based are not disclosed.
# Balancing of interests test
Bonnier News AB has stated the following.
Bonnier News AB's interest in making data available to affiliated companies based on the data subject's profile for the purpose of telemarketing and postal direct marketing outweighs the data subject's privacy interest.
By using the Group's existing resources for telemarketing and postal direct marketing, rather than buying the same information/resource from an external party, a cost saving is generated while allowing for a more controlled utilisation rate of addresses and phone numbers than would have been possible otherwise. The processing is also intended to save purchase costs.
Bonnier News AB, together with the affiliated companies, has taken steps to minimise the number of data collected, limit how long data is processed and in order to comply with the data minimisation principle, keep the databases separate. For the purposes of telemarketing and postal direct marketing, Bonnier News AB has limited the type of content tags generated by the data subject browsing on other companies' websites.31 Furthermore, a link between the databases could only be made with a small percentage of users.
31 Only tags categorised with IAB's taxonomy are collected.
23
Furthermore, within the framework of the cooperation, what is known as purpose-adapted schemes is applied. These regulate what information is disclosed from KDB. At the time of disclosure, only the data points defined as necessary for the marketing channel indicated at the time of disclosure are provided, such as telephone numbers in a telephone sales campaign and postal direct marketing address. The data points on which segmentation was based are not disclosed.
There is a possibility for the data subject to request deletion from the group common database. The data subject also has the right to object to the data being used for telemarketing and postal direct marketing.
The data subjects have a direct relationship with one or more affiliated companies. Users/customers have either visited an affiliated company's website, purchased products from an affiliated company or have an active digital subscription. Many of the customers are subscribers who have a long-term relationship with the company providing the service or product, and can therefore be considered to have a greater expectation that their data will be processed. Many readers have a strong commitment to their preferred type of news media. To some extent, customer profiles in KDB belong to unit-purchases such as literature, newspaper and goods purchases, where the relationship between customer and supplier may be considered somewhat less unique. Furthermore, the interaction is voluntary, clear information is provided and there are alternative products such as physical newspapers that private individuals can view completely anonymously.
According to Bonnier News AB, the processing is unlikely to have a negative impact on the data subject's interest.
The processing that takes place lies within the data subject's reasonable expectations because the individuals who come into contact with the companies do so out of free will in order to access content on websites, purchase services and/or products and the fact that they always have a customer/user relationship with one or more of the companies within the Group. Furthermore, the companies' integrity policy contains clear information about how customers' and users' personal data are processed and shared within the Group. The processing carried out within the framework of the KDB/behavioural database is closely associated with the companies' services and products, which should have an impact on the consumer's expectations. The fact that a group coordinates systems and central functions and, as a consequence, shares certain data for reasons of efficiency should not be unexpected for data subjects. Customers who have not signed up to the NIX register have a reasonable expectation that their contact details may be used for postal direct marketing or telemarketing. Consumers are accustomed to this type of marketing.
The Group common policy provides information about direct marketing and telemarketing. It shows that addresses and telephone numbers can be used by the Bonnier companies for direct marketing via mail and telephone sales through tele marketing. It also appears that the Bonnier companies can choose segments that they believe are relevant to the campaign in question, e.g. 'men in the age range 40-45 years living in the Stockholm area'. It also shows that Bonnier companies always respect NIX-blocks and whether someone has objected to the marketing.
### 3.6.3 IMY's assessment
IMY deals with the first two steps in the balancing of interests test jointly for the supplemented and simple behavioural profiles (sections 3.6.4 and 3.6.5). The third and
24
final steps are then dealt with separately for the supplemented behavioural profiles (section 3.6.6) and the simple behavioural profiles (section 3.6.7).
### 3.6.4 Legitimate interest
There is a commercial aspect to Bonnier News AB's interest in creating profiles to make the data available to affiliated companies in order for them to be used in tele marketing and postal direct marketing. IMY considers that the companies' interest is lawful, real and actually. In light thereof, IMY considers that the company's interest in creating profiles to make data available to affiliated companies in order to be used in tele marketing and postal direct marketing is legitimate.
### 3.6.5 Is the processing necessary for the legitimate interest?
The necessity requirement in Article 6(1)(f) of the GDPR must be examined in conjunction with the principle of data minimisation set out in Article 5.32 The purpose of the processing is to make contact information available to companies to use in tele marketing and postal direct marketing. The supervisory case has revealed that Bonnier News AB, together with the other companies, has taken steps to minimise the number of data collected and limit how long this data is processed, as well as to ensure that the databases in which the data are processed are kept separate and that only certain data are transferred in between. Furthermore, the company has ensured that no more information than what is necessary is disclosed to the affiliated companies in order to be used in tele marketing and postal direct marketing. In light thereof, IMY considers that the processing is necessary for the legitimate purpose.
### 3.6.6 Balance of interests for the processing of personal data in supplementary customer database profiles
Bonnier News AB has emphasised that the affiliated companies have an interest in marketing their products and services in an efficient and privacy-friendly manner. However, IMY points out that the interest in making data available for use in tele marketing and postal direct marketing is a commercial interest that does not weigh particularly heavily.
In the assessment of the interests of data subjects, IMY considers the following:
The profiling carried out on the supplemented customer database profiles includes data collected from affiliated companies during purchases and subscriptions (so-called customer engagements), data collection from Bisnode Sverige AB and data from the behavioural database (including data collected by the affiliated companies through cookies). IMY has already stated that Bonnier News AB should not have a greater possibility than the affiliated companies to rely on legitimate interest for the processing of personal data collected by the affiliated companies using cookies. The behavioural data of the data subject collected from the behavioural database to KDB is collected from the websites of different companies. IMY believes that data subjects cannot reasonably expect their behavioural data to be collected for marketing purposes just because they visit a website. Nor can reasonably expect their behavioural data to be combined with data from another purchase or collected data from other records for the purpose of being contacted for tele marketing or postal direct marketing. This does not change by the fact that the privacy-enhancing measure that the affiliates carrying out the marketing action do not have access to the collected behavioural data, but only contact details.
32 See judgment in Asociatia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48
25
The EDPB guidelines show that the scope of legitimate interest as a lawful basis for profiling depends on the level of detail of the profile, the size of the profile, the impact of profiling and the safeguards designed to ensure a fair, non-discriminatory and accurate profiling process.
IMY considers that the privacy interest of data subjects is strong due to the nature of the data, as the data enables the identification of individuals' behaviour and the collection of the data is given special protection in LEK.
IMY further points out that this is profiling within the meaning of Article 4(4) of the GDPR and that profiling is extensive as it provides in-depth insight on the data subject. There is also the fact that these are data collected from different websites combined with data collected from customer engagements and statistical data from Bisnode Sverige AB. In light thereof, IMY notes that the nature of the processing means that the privacy interest of the data subjects weighs heavily.
In conclusion, IMY considers that the data subject's privacy interest outweighs Bonnier News AB's and affiliated companies' interest in the processing of personal data that is based on so-called supplemented customer database profile and that is done in order to make contact information available to affiliated companies for tele marketing and postal marketing.
In light thereof, IMY points out that Bonnier News AB has processed personal data without having a lawful basis for doing so pursuant to Article 6(1) GDPR by profiling the data subjects based on their supplemented customer database profiles in order to make contact information available to affiliated companies for tele marketing and postal marketing.
### 3.6.7 Balance of interests for personal data not linked to the behavioural database
As IMY stated above in section 3.6.6, Bonnier News AB's interest is primarily a commercial interest that does not weigh particularly heavily.
As regards the assessment of data subjects' interests in processing operations unrelated to the behavioural database, IMY takes into account the following: Bonnier News AB has taken steps to minimise the number of data points both in relation to the principles of data minimisation and storage minimisation by not sharing data at object level, but only by product category, brand and type of packaging. Profiling also does not include data collected through cookies. The investigation has also shown that the data subject has been given the opportunity to object before the processing is conducted and that Bonnier News AB respects the data subjects' wishes to avoid marketing that has been noted in national block lists or with the controller. In light thereof, IMY considers that the processing is within what private individuals can reasonably expect from the information provided and that the contact information is disclosed only to affiliated companies within the Group.
In conclusion, IMY considers that the interests or fundamental rights of the data subjects do not outweigh the interests of Bonnier News AB and the affiliated companies for the processing in question.
In light thereof, IMY notes that Bonnier News AB can rely on Article 6(1)(f) of the GDPR for the processing in question.
26
### 3.7 Choice of corrective measure
#### 3.7.1 Applicable provisions etc.
In case of violations of the GDPR, IMY has a number of corrective powers, including reprimand, injunction and administrative fines. This follows from Article 58(2)(a) to (j) of the GDPR. IMY shall impose administrative fines in addition to or in place of other remedies referred to in Article 58(2), depending on the circumstances of each case.
If a controller or processor, with respect to one or the same or linked data processing operations, intentionally or negligently infringes several of the provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount determined for the most serious infringement. This is stated in Article 83(3) of the GDPR.
Each supervisory authority shall ensure that the imposition of administrative fines on a case-by-case basis is effective, proportionate and dissuasive. This is stated in Article 83(1) GDPR. Article 83(2) sets out the factors to be taken into account in order to determine whether an administrative pecuniary penalty is to be imposed and when assessing the amount of the fine.
The EDPB has adopted guidelines on the calculation of administrative fines under the GDPR aimed to create a harmonised methodology and principles for the calculation of fines.33
In the case of a minor infringement, according to Recital 148 of the GDPR, instead of imposing a fine, IMY may issue a reprimand under Article 58(2)(b).
#### 3.7.2 Same or interconnected data processing operations
In three cases above, IMY has assessed that Bonnier News AB had no lawful basis in Article 6(1) of the GDPR for its processing of personal data. IMY considers that these processing operations, all of which take place in the company's databases through profiling for marketing purposes, are linked within the meaning of Article 83(3) of the GDPR.
#### 3.7.3 Administrative fine
IMY has assessed that Bonnier News AB has infringed Article 6(1) of the General Data Protection Regulation in its processing of personal data that takes place for the purpose of displaying personalised advertisements and to make contact information available to affiliated companies for tele marketing and postal direct marketing. IMY does not consider these to be minor infringements. Bonnier News AB shall therefore be subject to an administrative fine for these infringements.
IMY notes that breaches of Article 6(1) of the GDPR fall within the scope of Article 83(5), which means that an administrative fine of up to 20 million EUR or 4 % of the global annual turnover in the previous financial year, whichever is the highest, may be imposed.
In determining the maximum amount of an administrative fine to be imposed on a company, the definition of 'company' used by the Court of Justice of the European Union for the purposes of Articles 101 and 102 TFEU (see recital 150 of the GDPR). It
33 EDPB Guidelines 8/2020 Guidelines 04/2022 on the calculation of administrative fines under the GDPR (adopted for public consultation on 12 May 2022).
27
is clear from the Court's case-law that this applies to any entity engaged in an economic activity, irrespective of its judicial form and the means in which it is financed, and even if, in the judicial sense, the entity consists of several natural or legal persons.34
IMY assesses that the company's turnover to be used as a basis for calculating the administrative fine imposed on Bonnier News AB is Bonnier News AB's parent company Albert Bonnier AB. The information gathered shows that Albert Bonnier AB's annual turnover in 2021 was 23 299 000 000 SEK. The maximum amount that can be determined for the administrative fine in the case is four per cent of this amount, i.e. approximately 931 960 000 SEK.
IMY considers that the following factors are relevant for the assessment of the gravity of the infringement.
There has been a matter of profiling of private individuals for profit when the profiling has been carried out in order to display personalised advertisements as well as when it has been used to provide contact details for tele marketing and postal marketing.
The profiling that has been used to show personalised ads has, in cases where data in the behavioural database about private individuals' browsing behaviour have been linked to KDB, included browsing history, purchase history and demographic and statistical data. It has been a matter of an ongoing infringement involving a large number of data subjects and covering a large amount of personal data. However, the data processed do not constitute, as far as IMY has found, special categories of personal data as set out in Article 9 of the GDPR. In this decision, IMY considered that the profiling through supplementary behavioural profiles was extensive in nature.
Regarding the profiling of personal data in KDB where there was a link to data in the behavioural database, so-called 'supplemented customer database profiles', IMY has assessed that the profiling was extensive in nature, since it contained data collected about the private individual's browsing behaviour collected from several websites combined with data from purchases made (customer engagement) and data collected from Bisnode Sverige AB. However, IMY makes the assessment that the personal data processing at issue does not have major privacy implications for the data subjects. The impacts are considered moderate.
In both cases, IMY considers that the profiling carried out where data could be linked in the two databases, supplementary behavioural profiles and the supplementary customer database profiles, has a higher degree of gravity compared to the infringement related to the profiling carried out in the so-called 'simple behavioural profiles' for displaying personalised advertisements. IMY considers that the profiling that takes place in the so-called simple behavioural profiles for displaying personalised advertisements in itself constitutes grounds for an administrative fine, but that it has a lower degree of gravity than the infringements where a link between the different databases could be made. The reasoning behind this is that there is lesser data regarding the data subjects and that the natural person only can be identified indirectly. However, IMY takes into consideration that this infringement also includes systematic processing which has been ongoing for a long period of time and concerned a large number of data subjects.
34 See judgment in Akzo Nobel, C-516/15, EU:C:2017:314, paragraph. 48
28
The measures taken by Bonnier to limit the infringement of the privacy of data subjects, in the form of retention periods, that data are not collected at product level, that no more data than necessary are disclosed to affiliated companies, have according to IMY, significantly reduced the gravity of the infringements. Also, the personal data has not been disclosed outside the Group. IMY has noted that Bonnier News AB has consistently taken steps to reduce the privacy infringement of the data subjects in its group common cooperation. This has also been taken into account when assessing the gravity of the infringements.
In the light of the above, IMY considers that all of these are infringements of lower seriousness. The starting point for the calculation of the administrative fine should therefore be low in relation to the current maximum amount.
In addition to the assessment of the gravity of the infringement, IMY must assess whether there are any aggravating or mitigating circumstances affecting the amount of the administrative fine. IMY considers that there are no additional aggravating or mitigating circumstances, other than those taken into account in the assessment of the seriousness above, which affect the amount of the fine.
In view of the gravity, aggravating and mitigating circumstances of the infringement and the high turnover in relation to the infringements found, IMY sets the administrative fine for Bonnier News AB at 13 000 000 SEK. IMY considers this amount to be effective, proportionate and dissuasive.
This decision has been taken by the Director-General [REDACTED] after a presentation by the lawyer [REDACTED]. In the final proceedings, the head of court [REDACTED] and the head of unit [REDACTED] also participated.
[REDACTED], 2023-06-26 (This is an electronic signature)
## How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy Protection. Indicate in the letter which decision you appeal and the change you request. The appeal must have been received by the Authority for Privacy Protection no later than three weeks from the day you received the decision. If the appeal has been received at the right time, the Authority for Privacy Protection will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain any privacy-sensitive personal data or information that may be covered by confidentiality. The authority's contact information is shown in the first page of the decision.