1(3)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision 2023-
09-28, no. IMY-2023-8429. Only the Swedish version of the
decision is deemed authentic.
Diarienummer:
IMY-2023-8423
Decision under the General Data Protection
Datum:
Regulation – Resursforum Sverige AB
2023-10-31
Decision of the Privacy Protection Authority
The Privacy Protection Authority (IMY) notes that, on 15 July 2022, Resursforum
Sverige AB (556706-7607) has processed personal data in breach of Article 12(4) of
the GDPR1 by not informing the complainant of the reason why Resursforum Sverige
AB rejected the complainant’s request for rectification pursuant to Article 16 of the
Data ProtectionRegulation and by not providing the complainant with information about
its ability to lodge a complaint with the Responsible Supervisory Authority for judicial
review of the refusal.
IMY gives Resursforum Sverige AB a reprimand pursuant to Article 58(2)(b) GDPR for
breach of Article 12(4) GDPR.
Presentation of the supervisory case
IMY has initiated supervision against Resursforum Sverige AB in response to a
complaint.
The complaint shows, in essence, the following: The complainant requested
rectification of his personal data on 21 June 2022. On 15 July 2022, Resursforum
Sverige AB rejected the complainant’s request without justification. In connection with
the refusal, Resursforum Sverige AB has not provided information to the complainant
about the possibility of filing a complaint with the lead supervisory authority for judicial
review of the refusal.
In its opinion on 27 June 2023, Resursforum Sverige AB stated the following.
Resursforum Sverige AB has not informed the complainant of the reasons for the
refusal and of the right to lodge a complaint with the lead supervisory authority for
judicial review of the refusal. Resursforum Sverige AB has taken steps for new
routines regarding the handling of similar cases and wrote a non-conformity report.
Postadress:
The complaint has been submitted to IMY, as the lead supervisory authority under
Box 8114
104 20 Stockholm Article 56 GDPR, by the supervisory authority in Denmark where the complaint was
lodged. In view of the cross-border complaint, IMY has made use of the cooperation
Webbplats:
www.imy.se
E-post:
[email protected] 1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telefon: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: 2(3)
Datum: 2023-10-31
and consistency mechanisms provided for in Chapter VII of the GDPR. The
supervisory authority concerned has been the data protection authority in Denmark.
Statement of reasons for the decision
Legal Regulation
If the controller fails to act upon the data subject’s request, the controller shall without
delay and no later than one month after they received the request to inform the data
subject of the reasons for non-action and of the possibility of lodging a complaint with a
supervisory authority and requesting judicial review under Article 12(4) GDPR.
The Privacy Protection Authority’s assessment
Has there been a breach of the GDPR?
Resursforum Sverige AB states that it has not informed the complainant of the reasons
for rejecting the complainant’s request for rectification and of the possibility of lodging
a complaint with the lead supervisory authority for judicial review of the refusal. IMY
finds that Resursforum Sverige AB has thereby processed personal data in breach of
Article 12(4) of the GDPR.
Choice of intervention
According to Article 58(2)(i) and Article 83(2) of the GDPR IMY has the power to
impose administrative fines pursuant to Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to or in place of the other
measures referred to in Article 58(2), such as injunctions and prohibitions. In addition,
it is clear from Article 83(2) which factors must be taken into account when imposing
administrative fines and in determining the amount of the fine. In the case of a minor
infringement, the IMY may, as stated in recital 148, instead of imposing a pecuniary
penalty, issue a reprimand under Article 58(2)(b). Account must be taken of
aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement and previous relevant infringements.
IMY notes the following relevant circumstances. The violations have occurred to a
single data subject. Resursforum Sverige AB has stated that it has taken measures for
new procedures for handling similar cases. Resursforum Sverige AB has not
previously received any corrective action for breach of the General Data Protection
Regulation. In those circumstances, IMY considers that there are such minor
infringements within the meaning of recital 148 and that it is therefore appropriate to
refrain from imposing a fine on Resursforum Sverige AB for the infringements found.
IMY gives Resursforum Sverige AB a reprimand pursuant to Article 58(2)(b) GDPR for
breach of Article 12(4) GDPR.
This decision was taken by Head of Unit following a presentation
by .
, 2023-10-31 (This is an electronic signature)
Integritetsskyddsmyndigheten Diarienummer: 3(3)
Datum: 2023-10-31
How to appeal
If you want to appeal the decision, write to the Privacy Protection Authority. Please
indicate in the letter the decision you are appealing and the amendment you are
requesting. The appeal must have been received by the Swedish Integrity Protection
Authority no later than three weeks from the date on which you received the decision.
If the appeal has been received in due time, the Swedish Integrity Protection Authority
will forward it to the Administrative Court in Stockholm.
You can e-mail the appeal to the Privacy Protection Authority if it does not contain any
privacy-sensitive personal data or information that may be covered by confidentiality.
The authority’s contact details are shown in the first page of the decision.