1(3)
Bravida Holding AB
[email protected]
Diarienummer:
DI-2022-1683 Decision following supervision
IMI-nummer: pursuant to the General Data
CR 152180
Datum:
Protection Regulation – Bravida
2024-01-30
Holding AB
Decision of the Data Protection Authority
The case is written off from further supervision
Presentation of the supervisory case
The Swedish Data Protection Authority (IMY) initiated supervision of Bravida Holding
AB (the parent company) following two complaints. The complaints has been handed
over from the Norwegian Data Protection Authority.
The parent company received the supervisory description with the complaints and was
given the opportunity to give its opinion in the matter on the 17th of april 2022. Bravida
Holding AB responded on the 4th of April 2022 that the mother company is not
controller of the personal data processing that is described in the complaints. On the
27th of may 2022, the first draft was shared with the Norwegian SA as concerned SA,
in accordance with article 60.3 of the general data protection regulation. On June 11th
2022 the Norwegian SA expressed opinions against IMY’s draft decision.
In its opinion the Norwegian SA stated, inter alia, that Bravida Holding AB on the 4th of
April had stated that the group common policy for credit controls that applies within the
Bravida group of companies and that this system for credit controls also applies in
Sweden and Norway. The group common policy, which has probably been established
by the head office of Bravida Holding AB in Sweden, has a significant and real impact
on the processing of personal data of the data subjects in Norway.
The parent company was given an opportunity to give its opinion on the Norwegian
Postadress: SA’s comments on June 22th 2022. On June 30th 2022 IMY submitted additional
Box 8114 questions in order to clarify which of the companies within the group of companies that
104 20 Stockholm decides the purpose and means of the processing which were subject of the
Webbplats: complaints.
www.imy.se
E-post: Bravida Holding AB have essentially stated the following. The parent company is not
[email protected] controller of the processing of personal data subject to the complaints. In order to
Telefon: minimise loss of customers, a general common policy for credit processes within the
08-657 61 00
Integritetsskyddsmyndigheten Diarienummer: DI-2022-1683 2(3)
Datum: 2024-01-30
Bravida group of companies has been established, in which it is stated that an
assessment of credit worthiness must be done before entering into agreements with
new customers in some cases. Bravida Norway AS (the affiliate) have conducted an
assessment of the credit worthiness of the complainant (complaint no. 1) in
accordance with the affiliates own routines for on-boarding of new customers (“4.2
Opprettelse av kunder”) and by mistake, Bravida Norway AS employees have
conducted an assessment of the credit worthiness of the complainants unincorporated
partnership (complaint no. 2). The local routine describes, inter alia, how assessments
of credit worthiness are to be made by Bravida Norway AS employees as well as how
private individuals shall be informed before the assessment is made. Bravida Norway
AS routine for credit controls is based on the content in the affiliates own integrity
policy (“personvernerklæring”). The assessments were thus conducted solely on
behalf of Bravida Norway AS according to national legislation on credit information.
The complainants personal data have been processed solely within the framework of
Bravida Norway AS operations and for the affiliates own purposes in connection with
providing the service, assessment of credit worthiness, invoicing and communication
with the complainants. The personal data regarding the complainants have been
stored in the group common system. The division of responsibility for the processing of
personal data regarding the complainants is regulated in a group common data
processing agreement and, according to said agreement, Bravida Holding AB acts as
processor on behalf of Bravida Norway AS.1
The handling of the complaint has been done through written correspondence. In light
of the routines for cross-border handling of complaints, IMY have used the
mechanisms for cooperation pursuant to chapter VII in the General Data Protection
Regulation. Denmark, Norway and Finland have been concerned supervisory
authorities.
Reason for the decision
Controller shall mean the same as in article 4.7 of the GDPR, a natural or legal person,
public authority, agency or other body which, alone or jointly with others, determines
the purposes and means of the processing of personal data; Controllership may stem
from Member State law.
According to article 4.23 of the GDPR, cross border processing means;
a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in the
Union where the controller or processor is established in more than one Member
State; or
b) processing of personal data which takes place in the context of the activities of a
single establishment of a controller or processor in the Union but which substantially
affects or is likely to substantially affect data subjects in more than one Member State.
Pursuant to article 56.1 of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried
1 Guidelines 07/2020 on the concepts of controller and processor in the GDPR, EDPB (07/2020), Adopted on 07 July
2021, 27 and 71.
Integritetsskyddsmyndigheten Diarienummer: DI-2022-1683 3(3)
Datum: 2024-01-30
out by that controller and handle complaints in accordance with the GDPR:s provisions
on cross border processing.
The existence of the group common credit assessment policy that establishes that an
assessment of credit worthiness under certain circumstances have to be made before
entering into new agreements points to some extent to the fact that Bravida Holding
AB have had a significant influence over the processing of personal data. On the
contrary, the investigation has shown that Bravida Holding AB only provided a
standard template for the integrity policy and that Bravida Norway AS have been
responsible for the decision making in deciding the purposes in the policy and the
routine and, have made adjustments in accordance with national law. In addition, the
processing of personal data has been conducted within the scope of Bravida Norway
AS operations for the purpose of providing services, conduct assessments of credit
worthiness, invoicing and communication with the complainants.
In its assessment of what has been known in the case, IMY finds that, and considering
the adjustments that have been made by the Norwegian company for the purpose of
following national legislation on credit information operations, that Bravida Holding AB
have not had a significant influence over the purposes of the processing that is
described in the complaints and cannot be regarded as controller of the processing of
personal data.
Because Bravida Norway AS is controller of the processing of personal data that is
subject to the complaints that the supervision is based on, as well as the fact that
Bravida Norway AS has its main establishment in Norway, it is IMY:s view that the
Norwegian SA should act as LSA in this matter and should handle the complaints in a
way it sees fit. IMY leaves the assessment on whether it is a national or cross border
case to the Norwegian SA.
IMY have responded to the Norwegian SA:s comments to the draft decision that has
been shared by giving an account of its point of view; that the Norwegian SA should
handle the complaints as it sees fit.
In summary, IMY notes that the complaints should be handled by the Norwegian SA
on the basis of the fact that the controller has its main establishment in Norway.
Against this background, IMY hands over all further handling of the complaints as well
as all relevant information from the investigation regarding Bravida Holding AB to the
Norwegian SA.
The supervisory case against Bravida Holding AB shall, against this background, the
written of from further handling.