1(2)
COMPLAINANT
See Appendix
SUBJECT OF THE SUPERVISION
iPiccolo
[email protected]
Ref no:
DI-2021-10530 Decision after supervision under the
Date: GDPR- iPiccolo
2024-03-26
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) closes the case.
Presentation of the supervisory case
IMY has initiated supervision of iPiccolo AB (iPiccolo or the company) in response to
three complaints. This decision concerns one of these complaints. A decision
concerning the other complaints is taken separately.
The complaint in question has been submitted to IMY as the lead supervisory authority
under Article 56 GDPR1. The handover took place from the supervisory authority of the
country where the complainant lodged his complaint (Finland under national reference
number ) in accordance with the Regulation’s provisions on cooperation in
cross-border processing.
The proceedings at IMY have been carried out by exchange of letters. In view of
complaints concerning cross-border processing, IMY has made use of the cooperation
and consistency mechanisms provided for in Chapter VII of the GDPR. The relevant
supervisory authorities have been the data protection authorities of Germany, Austria,
Norway, Finland, Denmark, the Netherlands, Belgium and Italy.
Statement of reasons for the decision
It follows from Article 57(1)(f) of the GDPR that IMY shall deal with complaints from
data subjects who consider that their personal data are being processed in a manner
contrary to the Regulation. It also follows from that provision that, where appropriate,
IMY must examine the subject matter of the complaint. The CJEU has ruled that the
Postal address: supervisory authority must investigate such complaints with due care.
Box 8114
104 20 Stockholm
According to the 23 § of the Administrative Procedure Act (2017:900), an authority
Website: must ensure that a case is investigated to the extent required by its nature.
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Phone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority for Privacy Protection Our ref: DI-2021-10530 2(2)
Date:2024-03-26
It is apparent from the complaint that, on 20 May 2018, the complainant contacted the
company with a request for access in order to be able to take a position on a potential
future request for erasure. The company replied to the complainant on 22-23 May
2018 that the complainant needs to submit a written, signed request and send a copy
of their identity card, passport, ID card number or other identification document in
order to obtain access to its personal data. The complaint does not indicate the date
on which the complainant made a request for access to the company. The company
replied to the complainant’s request on 23 May 2018. It has not been established that
the complainant has been in contact with the company after 25 May 2018 to challenge
the previous request or to make a new one.
IMY contacted the company with questions regarding, inter alia, when it received the
complainant’s request for access and whether they had any contact with the company
after 25 May 2018. The company stated in their reply to IMY on 26 October 2022 that it
cannot track the date of receipt of the request as its customer service system
automatically deletes cases after 2 years. They are therefore also unable to trace
whether they had had any contact with the complainant after 25 May 2018, but can
confirm that they did not have a case with the complainant after 26 October 2020 until
the company replied to IMY.
IMY, which has investigated the matter to the extent required by Article 57(1)(f) of the
GDPR and 23 § of the Administrative Procedure Act, cannot conclude that the
complaint falls within the scope of the GDPR.
The case is closed.
This decision has been made by the head of unit after presentation
by the legal advisor .
Appendix: The complainant’s personal data