1(6)
CDON AB
201 23 Malmö
Registration number:
DI-2019-12014 Decision pursuant to Article 60 under
the General Data Protection
Date:
2024-06-20
Regulation – CDON AB
Decision of the Privacy Protection Authority
The Swedish Data Protection Authority notes that during the period 28 October to 1
November 2019, CDON AB provided incorrect information on the basis of the legal
basis for the processing of personal data in question. In its processing of personal
data, CDON has therefore failed to fulfil its obligation under Article 13(1)(c) of the
GDPR1.
The Swedish Data Protection Authority decides to reprimand CDON AB pursuant to
Article 58(2)(b) GDPR for this deficiency.
The Privacy Protection Authority writes off the supervision in so far as it relates to
processing on the basis of consent pursuant to Article 6(1)(a) GDPR.
Presentation of the supervisory case
Handling of the case
In June 2019, the Swedish Data Protection Authority (‘IMY’) initiated an examination of
how several companies used consent to collect customer data. As part of this, on 28
October 2019, IMY initiated by own volition a supervision of CDON AB (‘CDON’), in
order to examine whether the consents obtained by CDON comply with the GDPR’s
requirements for voluntary, information and clarity in accordance with Articles 5(1)(a),
6-7 and 13(1)(c) of the GDPR. The Supervision was initiated on IMY’s own initiative
due to the fact that consent as a legal basis was a priority area under the Authority’s
supervisory plan 2019/2020.
IMY has not taken a position on whether CDON AB’s personal data processing is
Postal address: otherwise in compliance with the General Data Protection Regulation.
Box 8114
104 20 Stockholm
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Registration number: DI-2019-12014 2(6)
Date: 2024-06-20
The proceedings at IMY have been carried out by exchange of letters. IMY has also
taken note of CDON’s data protection information published on the company’s
Swedish website (https://cdon.se/).
Checkboxes on the website and when registering members
At the start of the supervision, CDON had checkboxes on its website where CDON
stated, among other things, that the data subject gave its consent to CDON sending
newsletters, discount codes and other offers to the data subject, thus processing
personal data in accordance with the CDON’s privacy policy. Furthermore, CDON
described in its privacy policy that the company used the legal basis of consent for
several purposes, such as that the customer, by becoming a member of CDON’s
customer club, consented to CDON analysing the customer’s personal data and
conducting profiling for direct marketing (mail, email and SMS) as well as for customer
surveys. In its membership terms, CDON further stated that, by becoming a member of
the Customer Club, the data subjects agree that CDON will process their personal
data, and, among other things, transfer them to countries outside the EEA. After IMY
put questions to CDON when IMY sent the supervisory letter to it, CDON replied in its
first reply on 18 November 2019 to IMY’s supervisory letter that the legal basis for
membership of the customer club was not consent.
Other consents obtained
During the exchange of letters, IMY put questions to CDON regarding the purposes for
which CDON used the legal basis of consent under Article 6(1)(a) GDPR. CDON
replied on 18 November 2019 that it used consent under Article 6(1)(a) for the analysis
of statistics, personalisation and marketing using so-called cookies and similar storage
technologies.
Later during the supervision, CDON changed their information concerning the legal
basis it used for the above mentioned processing operations. On 11 March 2020,
CDON informed IMY that the consent obtained by CDON for the analysis of statistics,
personalisation and marketing using the cookie tool was obtained in accordance with
the Electronic Communications Act (2022:482) and thus did not refer to consent for the
processing of personal data under the GDPR.
Statement of reasons for the decision
Personal Data Responsibility
CDON AB has replied that they are the sole data controller for the processing of
personal data that takes place in connection with the member registration. IMY has
found no reason to call this into question.
Processing based on consent
One of IMY’s objectives in carrying out the supervision was to examine whether the
legal basis was clear to the data subjects (cf. IMY’s initial supervisory letter). The legal
basis gives the data subjects certain rights. When a data controller obtains consent
from a data subject, this imposes specific requirements on the information to be
provided, and that personal data are provided voluntarily (cf. Article 4.11 and Article 7
GDPR). Furthermore, consent means that the data subject has special rights, such as
the right to withdraw that consent under Article 7(3) of the GDPR.
Privacy Protection Authority Registration number: DI-2019-12014 3(6)
Date: 2024-06-20
IMY has put questions to CDON regarding the purposes for which the company relies
on consent as a legal basis and how to obtain consent.
In its written reply of 18 November 2019, CDON stated, that it used the legal basis of
consent under 6.1.a GDPR for the purposes of analysis and statistics, personalisation,
marketing and competitions. With regard to the consent process, CDON provided
screens of consent collected through a so-called “cookie tool”.
In its response of 11 March 2020, CDON stated that it used consent only as a legal
basis for the organisation of competitions by CDON and that no competitions had been
organised. For other processing operations (analysis of statistics, personalisation and
marketing), the company stated that they collected consents under the Electronic
Communications2Act and that CDON used in its further processing a different legal
basis in Article 6 of the GDPR.
During the exchange of letters with IMY, CDON changed its position regarding the
legal basis it uses. Since it has thus become apparent that the company does not
support its processing on the legal basis consent, and since the purpose of supervision
was to examine how consent was obtained, not whether CDON’s processing is
supported by a legal basis under Article 6(1) of the GDPR, the purpose of the
supervision has expired in that respect.
Therefore, IMY writes off the supervision in the part that intends to review the
collection of consents and the review of consent as a legal basis pursuant to Article
6(1)(a) GDPR.
Information to data subjects
IMY has to consider whether CDON has fulfilled its obligation to provide information to
data subjects under Article 13. According to IMY, the issue should be assessed in the
light of the principle of transparency set out in Article 5 of the GDPR.
Applicable provisions
It follows from Article 5 of the GDPR that personal data must be processed in a
transparent manner in relation to the data subject (principle of transparency).3
According to Article 13(1)(c) of the GDPR, where personal data are collected from the
data subject, the controller must inform the data subject of the legal basis for the
processing.
The legal bases are set out in Article 6 of the GDPR. Article 6(1)(a) specifies that
processing is lawful if the data subject has given his consent to the processing of his or
her personal data for one or more specific purposes.
The Article 29 Working Party’s Guidelines on Transparency under the GDPR (which, in
the context of the introduction of the GDPR, were formally adopted by the EDPB)
state, inter alia, that the principle of transparency is an overarching obligation to apply,
3 See recital 39, which states that the principle of transparency requires that all information and communication
relating to the processing of such personal data is easily accessible and understandable and that clear and clear
language is used. That principle applies in particular to the information to data subjects on the identity of the controller
and the purpose of the processing, as well as additional information to ensure fair and transparent processing for the
natural persons concerned and their right to receive confirmation and notification of the personal data relating to them
being processed.
Privacy Protection Authority Registration number: DI-2019-12014 4(6)
Date: 2024-06-20
inter alia, to the question of how a controller facilitates the exercise of their rights by
data subjects.4 The guidelines also state that the information should be concrete and
precise, and that it should not be ambiguous or leave room for different interpretations.
In particular, the guidelines state that information on the purpose of the processing and
the legal basis should be clearly stated.5 This requirement is intended to ensure that
data subjects, in exercising their rights, have a substantial opportunity to exercise
them, and that the controllers can be held responsible for the processing of the
personal data of the data subjects.6
At the start of the supervision on 28 October 2019, the following information was
available to the data subjects on the CDON website.
Checkboxes on the CDON website
The opening of the supervision in October 2019 showed the following on the CDON
website. A text box with the text “I hereby agree that CDON AB sends me newsletters,
discount codes and other offers and that CDON in connection with this process
processes my personal data in accordance with CDON AB’s Privacy Policy”. On the
website there was also a check box with the text "I have taken note of and understood
CDON AB’s General Terms and Conditions and Privacy Policy. By becoming a
member of CDON AB’s customer club, I agree that CDON AB analyses my personal
data in order to offer me relevant and customised information and marketing for
CDON.
In its correspondence with IMY, CDON stated that the wording in question was not
intended to obtain consent and that it should therefore be reviewed.
CDON Privacy Policy
In the CDON Privacy Policy to which the data subject was linked through the
checkboxes, CDON stated, among other things, that “By becoming a member of our
customer club, you agree that we analyse your personal data and carry out profiling for
direct marketing (by mail, email and SMS) and customer surveys”.
Under the section “Why do we process your personal data?” CDON has stated in the
sub-heading “Consent to processing” that “Consent may be needed for certain direct
marketing (by post, email and SMS), customer surveys, etc. that are provided by
changing preferences on my pages or making choices when registering”. Further,
CDON has stated in its privacy policy under the same section that "If any processing
requires your consent, we will always explicitly ask you to give your consent to such
processing and to us processing your personal data in such a case. For example, we
request your consent if you want to become a member of CDON’s customer club and
you always have the opportunity to withdraw consent, for example through the cookie
tool. In connection with your consent, you will be able to confirm that you have read
this Privacy Policy and that you consent to the processing of your data as described
herein.
4 Article 29 Working Party, Transparency Guidelines under Regulation (EU) 2016/679, WP260rev01, last reviewed
and adopted on 11 April 2018, p. 1.
5 Ibid p. 11-12.
6 Ibid p. 55.
Privacy Protection Authority Registration number: DI-2019-12014 5(6)
Date: 2024-06-20
Under the section “Processing of customer club members’ personal data”, CDON
states, among other things, the following.
“Profiling: based on the consent given in connection with the newsletter and
application for membership of our customer club, we compile the information about
customers’ buying habits and interests that we collect in order to profile customers in
different segments in order to provide relevant and customised information and
marketing for CDON.
“Consent: By becoming a member of our customer club, you agree that we analyse
your personal data and carry out profiling for direct marketing (by post, email and
SMS) and customer surveys.
CDON Membership Terms and Conditions “CDON Club”
The CDON Membership Terms, which are a combined document together with the
Privacy Policy, include the following under the section “Processing personal data”:
» By becoming a member of the Customer Club, you consent to the processing of your
personal data in accordance with these membership terms. For more information
about how CDON processes your personal data, please read our Privacy Policy.
The section entitled “Consent to the processing of personal data” states the following.
» By becoming a member of the Customer Club, you agree that CDON will process
your personal data in accordance with these terms and conditions. The consent thus
includes, among other things, the transfer of your personal data to countries outside
the EEA.’
IMY notes that the information provided in connection with data subjects’ visits to the
website, as well as in the policies and general terms and conditions linked to, has
provided the data subject with incorrect information about the legal basis on which
CDON processed the data subjects’ personal data.
Therefore, by stating an incorrect legal basis to the data subjects – and thus not
informing the data subjects on what legal basis CDON legitimately based the
processing in question – CDON has failed to fulfil its obligation under Article 13(1)(c) of
the GDPR.
Choice of intervention
The last question that IMY has to consider is the action to be taken in response to the
infringement.
In case of breaches of the GDPR, IMY has a number of corrective powers, including
reprimand, injunction and fines. This follows from Article 58(2)(a) to (j) of the GDPR.
According to Recital 129 of the GDPR, IMY shall take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the
power to impose administrative fines pursuant to Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
Privacy Protection Authority Registration number: DI-2019-12014 6(6)
Date: 2024-06-20
prohibitions. In the case of a minor infringement, the IMY may, as stated in recital 148
of the GDPR, instead of imposing a pecuniary penalty, issue a reprimand pursuant to
Article 58(2)(b). Account must be taken of aggravating and mitigating circumstances of
the case, such as the nature, severity and duration of the infringement as well as
previous relevant infringements.
IMY notes the following relevant circumstances for the choice of intervention. The
shortcoming of CDON’s obligation to provide information to the data subjects may be
considered to be serious, since it is a direct misstatement of the legal basis for the
collection of personal data and because the incorrect information has been found in
several different locations. However, there are also circumstances that speak in an
attenuating direction. There has been no processing of sensitive personal data. The
impact on data subjects may be considered to have been limited. At the time of the
start of the supervision, there was no practice regarding the distinction between
consent under the Electronic Communications Act and the General Data Protection
Regulation. The review also shows that the Privacy Policy has been updated since the
beginning of the supervision, and CDON has stated that it has reviewed and improved
its work.
In an overall assessment of the circumstances of the case, IMY assesses that there is
a minor breach as referred to in recital 148 of the GDPR. The company must therefore
be given a reprimand pursuant to Article 58(2)(b) of the GDPR. IMY considers this
measure to be appropriate, necessary and proportionate to ensure compliance with
the GDPR.