1(4)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision 2024-
07-29, no. IMY-2023-16127. Only the Swedish version of
the decision is deemed authentic.
Diarienummer:
IMY-2023-16127 Final decision pursuant to Article 60
Ref no: under the General Data Protection
IMY-2023-16127
IMI case no CR 595291 Regulation – Ellos Group AB and
Date of translation :
Ellos Group Sweden AB
2024-07-29
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection finds that Ellos Group Sweden AB in its
handling of the complainant’s request for access made on 25 August 2020 has
processed personal data in breach of Article Article 12(3) of the GDPR by failing to
comply with the complainant’s right of access under Article 15 of the GDPR without
undue delay.
The Swedish Authority for Privacy Protection closes the part of the supervision that
has been directed at Ellos Group AB.
Presentation of the supervisory case
IMY has received a complaint against Ellos from the Danish Supervisory Authority
(Datatilsynet) in accordance with the provisions on the competence of the lead
supervisory authority in Article 56 GDPR.
The case has been handled through written procedure. In the light of the complaint
relating to cross-border processing, IMY has used the mechanisms for cooperation
and consistency contained in Chapter VII of the GDPR. The supervisory authority
concerned have been the data protection authority in Denmark.
The deficiency in question alleged in the complaint is that the complainant did not
obtain access to its data in a timely manner and that the copy of the data was not
complete.
IMY initiated supervision and sent our questions to Ellos Group AB.
Postadress:
Box 8114 Ellos Group Sweden AB (through Ellos Data Protection Officer) submitted its
104 20 Stockholm comments on the matter, se the following.
Webbplats:
www.imy.se Ellos Group Sweden AB is the data controller for the processing of personal data
E-post: described in the complaint. The company received the applicant’s request for access
[email protected] by e-mail on 25 August 2020. Requests for access were received through a channel
Telefon: that normally handles other types of issues and is not monitored as regularly as the
08-657 61 00
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16127 2(4)
Datum: 2024-07-29
channels referred to for these types of requests. The complainant’s request was
therefore left unaddressed for a longer period than desirable and was not dealt with
within the time limit. The access request was handled by email on 22 December 2020.
On 24 December 2020, the complainant submitted a request for further information.
On 7 January 2021, Ellos Group Sweden AB informed the complainant that the
requested information was processed by Resurs Bank as data controller. Ellos Group
Sweden AB considers that the information provided to the complainant was complete.
The complainant, through the Danish supervisory authority, has been given the
opportunity to comment on Ellos Group Sweden AB’s reply, but has not submitted any
comments.
Statement of reasons for the decision
As defined in Article 4(7) of the GDPR, the controller is the person who alone or jointly
with others determines the purposes and means of the processing of personal data.
Ellos Group Sweden AB has stated that Ellos Group Sweden AB is the data controller
for the personal data processing to which the complaint relates and not Ellos Group
AB to which the first supervisory letter was addressed. Against this background, IMY
concludes that Ellos Group Sweden AB is the data controller for the current processing
of personal data, which is why the supervisory case directed against Ellos Group AB
hereby is closed.
The controller shall be obliged to inform any person who so requests whether or not
personal data relating to the applicant are being processed. Where such data are
processed, the controller shall, in accordance with Article 15 of the GDPR, provide the
data subject with supplementary information concerning, inter alia, the purposes of the
processing and the recipients of the data, as well as a copy of the personal data
processed by the controller.
The investigation in the case shows that Ellos Group Sweden AB received the
complainant’s first request for access on 25 August 2020 and that the complainant’s
request was complied with on 22 December 2020. IMY finds that Ellos Group Sweden
AB has processed the complainant’s personal data in breach of Article 12(3) of the
GDPR by failing to comply with the complainant’s request for access pursuant to
Article 15 of the GDPR without undue delay, or at the latest within one month.
The investigation also shows that the company received the applicant’s request for
additional information on 24 December 2020. Ellos Group Sweden AB has stated that
current data is processed by Resurs Bank and that the company provided information
about this to the complainant on 7 January 2021. The investigation has not revealed
any reason to question that Ellos Group Sweden AB is not the data controller for the
processing in question. In those circumstances, IMY finds that the investigation does
not show that the applicant’s personal data were processed in breach of Article 15 of
the GDPR.
Choice of corrective measure
Within the scope of the corrective powers, IMY shall take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.
It follows from Article 58(2) and Article 83(2) of the GDPR that IMY has the power to
impose administrative fines in accordance with Article 83 of that regulation. In the case
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16127 3(4)
Datum: 2024-07-29
of a minor infringement, IMY may, as stated in recital 148 of the GDPR, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Aggravating and
mitigating circumstances of the case, such as the nature, gravity and duration of the
infringement and previous relevant infringements, must be taken into account. In the
case of a minor infringement, IMY may, as stated in recital 148, instead of imposing a
fine, issue a reprimand pursuant to Article 58(2)(b). Account needs to be taken to the
aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement as well as past infringements of relevance.
IMY notes the following relevant facts. The current supervision covers Ellos Group
Sweden AB's handling of an individual complainant's request for access in the light of
the requirements set out in Article 12(3) of the GDPR. In doing so, IMY has found that
Ellos Group Sweden AB has failed to fulfil its obligations to fulfil the right in time. The
prescribed time limit of a maximum of one month has been exceeded by just under
three months. However, the applicant’s right of access has been granted. The
deficiencies found are therefore of a less serious nature than if the request had been
left unanswered. In addition, the request had already been accommodated long before
IMY contacted Ellos Group Sweden AB with questions about the complaint in question.
Furthermore, the infringement was not intentional.
On an overall assessment of the circumstances of the infringement found, IMY
concludes that there is no need to use the corrective powers in the present case.
The case should therefore be closed.
_____________________________
, 2024-07-29
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16127 4(4)
Datum: 2024-07-29
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.