1(3)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection’s draft
decision.
COMPLAINANT
See appendix
Swedish ref no:
DATA CONTROLLER
IMY-2023-15896
Scandinavian Airlines System AB
Nat.ref.no
2023-31-7819
IMI case register:
580527 Final decision under the General Data
Date of the decision:
2024-07-31 Protection Regulation – Scandinavian
Airlines System AB
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection (IMY) finds that Scandinavian Airlines
System AB has processed personal data in breach of Article 12 (3) of the General
Data Protection Regulation (GDPR)1 by not having accommodated the complainant´s
request for erasure made on the 1 September 2019 without undue delay, and first on
15 June 2023.
The Swedish Authority for Privacy Protection issues a reprimand to Scandinavian
Airlines System AB pursuant to Article 58(2)(b) of the GDPR for the infringement of
Article 12(3) of the GDPR.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision against
Scandinavian Airlines System AB (SAS) due to a complaint. The complainant has
been submitted to IMY, as the lead supervisory authority under Article 56 of the
GDPR, by the supervisory authority of the country (Denmark) in which the complainant
lodged its complain in accordance with the Regulation´s provisions on cooperation in
cross-border processing.
Since it is a cross-border complaint, IMY has made use of the mechanisms got
cooperation and consistency of the GDPR. The supervisory authorities concerned
have been the data protection authorities in Denmark, Netherlands, Belgium, Estonia,
Postal address:
France, Norway, Germany (Bayern, Berlin, Hesse) and Ireland.
Box 8114
104 20 Stockholm
The complainant has stated the following. The complainant requested access to his
Website:
www.imy.se personal data on 1st September 2019. The complainant received an email from SAS
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-15892 2(3)
Datum: 2024-07-31
that the request will be complied within 30 days. The complainant´s request was
complied with on the 15th June 2023.
SAS has stated the following. SAS received the complainant’s request for access on 1
September 2019. As of September 6, 2019, SAS systems that manage data subjects’
rights and access to information (“Privacy App”), have collected all necessary data.
Normally, the Privacy App sends an email to the individual who requested their
information, but in this specific case the email function in the system was not working.
Only one data subject, the complainant in this case, was affected by this. In 2023, the
Privacy App was updated and changes were made to the email function, which is the
reason that the system sent the delayed response to the complainant. SAS had no
knowledge that the complainant had not previously received a response from the
Privacy App.
Since May 2018, the Privacy App has produced information about 1,300 times, and
SAS review the functionality and process of this procedure at least once a year. This is
the first time that this technical bug has been found in the Privacy App, and this bug is
now fixed.
SAS believes that they have handled the request from the data subject on time, but
that unfortunately there was a technical bug in the Privacy App that SAS did not know
about at the time, which meant that the email response to the complainant (that SAS
had no information about the complainant) got stuck in the Privacy App.
The complainant has been given the opportunity to comment on the material but has
not been heard.
Applicable provisions, etc.
It follows from Article 57(1)(f) of the GDPR that IMY shall handle complaints lodged by
a data subject who consider that their personal data is being processed in a manner
contrary to the Regulation and investigate, to the extent appropriate, the subject matter
of the complaint. The Court of Justice of the European Union has ruled that the
supervisory authority must investigate such complaints with due care.2
Pursuant to Article 15 of the GDPR, a data subject has the right to obtain from the
controller confirmation as to whether or not personal data relating to him or her are
being processed and, if so, access to the personal data and certain information.
Pursuant to Article 12(3) of the GDPR, upon request, the controller shall provide the
data subject, without delay and in any event no later than within one month of receipt
of the request, with information on the measures taken pursuant to, inter alia, Article
15 of the GDPR. That period may be extended by two months further, if necessary,
considering the complexity of the request and number of requests received. The
controller shall inform the data subject of such an extension within one month of
receipt of the request and shall state the reasons for the delay.
Assessment of IMY
It appears from the investigation that the parties agree that the complainants request
for access was complied with more than one month after the request was received. It
does not appear that the request was of a particularly complex nature. Nor is it
2 Schrems II, C-311/18, EU:C:2020:559, p. 109.
Page 2 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-15892 3(3)
Datum: 2024-07-31
apparent that SAS informed the applicant of the delay in accordance with Article 12(3)
of the GDPR. IMY therefore takes the view that SAS failed to fulfil their obligation
under Article 12(3) of the GDPR in that they did not comply with the complainants
request to access on the 1 September 2019 until the 15 June 2023.
Choice of corrective measure
It follows from Article 58(2) and Article 83(2) of the GDPR that the IMY has the power
to impose administrative fines pursuant to Article 83 of the GDPR.
In the case of a minor infringement, the IMY may, as stated in recital 148 of the GDPR,
instead of imposing a pecuniary penalty, issue a reprimand pursuant to Article 58(2)(b)
of the GDPR. Account must be taken of aggravating and mitigating circumstances of
the case, such as the nature, severity and duration of the infringement as well as
previous relevant infringements.
IMY notes the following relevant circumstances. The supervision covers SAS handling
of an individual complainants request for access to his personal data. The infringement
in question has affected one person and has occurred due to a temporary system
problem at SAS. The company states that this is the first time that the technical bug
occurred and that it has now been fixed. Against that background, IMY considers the
infringement to be minor within the meaning of recital 148 and that Scandinavian
Airlines Systems AB should be issued a reprimand under Article 58(2)(b) of the
GDPR.3
This decision has been made by specially appointed decision-maker, legal advisor
after presentation by legal advisor .
Appendix
The complainant’s personal data
3 EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR (finally adopted on 24 May
2023).
Page 3 of 3