1(5)
Rusta AB
Swedish ref. number:
IMY-2022-2745 Final decision under the General Data
Norwegian ref. number: Protection Regulation – Rusta AB
20/03594
IMI case register:
355627
Date:
Decision of the Swedish Authority for Privacy
2024-08-23 Protection
The Swedish Authority for Privacy Protection (IMY) finds that Rusta AB (556280-2115)
has processed the complainant’s personal data in breach of:
• Article 17(1)(c) GDPR by not erasing the personal data of the complainant
after the complainant objected to the processing of his personal data for direct
marketing purposes in accordance with Article 21(2)
• Article 21(3) of the GDPR by not having ceased to process the complainant’s
personal data for direct marketing purposes following the complainant’s
objection to the processing.
IMY issues a reprimand to Rusta AB pursuant to 58(2)(b) of the GDPR.
Presentation of the supervisory case
Processing
IMY has initiated a supervision against Rusta AB (Rusta or the company) due to a
complaint. The complaint has been submitted to IMY as the lead supervisory authority
under Article 56 GDPR. The handover has been made by the supervisory authority of
the country where the complainant lodged his complaint (Norway) in accordance with
the Regulation’s provisions on cooperation in cross-border processing.
The case has been handled through a written procedure. In view of the cross-border
processing, IMY has made use of the cooperation and consistency mechanisms
provided for in Chapter VII of the GDPR. The concerned supervisory authorities have
been the data protection authorities of Norway, Finland and Denmark.
The complaint
The complainant essentially states that she received repeated text messages from
Rusta asking her to register as a member. On the basis of the text messages, the
complainant contacted Rusta by telephone and e-mail, and informed the company of
the mailings and asked them to remove her number from their system. Nevertheless,
the mailings have continued.
Rusta’s statement
Rusta essentially states the following. The company is the controller for the
processingnto which the complaint relates. The complainant contacted the company
on five occasions and requested erasure. The data has been deleted at all times.
Rusta only sends this type of communication to people who have actively chosen to
join Rusta's customer club (Club Rusta) by providing their mobile number when
purchasing from Rusta. If a person – after providing their mobile number – does not
complete their registration within 30 days, the mobile number is automatically deleted.
In addition to automatic deletion, Rusta has the option to manually delete the mobile
number from Rusta's system.
If someone contacts Rusta to be removed from mailings, Rusta's routine is that
personal data is deleted from Rusta's system. As shown in the supplier's description,
erasure means that Rusta stops processing the personal data and that Rusta does not
send any further communication. Since Rusta deleted the personal data of the data
subject on each occasion, the company has therefore ceased the processing of this
data for direct marketing purposes.
In order for someone, after erasure, to receive communication from Rusta, someone
must re-enter the mobile number when making a purchase at Rusta. This is possible
because Rusta does not retain any data after deletion. Rusta does not keep any
technical logs that show that erasure has occurred. However, Rusta has provided
messages from Rusta's customer service confirming erasure. Furthermore, the
employees who worked in Rusta's customer service at the time of the relevant
requests can confirm that the erasure took place.
The probable reason why the data subject has continued to receive mailings is that
someone has repeatedly provided the data subject's mobile number when purchasing
from Rusta. This may have been because someone mistakenly perceived that the
complainant's mobile number was their own, or intentionally used the complainant's
mobile number, for example to receive membership benefits without registering
themselves.
The reason why the data subject has received communication from Rusta (after
objection) is that the data subject's mobile number has been provided again when
purchasing from Rusta, not that Rusta has resumed communication based on existing
personal data. Rusta’s assessment has been that it is not in compliance with the
GDPR to create ‘block lists’ to prevent future communications. No reprimand should be
issued as it would be disproportionate.
Rusta has been given the opportunity to comment on IMY's draft decision.
Rusta has attached a description of the flow for registering and deleting contacts in the
system used by the company.
Motivation for the decision
The issue in the case
The examination in this supervision concerns whether Rusta has complied with the
complainant’s request to have its telephone number removed from the company’s
system to stop mailings. In this supervision, IMY has not taken a position on any
requirements to prevent future mailings.
Right to object to direct marketing
According to Article 21(2) of the GDPR, the data subject shall have the right to object
at any time to processing of personal data concerning him or her for direct marketing
purposes. Furthermore, as stated in the Article 21(3) of the GDPR, personal data shall
no longer be processed for such purposes if a data subject objects to the processing.
The investigation in the case shows that Rusta sent text messages to the complainant
with a link to confirm membership of the customer club. The mailings were sent via a
direct channel to the complainant from the company with information on how to
complete the registration to the customer club. IMY considers that this type of mailing
constitutes direct marketing since it is sent directly to the complainant for a commercial
purpose.1 Therefore, there has been a right for the complainant to object to this
processing of personal data under Article 21(2) GDPR.
On five separate occasions, the complainant asked Rusta to erase her number from
their system because she did not wish to receive text messages and also stated that
she had not registered with the customer club. The complainant has therefore
expressly requested erasure. The question, however, is whether her request for
erasure should also be considered to include an objection to direct marketing.
The European Data Protection Board (EDPB) Guidelines 01/2022 on the rights of data
subjects (right of access) state:
It should be noted that the GDPR does not introduce any formal requirements for
persons requesting access to data. In order to make the access request, it is sufficient
for the requesting persons to specify that they want to know what personal data
concerning them the controller processes. Therefore, the controller cannot refuse to
provide the data by referring to the lack of indication of the legal basis of the request,
especially to the lack of a specific reference to the right of access or to the GDPR.
[…]
It should be borne in mind that complainants may not be familiar with the intricacies of
the GDPR and that it is advisable to be lenient towards persons exercising their right of
access.2
IMY’s assessment is that the responsibility of the controller to give a broad
interpretation of persons exercising their rights applies to all rights under the GDPR,
not only to the right of access. It is therefore concluded that, even if the complainant
1 Judgment of the Court of Justice of the European Union of 25 November 2021, Case C-102/20, paragraph. 47.
2 EDPB Guidelines 01/2022 on data subject rights – Right of access, Version 2.0, (finally adopted on 28 March 2023),
para. 50.
has not expressly invoked Article 21, her letters should nevertheless be interpreted,
taking into account the circumstances, as an objection to direct marketing in
accordance with Article 21(2) GDPR. The complainant’s intention must, in the
circumstances of the case, be deemed to have been to object to the direct marketing.
The consequence for the controller when a data subject has objected to a processing
with the purpose of direct marketing is that the personal data shall no longer be
processed for such purposes. Rusta should therefore have ceased the processing of
the complainant’s personal data for direct marketing purposes when she made her first
objection. The complainant shall not have to repeat its objection on several occasions
in order for the company to cease the processing of personal data. However, the
investigation in the case shows that the complainant continued to receive text
messages from Rusta despite her objections and that the company therefore
continued to process the complainant’s personal data for direct marketing purposes.
IMY finds that Rusta has therefore acted in breach of Article 21(3) of the GDPR.
Right to erasure
According to Article 17(1)(c) GDPR, the data subject shall have the right to obtain from
the controller the erasure of personal data concerning him or her without undue delay
and the controller shall have the obligation to erase personal data without undue delay
if the data subject objects to the processing pursuant to Article 21(2).
The investigation in the case shows that on five separate occasions the complainant
contacted Rusta and requested the company to erase her phone number. As noted
above, and for reasons set out therein, the complainant’s request for erasure must be
considered to include an objection pursuant to Article 21(2) GDPR.
Rusta states that on all five occasions the company erased the complainant’s
telephone number within 24 hours. However, the investigation in the case shows that
the complainant has continued to receive text messages from Rusta despite the fact
that the erasure of the complainant’s telephone number is said to have taken place.
IMY considers that the explanation given by Rusta as to why the complainant
continued to receive text messages, specifically that incorrect numbers may have been
provided by another customer at the checkout, or that employees at the checkout may
have accidentally entered an incorrect number, does not appear likely. If that where
the case, the error must have occurred on five separate occasions. Instead, according
to IMY, it is clear from the circumstances of the case that Rusta has not been able to
completely fulfil the complainant’s right to erasure. IMY finds that Rusta has therefore
acted in breach of Article 17(1)(c) of the GDPR.
Summary
In summary, IMY notes that the investigation in the case shows that Rusta processed
the complainant’s personal data in breach of Article 17(1)(c) of the GDPR by not
erasing the complainant’s personal data following the complainant’s objections under
Article 21(2) and that Rusta processed the complainant’s personal data in breach of
Article 21(3) of the GDPR by not having ceased to process the complainant’s personal
data for direct marketing purposes following her objections to the processing.
Choice of corrective measure
According to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances of the case need to be taken into consideration. These could include
the nature, gravity and duration of the infringement as well as past infringements of
relevance.
IMY notes the following relevant facts. The current supervision includes an
examination of how Rusta has handled one person’s request for erasure and
objection. IMY finds that Rusta has failed to fulfil its obligations under those rights
towards the complainant. Rusta has however taken measures, even if they prove to be
insufficient, in order to comply with the complainant’s request for erasure and
objection. The present deficiencies are therefore of a less serious nature than if the
request had been completely disregarded. Rusta has also stated that they have an
ongoing investigation to review the possibility of blocking phone numbers from being
registered, or receiving SMS mailings. The company has not previously been found to
have infringed the General Data Protection Regulation.
Against this background, IMY considers that these breaches are minor infringements
within the meaning of recital 148 and that Rusta AB is to be given a reprimand
pursuant to Article 58(2)(b) of the GDPR.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.