Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s final decision. Only the Swedish version is authentic. 1(6)
COMPLAINANT
See appendix
CONTROLLER
Warner Music Sweden AB
Swedish ref.:
IMY-2023-16448 Final decision under the General Data
National ref: Protection Regulation – Warner Music
D130.870
IMI case register:
Sweden AB
388187
Date:
2024-10-04
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Warner Music Sweden
AB (Warner Music) (556055-2605) has processed personal data in breach of Article 6
and 7.3 of the General Data Protection Regulation (GDPR)1 by not providing sufficient
information about the right to withdraw consent.
IMY issues a reprimand to Warner Music pursuant to Article 58(2)(b) of the GDPR.
Presentation of the supervisory case
IMY has initiated supervision regarding Warner Music due to a complaint. The
complaint is one of several complaints submitted to the European Data Protection
Authorities regarding cookies and cookie banners. The complaints mainly concern the
design of cookie banners, the placement of cookies and the subsequent processing of
personal data after the cookies have been placed on the complainant's browser or
device. To facilitate the cooperation on these complaints, a ‘Cookie Banner Taskforce’
was created within the European Data Protection Board.
In view of the cross-border nature of the processing, IMY has made use of the
cooperation and consistency mechanisms provided for in Chapter VII of the GDPR.
The supervisory authorities concerned have been the data protection authorities in
Austria and Italy.
The complainant has essentially stated the following. On 21 May 2021, Warner Music
processed the complainant’s personal data in breach of the GDPR because there was
Postal address:
no valid consent. Warner Music has not had a prominent option to withdraw the
Box 8114
104 20 Stockholm
consent in the same way as there is to give the consent. Not having an option to
Sweden withdraw that is as easy to find as the cookie banner, makes it not as easy to withdraw
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2023-16448 2(6)
for Privacy Protection Date: 2024-10-04
consent as to give it. Warner Music´s information about the use of cookies on the
website (in a so-called cookie banner) has been attached to the complaint.
Warner Music has essentially stated the following. The legal basis for the subsequent
processing of personal data collected through the setting of cookies is consent. The
company fulfils the conditions for consent described in Article 7 of the GDPR, inter alia,
by means of the information provided in the company’s cookie banner on its website.
The cookie banner contains information about the use of cookies and information
about the processing of personal data collected through the setting of cookies. Visitors
to the website can make clear choices through the cookie banner to enable an
informed and voluntary choice regarding the processing of personal data. Visitors are
also informed through the cookie banner that they have the choice to withdraw their
consent at any time. The cookie banner shows that the visitor can manage their
options for cookies on the company’s website by clicking on ‘cookie settings’. This link
appears on all pages of the website.
Warner Music has further proposed changes to its cookie banner, to include the
wording ‘you can withdraw your consent at any time’. The updates would include the
wording in both the first and second layers of the banner.
Definition of the case
The Swedish Post and Telecom Authority is the sole competent supervisory authority
over the Electronic Communications Act (2022:482), which lays down specific
requirements for the storage of cookies in terminal equipment or the collection of data
from such equipment. However, the personal data processing that takes place after
collection, such as analysis or profiling, is subject to the rules of the General Data
Protection Regulation, where IMY is the competent supervisory authority. Against that
background, IMY’s examination has been limited to the processing of personal data
that took place after the data was collected and the deficiencies alleged in the
complaint relating to that subsequent processing.
Motivation for the decision
Applicable provisions, etc.
Processing of personal data is only lawful if one of the conditions set out in Article 6 of
the GDPR is met. The legal basis in question in the case is consent pursuant to Article
6(1)(a).
Consent is defined in Article 4(11) of the GDPR as any freely given, specific, informed
and unambiguous indication of the data subject’s wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her. For consent to be valid, all of these requirements
must be met.
The transparency of the processing of personal data regarding the data subject is set
out in Article 5(1) of the Regulation. It is in the light of that principle that the
requirement that consent must be informed must be read.
Article 7(3) of the GDPR provides that, in order for consent to be valid, the data subject
must have the right to withdraw his or her consent at any time. Before consent is
Swedish Authority Our ref.: IMY-2023-16448 3(6)
for Privacy Protection Date: 2024-10-04
given, the data subject shall be informed thereof. It should be as easy to withdraw as it
is to give consent.
The recitals to the GDPR state that natural persons should be made aware, inter alia,
of their rights in relation to the processing of personal data and of how to exercise their
rights in relation to the processing.2
The European Data Protection Board (EDPB) guidelines on consent state that giving
and withdrawing consent must not always be done through the same action, but
should be as simple. In practice, when consent is given electronically by a single
mouse click, swipe or keystroke, data subjects must be able to withdraw consent just
as easily. Where consent is obtained through a service-specific user interface (e.g. via
a website or an app), there is no doubt a data subject must be able to withdraw
consent via the same electronic interface, as switching to another interface for the sole
reason of withdrawing consent would require undue effort. Furthermore, the data
subject should be able to withdraw the consent without difficulty. This means, among
other things, that a controller must ensure that it does not cost anything to withdraw
consent and that lowering the service level.3
The EDPB further considers that information on the right to withdraw consent is a
minimum requirement for the consent to be considered informed, and thus to be a
valid consent. This information must be provided before the user gives his or her
consent. Providing information on the possibility of withdrawal is necessary for the user
to exercise his or her right to withdraw his or her consent. If the controller does not
provide easily accessible information, the user's consent becomes an invalid ground
for processing.4 When requesting consent, controllers should ensure that they always
use clear and plain language. For example, the declaration of consent must be names
as such. Phrases like ‘I know that…’ does not meet the requirement of clear
language.5
The issue in the case is if there has been a valid consent in order to processing the
complainant’s personal data through the use of cookies.
Assessment
Warner Music provides information that cookies are used on the website in a so-called
cookie banner that is displayed, among other things, when the user first enters the
website. In the first layer of the cookie banner, as it appeared at the time of the
complaint, there are three equally prominent choices: ‘Cookie settings’, ‘Reject all’ and
‘Accept all cookies’. The following assessment is based on this cookie banner and the
company's website.
Clear and unambiguous information on the right of withdrawal
IMY considers that the controller must provide information on the possibility of
withdrawing consent in order to comply with the informed consent requirement.
Withdrawal of consent is a right that every data subject has when consent has been
used as a legal basis. It is therefore necessary that a user receives this information
before consent is given. The EDPB Guidelines state that a controller should always
use clear and plain language when requesting consent. IMY considers that the
2 Recital 39.
3 EDPB Guidelines 05/2020 on consent under Regulation (EU) 2016/679, version 1.1, adopted on 4 May 2020,
paragraphs 113-114. Swedish version.
4 A.a. paragraphs 62-64 and 116.
5 A.a. paragraph 67.
Swedish Authority Our ref.: IMY-2023-16448 4(6)
for Privacy Protection Date: 2024-10-04
requirement for clear and plain language should also apply to information on
withdrawal of consent. This means that it must be clear to the complainant that he or
she has the right to withdraw his or her consent.
Neither the information text on the cookie banner nor the website in general says
anything about a user's right to withdraw their consent at any time. Instead, the
information text in the cookie banner states that ‘You can manage your cookie choices
on our site now or later by clicking on ‘Cookie settings’. ‘Cookie settings’ indicates
‘Update your cookie settings at any time by clicking on ‘Cookie settings’ on all pages,
which will then take you back to this settings centre’.
Simply providing information about the possibility of administering their cookie choices
or updating settings is not sufficient to make it clear to a user that there is a right to
withdraw consent.
In the light of Article 7(3) of the GDPR, recital 39 and the EDPB Guidelines on
Consent, IMY considers that Warner Music did not inform the complainant on the right
to withdraw a consent in a sufficiently clear manner to enable him or her to defend his
or her rights. Therefore, the complainant cannot be considered to have given an
informed consent. As there was no information on the right to withdraw, it has not been
as easy to withdraw as to consent.
Comparison of consent and withdrawal procedures
The complainant highlights the option of having a permanently hovering icon visible on
all pages of the website to withdraw consent. IMY believes that a permanent hovering
icon is an option that can meet the condition that it should be as easy to withdraw as to
give consent. On the other hand, IMY does not consider that the GDPR requires a
specific technical solution that all controllers must use in order to comply with the
requirement of Article 7(3). The assessment of whether it is as easy to withdraw as it is
to give consent needs to be made in the individual case on the basis of the procedure
in question used to give consent. This assessment is in line with the Cookie Banner
taskforce report and the EDPB opinion on valid consent.6
At the relevant time, when a user first visited Warner Music's website, the cookie
banner appeared immediately. There, the user could, at the click of a button, consent
to the use of all (non-essential) cookies. Once a user had given their consent in the
cookie banner, the cookie banner disappeared. In order to withdraw the consent, the
data subject had to click on the ‘cookie settings’ link located at the bottom of the footer.
When you clicked on the link, you ended up in a settings center, in the second layer of
the view. In the settings centre, the data subject had to uncheck the categories of the
cookies to which he or she had previously consented, and then confirm his or her
choices. When comparing the way consent was obtained on the website, fewer
keystrokes were needed to give consent than to withdraw consent.
Since the relevant period, Warner Music has changed its settings centre to which the
data subject accesses after clicking on ‘cookie settings’. The data subject no longer
has to uncheck the categories of cookies to which he or she has consented, but can
choose directly to ‘reject all’. IMY considers that this measure facilitated the withdrawal
of consent by the data subject. As a result of this improvement, IMY considers that the
deficiency that existed at the time of the complaint, in this respect, no longer persists.
6 Report on the work of the Cookie Banner Taskforce, adopted on 17 January 2023, para. 35 and Opinion 08/2024 on
valid consents for “Consent or Pay Models” implemented by large online platforms, adopted on 17 April 2024,
paragraph 169 (IMY translation).
Swedish Authority Our ref.: IMY-2023-16448 5(6)
for Privacy Protection Date: 2024-10-04
The "cookie settings" link is permanently available on all pages of the website and the
data subject can withdraw his or her consent with one keystroke after pressing the link.
IMY's assessment is therefore that this deficiency has been remedied.
Summary
Warner Music has not provided sufficiently clear information about the possibility of
withdrawing consent and the data subject has thus not been able to give informed
consent. Since there was no information about the right to withdraw, it has not been as
easy to withdraw as to consent on the company's website warnermusic.se. There was
therefore no valid consent and therefore no legal basis for processing the
complainant’s personal data. Warner Music therefore processed the complainant’s
personal data in breach of Article 6 and Article 7(3) of the GDPR.
Choice of corrective measure
Pursuant to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances of the case need to be taken into consideration. These could include
the nature, gravity and duration of the infringement as well as past infringements of
relevance.
IMY notes the following relevant facts. IMY has assessed that the company has not
had a legal basis to process the complainants' personal data. Although Warner Music
is not considered to have made the withdrawal as easy as the giving of consent, there
has been an opportunity to withdraw the consent via a permanently accessible link on
the website. Warner Music has provided some information that the data subject may
change their choices, even if this is considered insufficient. Warner Music has also
made some improvements, after receiving the complaint, to make it easier for data
subjects to withdraw consent. The company has not previously been found to have
infringed the General Data Protection Regulation.
Since Warner Music has also stated that it intends to add clear and precise information
on the right to withdraw consent to its cookie banner, IMY does not consider it
appropriate to order it to do so.
Against this background, IMY considers this a minor infringement within the meaning
of recital 148 and that Warner Music is to be given a reprimand pursuant to Article
58(2)(b) of the GDPR.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
Swedish Authority Our ref.: IMY-2023-16448 6(6)
for Privacy Protection Date: 2024-10-04
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.