Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
20/02270-12 22.10.2024
Closure of case
Datatilsynet refers to your complaint dated 19 November 2019 regarding lack of erasure of
personal data, and Datatilsynet’s letter to you dated 5 July 2024 where we requested your
feedback in the case.
Decision
Datatilsynet rejects your complaint.
Background
We informed you on 21 January 2020 that this is a so-called cross-border case. The case is
cross-border because & Other Stories is established in more than one EEA country and the
processing in question takes place in the context of the activities of such establishments. To
ensure uniform application of the GDPR in the EEA, data protection authorities across the
EEA must cooperate in the handling of cross-border cases.
The Swedish Data Protection Authority has acted as lead supervisory authority in the handling
of your complaint. We, and 12 other supervisory authorities, have been involved as concerned
supervisory authorities.
Reasoning for our decision
The Swedish supervisory authority has investigated the subject matter of your complaint to
the extent appropriate in accordance with Article 57(1)(f) GDPR and, based on such
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
investigation, they have not found any infringement of the GDPR. The Swedish supervisory
authority has therefore concluded that your complaint should be rejected and that the case
should be closed. All concerned supervisory authorities, including us, agree with such
conclusion.
Please find below information from the Swedish supervisory authority. This information
explains how your complaint has been handled and the reasons as to why your complaint
should be rejected. As your complaint is to be rejected, the supervisory authority that received
your complaint – in this case us – is the one which will adopt the final decision pursuant to
Article 60(8) GDPR.
As this is a cross-border case, the information is written in English. We can provide a
translation. If you wish to receive a translation, please contact us.
The Swedish Authority for data protection (IMY) has received a complaint from you
against & Other stories/H&M Hennes & Mauritz AB. The complaint was transferred
from the supervisory authority of the Member State where you lodged your complaint
(Norway) in accordance with the provisions of the GDPR on cooperation in
crossborder processing. IMY has handled the case as responsible supervisory
authority for the company’s operations pursuant to Article 56 of the GDPR.
IMY shall process complaints about incorrect processing of personal data and, where
appropriate, investigate the subject matter of the complaint (Article 57(1)(f) GDPR).
The CJEU has ruled that the supervisory authority must investigate such complaints
with due care. According to 23 § of the Swedish Administrative Procedure Act
(2017:900), an authority must ensure that a case is investigated to the extent required
by its nature.
On 28th of June 2024 IMY asked the Norwegian supervisory authority to forward a
letter asking you whether your complaint was still relevant. You were informed that if
we do not receive an answer from you within the set timeframe we will presume that
you no longer wish to pursue this concern and we will proceed to close our file in this
matter.
IMY has not received any response from you. IMY therefore assumes that the
complaint is no longer relevant. Against this background, IMY finds no reason to
continue the investigation.
IMY closes the case.
For information purposes, IMY would like to inform you that you always have the
opportunity to submit a new complaint to us.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the
GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant
to Section 22(2) of the Norwegian Personal Data Act (in Norwegian:
personopplysningsloven). This decision can nevertheless be challenged before Norwegian
courts in accordance with Article 78(1) GDPR.
Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian
Public Administration Act regarding the information they receive about the complainant’s
identity, personal matters and other identifying information, and such information can only be
used to the extent necessary to safeguard their interests in this case. Any breach of this duty of
confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Kind regards
Tobias Judin
Head of Section
Anne Eidsaa Hamre
Senior legal adviser
This document is electronically approved and therefore does not require a handwritten
signature.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO