Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s draft decision. Only the Swedish version is authentic. 1(5)
COMPLAINANT
See appendix
CONTROLLER
Svenska Julförlaget AB
Swedish ref.:
IMY-2024-961 Final decision under the General Data
Finnish ref: Protection Regulation – Svenska
7376/153/22
IMI case register:
[598404]
Julförlaget AB
Date:
2024-12-11
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Svenska Julförlaget AB
(Svenska Julförlaget), 556952-143, is processing the complainant’s personal data in
breach of
• Article 17(1)(c) of the General Data Protection Regulation (GDPR)1 by not
deleting the personal data of the complainant after the complainant has
objected to the processing pursuant to Article 21 (2) and
• Article 21(3) of the GDPR by processing the complainant’s personal data for
direct marketing purposes after the complainant objected to processing for
such purposes.
IMY issues a reprimand to Svenska Julflörlaget pursuant to Article 58(2)(b) of the
GDPR for the stated infringements of the GDPR.
Pursuant to Article 58.2 (c) of the GDPR IMY orders Svenska Julförlaget AB to
• erase the complainant’s personal data pursuant to Article 17(1)(c) of the
GDPR and
• stop processing the complainant’s personal data for direct marketing purposes
pursuant to Article 21(3) of the GDPR.
The measures shall be implemented no later than two weeks after this decision has
become final.
Postal address:
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 5
Swedish Authority Our ref.: IMY-2024-961 2(5)
for Privacy Protection Date: 2024-12-11
Presentation of the supervisory case
The handling of the case
IMY has initiated supervision regarding Svenska Julförlaget AB due to a complaint
regarding the right to erasure and objection to direct marketing pursuant to Articles 17
and 21 of the GDPR. The complaint has been submitted to IMY, as lead supervisory
authority pursuant to Article 56 of the GDPR. The handover has been made from the
supervisory authority of the country where the complaint has been lodged (Finland) in
accordance with the provisions of the GDPR on cooperation in cross-border
processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authority has been the Finish Authority for Privacy Protection.
The complaint
The complainant has essentially stated the following. Svenska Julförlaget sends sales
catalogues to the complainant despite the fact that he has on several occasions asked
the company to cease sending him direct marketing and delete his personal data. The
direct marketing has continued year after year despite that Svenska Julförlaget has
replied that the mailings would stop. According to the complaint the request has, at
least, been made in September, 7th 2020 and September, 8th 2021. On August,
25th 2023, the applicant stated that he had again received marketing from Svenska
Julförlaget again. Together with the complaint, the complainant submitted a picture of
direct marketing from Svenska Julförlaget in the form of a sales catalogue from the
year 2022.
When the complainant was given the opportunity to comment on Svensk Julförlaget’s
statement in the case, as set out below, he also submitted scanned images of
Svenska Julförlaget’s sales catalogues from 2023 and 2024 and the corresponding
sales lists dated 2023 and 2024 showing the appellant’s name and address.
Statements from Svenska Julförlaget
Svenska Julförlaget AB has essentially stated the following. Svenska Julförlaget is the
controller of the processing of personal data that is the subject to the complaint.
Svenska Julförlaget has handled the complainant’s request for erasure and objection
to direct marketing. The direct marketing in 2020 was sent to the complainant by
mistake. In September 2020, the complainant turned to julforlaget.se, but should have
emailed julforlaget.fi as it was said that Finnish customers should do for customer
service. Since then, the case has not been handled as it should have been, due to the
fact that julforlaget.fi was not contacted, and the complainant received incorrect
automatic information that the next year's direct marketing would be stopped. The
complainant therefore incorrectly received direct marketing in 2021. The complainant
emailed the Swedish customer service again in 2021. At that time, attention was paid
to the problem and the company introduced a new routine that meant that customer
service also handled Finnish customers who emailed to the wrong email address.
Svenska Julförlaget buys addresses through an external company. The reason why
the complainant could submitte a picture of a mailing from 2022 may be that his
information was included in the addresses purchased or that he took the mailing from
Page 2 of 5
Swedish Authority Our ref.: IMY-2024-961 3(5)
for Privacy Protection Date: 2024-12-11
a neighbour or relative. Nor is it true that the complainant received mailings in 2023
and 2024, since the complainant was removed after his email in 2021 and the
customer card was marked ‘do not disturb’. The address source is clearly visible from
the company's mailings and the address source has been cut from the images
submitted by the complainant.
Motivation for the decision
IMY will examine whether Svenska Julförlaget has fulfilled the complainant’s request
for erasure and whether the company has ceased the processing of the complainant’s
personal data for direct marketing purposes after he objected to that kind of
processing.
Applicable provisions
According to the principle of accountability, the controller must be able to demonstrate
that the processing of personal data is carried out in accordance with data protection
rules (Articles 5(2) and 24 GDPR). This means that the controller bears the burden of
proving that the processing complies with the data protection rules.2
Pursuant to Article 17(1)(c) of the GDPR, the data subject is entitled to have his or her
personal data erased by the controller without undue delay, inter alia, when the data
subject objects to the processing pursuant to Article 21(2) of the GDPR.
Pursuant to Article 21(2) of the GDPR, the data subject has the right to object at any
time to processing of personal data concerning him or her for direct marketing
purposes. Furthermore, it follows from Article 21(3) of the GDPR, that personal data
may no longer be processed for such purposes if a data subject objects to the
processing.
IMY:s Assessment
Since 2020, the applicant has repeatedly approached Svenska Julförlaget to request
that the company’s direct marketing be stopped and that his data should be deleted.
IMY considers that the complainant’s e-mails should have been interpreted and
handled as an objection to direct marketing and the request for erasure.
Svenska Julförlaget has stated that the complainant’s email received in 2020 was not
handled correctly because he contacted the Swedish customer service department
instead of the Finnish one. IMY notes that Svenska Julförlaget has had an obligation to
deal with the complainant’s request despite that it was sent to an email address that
belonged to the company’s Swedish customer service. A data subject is not limited to
use certain communication channels indicated by the controller as the preferable one,
the data subject can also make requests by using other official communication
channels of the controller, such as the complainant has done.3
Svenska Julförlaget states that the complainant’s request for erasure and objection to
direct marketing were dealt with in 2021 and that the company has not sent him any
marketing after that date. However, the applicant has submitted documentation in the
form of pictures of Svenska Julförlaget’s sales catalogues from 2022, 2023 and 2024.
2 Dom Valsts ieņēmumu dienests, mål C-175/20, EU:C:2022:124 p. 77–81.
3 European data protection Boards (EDPBS) Guidelines 01/2022 on data subject rights – Right of access, p 52–56.
Page 3 of 5
Swedish Authority Our ref.: IMY-2024-961 4(5)
for Privacy Protection Date: 2024-12-11
As regards the catalogues of the last two years, the applicant also attached sales lists
belonging to the catalogues showing the complainant’s name and address. IMY
considers that the documentation supports that the complainant has received postal
marketing from Svenska Julförlaget in 2022–2024 made for commercial purposes, in
order to get him to become a customer of the company, which has been addressed to
the complainant. Such mailings constitute direct marketing.4 IMY does not consider
that the Company has provided any reasonable explanation to disprove that such
marketing has been made. IMY considers that the investigation shows that Svenska
Julförlaget has processed the complainant’s personal data in breach of Article 17(1)(c)
by not erasing the complainant’s personal data even though he has objected to the
processing. IMY also considers that the company has not ceased the processing of his
personal data for direct marketing purposes after he objected to it in breach of Article
21(3) of the GDPR.
Choice of corrective measure
In the event of infringements of the General Data Protection Regulation, IMY may
direct a number of actions, known as corrective powers, against the subject of
supervision. It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY
has, inter alia, the power to impose administrative fines in accordance with Article 83
of that regulation. In the case of a minor infringement, IMY may, as stated in recital
148 of the GDPR, instead of imposing a fine, issue a reprimand pursuant to Article
58(2)(b). Aggravating and mitigating circumstances of the case, such as the nature,
gravity and duration of the infringement and previous relevant infringements, must be
considered.
Svenska Julförlaget has processed the complainant’s personal data in breach of
Articles 17(1) and 21(3) of the GDPR. However, the infringement in question has
affected an individual complainant. Furthermore, the company has not previously been
found to have infringed the GDPR.
In the light of the circumstances surrounding the infringements found, IMY considers
that these are minor infringements within the meaning of recital 148 and that Svenska
Julförlaget should therefore be given a reprimand under Article 58(2)(b) of the GDPR
for the breaches.
The investigation in the case shows that the complainant's objection to direct
marketing and request for erasure has not been met. IMY therefore considers that it is
appropriate to order Svenska Julförlaget pursuant to Article 58(2)(c) to delete the
complainant’s personal data pursuant to Article 17(1)(c) of the GDPR and to stop
processing the complainant’s personal data for direct marketing in accordance with
Article 21(3) of the GDPR. The measures shall be implemented no later than two
weeks after this decision has become final.
This decision has been made by decision maker after presentation
by legal advisor .
4 Dom StWL Städtische Werke Lauf a.d. Pegnitzden, mål C-102/20, EU:C:2021:954, p 47.
Page 4 of 5
Swedish Authority Our ref.: IMY-2024-961 5(5)
for Privacy Protection Date: 2024-12-11
Appendix
The complainant’s personal data
Page 5 of 5