Notice: This document is an unofficial translation of IMY´s final decision. Only the Swedish
version is authentic.
1(6)
COMPLAINANT
See appendix
CONTROLLER
Pierce AB
Swedish ref:
IMY-2022-6646 Final decision pursuant to Article 60
IMI case register: under the General Data Protection
331357
Regulation
Date:
2024-12-20
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Pierce AB
(556763 – 1592) has processed the complainant’s1 personal data in breach of:
• article 6(1) of the General Data Protection Regulation (GDPR)2 by during the
period April 7, 2021 – June 6, 2021 having used the complainants email
address for the purpose of sending newsletters to him without being able to
demonstrate a legal basis for that processing,
• article 13 by having provided the complainant with insufficient information
about the processing in question, and
• article 12(3) by not having handled the complainant’s request for access on
May 30, 2021 without undue delay.
IMY issues a reprimand to Pierce AB pursuant to Article 58(2)(b) of the GDPR for the
infringements.
Presentation of the supervisory case
IMY has initiated supervision regarding Pierce AB (‘Pierce’, the company) due to a
complaint. The complaint was submitted to IMY as the lead supervisory authority
pursuant to Article 56 of the GDPR. The submission of the complaint was made by the
supervisory authority with which the complaint was lodged (the Norwegian supervisory
authority) to be handled in accordance with the provisions of the GDPR on cooperation
in cross-border processing. In handling the case, IMY has used the cooperation and
consistency mechanism of chapter VII of the GDPR. The other supervisory authorities
concerned have been the authorities of Austria, Belgium, the Czech Republic,
Postal address:
Box 8114
Denmark, Finland, France, Germany, Ireland, Italy, the Netherlands, Norway, Poland
104 20 Stockholm and Spain.
Website:
www.imy.se
E-mail:
1 The complainant’s identifications data are set out in annex.
[email protected] 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Reference number: IMY-2022-6646 2(6)
Date: 2024-12-20
The complainant has essentially stated the following. After he made a purchase from
Pierce on 7 April 2021, and provides his email adress, the company sent him
marketing emails (newsletters) in large quantities and without legal basis. At the time
of purchase, he had neither consented to, nor been given the opportunity to object to,
the sending of newsletters. At the time of purchase, he also received insufficient
information about the company's processing of his personal data for the purpose of
sending newsletters, including no information about the processing of his personal
data in connection with the opening and reading of the newsletters. On 30 May 2021,
he requested access to his personal data pursuant to Article 15 of the GDPR, to which
the company did not respond. The mailings ended a week after his access request. In
support of the complaint, the complainant submitted, i.a. written information from the
company.
IMY has initiated supervision to investigate whether Pierce had a legal basis pursuant
to Article 6(1) of the GDPR to use the complainant´s email address to send marketing
emails to the complainant during the period in question, whether the complainant has
received sufficient information about the processing pursuant to Articles 12 and 13
when the email address was collected, and whether the company handled the
complainant's request for access without undue delay. The examination of the case is
limited to what the complainant has stated about Pierce's processing of his personal
data relating to the newsletters in question, and his request for access on May 30,
2021, and not the company's processing in general. The case has been handled
through written procedure.
Pierce has stated that the company is the controller concerning the processing to
which the complaint relates.
Reasons for the decision
Legal basis
The lawfulness of the processing of personal data requires a legal basis in Article 6(1)
of the GDPR. Personal data can be processed on the basis of a balance of interests
under Article 6(1)(f), if the processing is necessary for the purposes of legitimate
interests and the interests of the data subject do not override those interests.
Marketing is, according to recital 47 of the GDPR, an example of a purpose that may
support the processing of personal data based on a balance of interests. When
assessing whether a processing operation can be based on a balance of interests,
account may be taken, i.a. of what information the data subject has been given about
the processing of his or her personal data, and whether the specific interest may
conflict with other legislation, such as the Marketing Act (2008:486).3
Section 19 of the Marketing Act states that, under certain conditions, a trader may use
e-mail for marketing to a natural person without consent. One of the conditions is that
the natural person, when the e-mail address is collected, is clearly and explicitly given
3 See Recital 70 of the GDPR and EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f),
Section 4, adopted for public consultation on October 8, 2024, in particular at paragraph 116.
The Privacy Protection Authority Reference number: IMY-2022-6646 3(6)
Date: 2024-12-20
the opportunity to object to the use of such details for marketing purposes free of
charge and easily.
Article 12 of the GDPR imposes a requirement to provide transparent information to
the data subject when personal data is collected. Examples of information to be
provided pursuant to Article 13 when personal data is collected include the purposes of
the processing, the legal basis for the processing and, where the processing is based
on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party.
In addition, according to the provision, the data subject must be informed at the time of
collection of his or her right to object to the processing. Article 21(3) states that the
data subject has the right to object to processing for direct marketing purposes. Article
12(2) requires the controller to facilitate the exercise of data subject's rights under
Article 21.
The complainant stated that after providing his e-mail address in connection with a
purchase from Pierce, he received marketing e-mails (newsletters) from the company
without any legal basis. According to the complainant, he had neither consented to,
nor been given the opportunity to object to, receiving these mailings.
In the written information from the company, submitted by the complainant in this case,
states under the heading Direct Marketing that personal data will be used to send
offers by e-mail if you have given your consent. Under the headings of What are your
rights and under Your right to object to direct marketing, it is stated that you can opt
out of receiving direct marketing by following the instructions in each marketing
message.
Pierce has responded to the complaint, including the documents submitted by the
complainant in support of the complaint, and mainly stated the following. The company
sent approximately 27 e-mail newsletters to the complainant during the period in
question. This was done on the basis of a balancing of interests under Article 6(1)(f) of
the GDPR. The company does not rely on consent. At the time of the collection, the
complainant did not have the opportunity to opt out of receiving e-mail newsletters via
a checkbox. In order to be able to send newsletters, the company relies on section
19(2) of the Marketing Act. The company provides the natural person with a clear and
simple opportunity to object, free of charge, to the use of their data for marketing
purposes both at the time of collection and in each subsequent marketing message. In
Pierce´s privacy policy, the company informs data subjects of their right to object to
direct marketing and how to do so. The data subject could therefore, already at the
time of collection, contact the company to opt out of newsletters. Each newsletter sent
out also contained a clearly indicated unsubscribe link. The company has now updated
its procedures, so that customers are more clearly given the opportunity to decline at
the time of collection, and updated its privacy policy, among other things, to be even
clearer and comply with the requirements set by IMY and other supervisory authorities
in their latest practice. The company has submitted a documented balance of interests
that, among other things, refers to Section 19 of the Marketing Act.
IMY notes that the GDPR requires data controllers, when collecting personal data, to
provide transparant information on the purposes for which the data will be used and,
where applicable, the right to object to the processing, and to facilitate the data
subject's right to object to direct marketing.
The investigation shows that when the e-mail address was collected, the complainant
was not clearly informed that he would receive marketing e-mails unless he actively
The Privacy Protection Authority Reference number: IMY-2022-6646 4(6)
Date: 2024-12-20
objected. According to the information provided by the company at the time, sending
offers by e-mail required his consent. It is questionable whether the procedure was in
accordance with Section 19 of the Marketing Act. Against this background, IMY
considers that it has not been established that Pierce has been able to rely on Article
6(1)(f) of the GDPR to support the processing of the complainant's personal data in
question. No other legal basis has been relevant to apply for the processing. IMY finds
that by sending the newsletters in question by email to the complainant without being
able to demonstrate a legal basis for the processing, Pierce has processed the
complainant's personal data in breach of Article 6(1) of the GDPR.
Information to the complainant
When personal data is collected from a data subject, Article 13 of the GDPR requires
the controller to inform the data subject about the processing of his or her personal
data.
Some uncertainties in the information provided to the complainant regarding the legal
basis and the right to object to the processing has already been taken into
consideration when assessing whether the company had a legal basis for sending the
newsletter emails to the complainant.
The complainant also claims that the company did not inform him about the processing
of his personal data when opening and reading the newsletter.
Pierce has essentially stated the following. Through the company's newsletter register,
data has been collected on whether the complainant has opened the newsletters,
including whether the complainant has clicked on anything in the newsletters. This
information was not previously provided to the complainant, but the company informed
the complainant on October 12, 2022 that the company processes information that he
has not opened the newsletters. The company has also updated its privacy policy with
information about this and referred the complainant to the updated policy.
The investigation shows that, when collecting the complainant's personal data, Pierce
did not inform the complainant about the company's processing relating to the
complainant's opening and reading of the newsletters in question. IMY finds that by
providing insufficient information about the processing of the complainant's personal
data at the time of collection, Pierce has processed the complainant's personal data in
breach of Article 13 of the GDPR.
Request for access
Pursuant to Article 15 of the GDPR, the data subject has the right to obtain from the
controller confirmation as to whether or not personal data concerning him or her are
being processed and, where that is the case, access to the personal data and certain
additional information.
Articles 12(3) and 12(4) of the GDPR set out the information to be provided to the data
subject in connection to a request for access and the time limits that apply in different
cases.
The complainant has stated he requested access from Pierce on May 30, 2021, did
not receive a response within one month and when the complaint was filed still had not
received a response.
The Privacy Protection Authority Reference number: IMY-2022-6646 5(6)
Date: 2024-12-20
Pierce has essentially stated the following. The complainant's request was not opened
because, in accordance with the company's security procedures, the e-mail was
unfortunately misinterpreted as a security threat. There was therefore no deliberate
refusal of the customer's request, nor was the company unable to handle the request.
The complainant's request was granted on 12 October 2022. To minimize the risk of
similar situations in the future, Pierce has created an email address for data protection
issues, which is referred to in the company's privacy policy.
The investigation shows that the complainant requested access from Pierce on May
30, 2021 and that the company, according to its own statement, did not respond to the
request until October 12, 2022.
While there may be circumstances in individual cases that may explain why a request
is not opened, controllers have an obligation to take measures to counteract this. One
such example is to facilitate, through instructions and guidance, data subjects who
wish to exercise their rights. It has not been established that the company had taken
sufficient measures in this respect at the time of the request.
IMY finds that by not having handled the complainant's request for access on May 30,
2021, without undue delay, Pierce has processed the complainant's personal data in
breach of Article 12(3) of the GDPR.
Choice of corrective measure
In case of infringements of the GDPR, Article 58(2)(i) allows IMY to impose
administrative fines in accordance with Article 83. Recital 148 states that in a case of a
minor infringement, IMY shall instead issue a reprimand under Article 58(2)(b). In the
assessment due regard must be given to the circumstances of each individual case,
such as the nature, gravity and duration of the infringement, the scope of the
processing, the number of data subjects affected and any relevant previous
infringements.
In this case, IMY has taken into consideration the following circumstances. The
company has used the complainant's email address for the purpose of sending
newsletters without having a legal basis for that processing, provided insufficient
information about the processing in question and did not handle the complainant's
access request without undue delay. The infringements concern a limited amount of
personal data. They do not involve processing of sensitive personal data. There are no
previous decisions on infringements of the GDPR against the company. According to
the information received, the company has taken actions to remedy the infringements.
Against this background, IMY considers that these are minor infringements within the
meaning of recital 148 of the GDPR and that Pierce is to be given a reprimand for the
infringements.
This decision has been approved by Head of Unit after presentation by
legal advisor .
Appendix
The complainant’s personal data
The Privacy Protection Authority Reference number: IMY-2022-6646 6(6)
Date: 2024-12-20
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.