Datatilsynet
Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference
Our reference
23/03081-12
Date
02.01.2025
## Closure of case
Datatilsynet refers to your complaint dated 07.08.2023, and Datatilsynet's e-mail to you dated 13.09.2024 where we requested your feedback in the case.
## Decision
Datatilsynet rejects your complaint.
## Background
We informed you 28.09.2023 that this is a so-called cross-border case. The case is cross-border because Scandic is established in more than one EEA country and the processing in question takes place in the context of the activities of such establishments. To ensure uniform application of the GDPR in the EEA, data protection authorities across the EEA must cooperate in the handling of cross-border cases.
The Swedish Data Protection Authority has acted as lead supervisory authority in the handling of your complaint. We have been involved as a concerned supervisory authority.
## Reasoning for our decision
The Swedish supervisory authority has investigated the subject matter of your complaint to the extent appropriate in accordance with Article 57(1)(f) GDPR and, based on such investigation, they have not found any infringement of the GDPR. The Swedish supervisory authority has therefore concluded that your complaint should be rejected and that the case should be closed. We, as a concerned supervisory authority, agree with such conclusion.
Please find below information from the Swedish supervisory authority. This information explains how your complaint has been handled and the reasons as to why your complaint should be rejected. As your complaint is to be rejected, the supervisory authority that received your complaint – in this case us – is the one which will adopt the final decision pursuant to Article 60(8) GDPR.
As this is a cross-border case, the information is written in English. We can provide a translation. If you wish to receive a translation, please contact us.
Postal address:
P.O. Box 458 Sentrum
N-0105 OSLO
Office address:
Trelastgata 3
N-0191 OSLO
Phone:
+47 22 39 69 00
Ent.reg:
974 761 467
Home page:
www.datatilsynet.no/en/
*You have filed a complaint against Scandic Holding AB. Your complaint has been submitted to the Swedish Authority for Privacy Protection (IMY) by the supervisory authority of the country where you lodged your complaint (Norway) in accordance with the provisions of the GDPR on cooperation in cross-border processing. IMY has handled the complaint as lead supervisory authority under Article 56 of the General Data Protection Regulation1 (GDPR).*
*Due to the cross-border nature of the complaint case, IMY has made use of the mechanisms for cooperation and consistency provided for in Chapter VII of the GDPR. The concerned supervisory authority has been the data protection authority in Norway. You have filed a complaint against Scandic Holding AB. Your complaint has been submitted to the Swedish Authority for Privacy Protection (IMY) by the supervisory authority of the country where you lodged your complaint (Norway) in accordance with the provisions of the GDPR on cooperation in cross-border processing. IMY has handled the complaint as lead supervisory authority under Article 56 of the General Data Protection Regulation (GDPR).*
*IMY shall process complaints about incorrect processing of personal data and, where appropriate, investigate the subject matter of the complaint (Article 57(1)(f) GDPR, usually abbreviated GDPR).*
*It follows from Section 23 of the Administrative Procedure Act (2017:900) that an authority shall ensure that cases are investigated to the extent required by their nature.*
*IMY has, via the Norwegian Data Protection Authority, given you the opportunity to supplement your complaint on 13 September 2024. IMY has not received any additional information. In so doing, IMY has investigated the case to the extent required by Article 57(1)(f) of the GDPR and Section 23 of the Administrative Procedure Act.*
*On the basis of the information you have provided in your letter received by IMY on 2023-09-28, IMY considers that it is not possible to conclude that what you have stated in your letter may constitute a deficiency in relation to the provisions of the GDPR.*
*The case should therefore be closed.*
### **Ability to appeal**
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant to Section 22(2) of the Norwegian Personal Data Act (*in Norwegian: personopplysningsloven*). This decision can nevertheless be challenged before Norwegian courts in accordance with Article 78(1) GDPR.
2
# **Duty of Confidentiality**
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian Public Administration Act regarding the information they receive about the complainant’s identity, personal matters and other identifying information, and such information can only be used to the extent necessary to safeguard their interests in this case. Any breach of this duty of confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Kind regards
Tobias Judin
Head of Section
Selma Kjellemo
juridisk rådgiver
*This letter has electronic approval and is therefore not signed*
3