Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
20/02290-17 15.01.2025
Closure of case
Datatilsynet refers to your complaint dated 23 August 2018 regarding erasure of personal data
at SAS.no (Scandinavian Airlines System Denmark-Norway-Sweden, SAS), and
Datatilsynet’s letter to you dated 5 July and 7 October 2024.
Decision
Datatilsynet rejects your complaint.
Background
We informed you on 5 July 2024 that this is a so-called cross-border case. The case is cross
border because SAS is established in more than one EEA country and the processing in
question takes place in the context of the activities of such establishments. To ensure uniform
application of the GDPR in the EEA, data protection authorities across the EEA must
cooperate in the handling of cross-border cases.
The Swedish DPA has acted as lead supervisory authority in the handling of your complaint.
We, and 11 other CSAs, have been involved as concerned supervisory authorities.
Reasoning for our decision
The Swedish DPA has investigated the subject matter of your complaint to the extent
appropriate in accordance with Article 57(1)(f) GDPR and, based on such investigation, they
have not found any infringement of the GDPR. The Swedish DPA has therefore concluded
that your complaint should be rejected and that the case should be closed. All concerned
supervisory authorities, including us, agree with such conclusion.
Please find below information from the Swedish DPA. This information explains how your
complaint has been handled and the reasons as to why your complaint should be rejected. As
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
your complaint is to be rejected, the supervisory authority that received your complaint – in
this case us – is the one which will adopt the final decision pursuant to Article 60(8) GDPR.
As this is a cross-border case, the information is written in English. We can provide a
translation. If you wish to receive a translation, please contact us.
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection (IMY) finds that the investigation has
not shown that Scandinavian Airlines System Denmark-Norway-Sweden (902001-
7720) has processed personal data in breach of Article 17 of the General Data
Protection Regulation (GDPR) as alleged in the complaint.
Presentation of the supervisory case
IMY has initiated supervision regarding Scandinavian Airlines System Denmark-
Norway-Sweden (SAS) due to a complaint against the company. The complaint was
transferred from the supervisory authority of the Member State where the complainant
lodged his/her complaint (Norway) in accordance with the provisions of the GDPR on
cooperation in cross-border processing. IMY has handled the case as responsible
supervisory authority for the company’s operations pursuant to Article 56 of the
GDPR.
The case has been handled through written procedure. Since the complaint relates to
cross-border processing, IMY has used the mechanisms for cooperation and
consistency regulated in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Norway, Spain, Netherlands,
France, Denmark, Germany, Italy, Finland, Cyprus, Austria, Poland and Portugal.
Below follows a description of the arguments put forward by the complainants and the
company in relation to each complaint.
The complainant has stated the following. The complainant has requested erasure of
his personal data according to article 17 of the GDPR but his request has not been
complied with.
SAS has stated the following. SAS received the complainants request for erasure on
the 1st of January 2019. In accordance with the procedure for erasure of personal
data, SAS complied with the request and deleted the complainant’s personal data,
which was communicated to the complainant on the 2th of January 2019.
According to article 17(3)(b) of the GDPR, the right to erasure of personal data is
limited if the personal data is necessary for compliance with a legal obligation which
requires processing by Union or Member State law. There are several EU regulations
and directives related to the handling of PNR data.
2
A Passenger Name Record (PNR) is a unique airline reservation number for one or
more flights. PNR contains personal data provided by a passenger and is collected
and stored by airlines. They include the following personal data: the passengers
name, passport details, travel dates, itineraries, seats, luggage, contact details, any
membership number, payment methods and requests for special services (SSR), such
as requirements for special meals and/or special assistance.
According to the The Air Passengers Rights Regulation 261/2004, customers of SAS
can sue the company in three or four countries; the place of departure and
destination, where the airline is domiciled and also in the customer’s home country.
Under the Directive, the rules on limitation are determined by national law. In
Sweden, the general limitation period of 10 years applies. In order for SAS to be able
to meet any demands from customers, PNR data needs to be saved during the
limitation period.
According to the Directive 2016/681 (Use of passenger name record (PNR)) for the
purpose of preventing, detecting, investigating and prosecuting terrorist offences and
serious crime, PNR data must be retained for a period of 5 years.
SAS further states that the aforementioned legal obligations are the legal basis for the
processing and saving of PNR data. This information can also be found in SAS
Privacy Policy. In accordance with the regulations mentioned above, SAS PNR data is
stored for 10 years from the end of the flight.
IMY has sent SAS statement to the supervisory authority of the country in which the
complainant lodged its complaint (Norway) to give the complainant opportunity to
comment on SAS statement. The complainant has not responded.
Motivation for the decision
The complainant has requested erasure of his personal data. According to Article
17(1) of GDPR, the data subject shall have the right to obtain from the controller the
erasure of his or her personal data without undue delay and the controller shall be
obliged to erase personal data without undue delay, under certain conditions set out
in the relevant article. Article 17(3) of GPDR lists the exceptions to this right.
The data subject’s right to erasure is not an unconditional right, and applies in the
situations and under the conditions set out in Article 17 of the GDPR. SAS states that
they have complied with the complainants right to erasure. Some data have not been
deleted that are processed for legal obligations. IMY finds no reason to question SAS's
information that the processing of the complainant's personal data is necessary to
defend legal claims and to comply with the legal requirements mentioned by the
company.
3
IMY considers that SAS has complied with the complainants right to erasure and finds
that the investigation has not shown that SAS has processed the complainant’s
personal data in breach of Article 17 of the GDPR as alleged in the complaint.
The case should therefore be closed.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the
GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant
to Section 22(2) of the Norwegian Personal Data Act (in Norwegian:
personopplysningsloven). This decision can nevertheless be challenged before Norwegian
courts in accordance with Article 78(1) GDPR.
Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian
Public Administration Act regarding the information they receive about the complainant’s
identity, personal matters and other identifying information, and such information can only be
used to the extent necessary to safeguard their interests in this case. Any breach of this duty of
confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Kind regards
Tobias Judin
Head of Section
Anne Eidsaa Hamre
Senior legal adviser
This letter has electronic approval and is therefore not signed
Copy: SAS
4