Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(3)
COMPLAINANT
CONTROLLER
Morrow Bank ASA
Swedish ref.:
DI-2022-558 Final decision under the General Data
Norweigan ref: Protection Regulation – Morrow Bank
23/01372-5
IMI case register:
ASA
544525
Date:
2025-02-14
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection's (hereinafter “IMY”) adopts the following
decision on the complaint submitted against Morrow Bank ASA on 23 January 2022
(Case DI-2022-558):
• The complaint shall be rejected pursuant to Article 60(8) of the General Data
Protection Regulation (GDPR)1.
Factual Background
On 7 January 2022, Morrow Bank sent an email to the data subject residing in Sweden
(hereinafter the “complainant”) informing that it would update its privacy policy to
include a section about disclosure of contact information to third parties, such as
Facebook and Google for customer matching purposes. This matching would entail
that those customers would be shown relevant information and marketing on social
media, search engines and websites.
In the updated privacy policy, Morrow Bank stated that it would rely on Article 6(1)(f) of
the GDPR as the lawful basis for this disclosure for customer matching purposes.
Customers were informed that they had a right to object to this specific disclosure by
signing into the portal at the bank’s website. Thus, the disclosure would happen by
default unless customers explicitly opted-out by objecting.
Since the complainant already had explicitly opted-out of receiving any offers from
Postal address:
Box 8114
104 20 Stockholm
Morrow Bank and its partners by email and SMS at the time of becoming a customer in
Sweden July 2020, he wrote an email to Morrow Bank on 9 January 2022, inquiring why the
Website:
bank had decided to disclose his email and phone number to these third-party partners
www.imy.se without his consent. On 18 January 2022, the complainant sent a follow-up email
E-mail:
where he informed Morrow Bank that he would lodge a complaint to IMY unless the
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: DI-2022-558 2(3)
for Privacy Protection Date: 2025-02-14
bank made changes as to how the contact information is disclosed to third parties. The
emails to [email protected] remained unanswered.
According to the complainant, it could not reasonably be expected that a licensed bank
would disclose its customers' contact information to third parties such as Facebook
and Google for the purpose of consumer matching, at the time of becoming a
customer in July 2020. As such, the complainant holds that the disclosure of contact
information under the "legitimate interests" clause in this specific case is unlawful.
Legal Background
The GDPR lays down the provisions, which are relevant in the present case:
Pursuant to Article 4(1) GDPR:
‘personal data’ means any information relating to an identified or identifiable natural
person (“data subject”); an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person.
Pursuant to Article 4(2) GDPR:
‘processing’ means any operation or set of operations which is performed on personal
data or on sets of personal data, whether or not by automated means, such as
collection, recording, organisation, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
Article 77(1) GDPR states that:
Without prejudice to any other administrative or judicial remedy, every data subject
shall have the right to lodge a complaint with a supervisory authority, in particular in
the Member State of his or her habitual residence, place of work or place of the
alleged infringement if the data subject considers that the processing of personal data
relating to him or her infringes this Regulation.
Findings
In the context of the investigation regarding the present case, Morrow Bank states that
they never processed customer’s personal data for consumer matching purposes.2
Indeed, it changed its privacy policy in 2022 as preparation, in case it would be
relevant. However, such processing never started.
Furthermore, Morrow Bank has now changed its privacy policy and removed the
information on customer matching.3
In light of the above, it appears that Morrow Bank never processed the personal data
(within the meaning of Article 4(1) and (2)) of the complainant for customer matching
2 See Morrow Bank’s reply to Datatilsynet’s order to provide information, dated 6 December 2024.
3 Ibid.
Swedish Authority Our ref.: DI-2022-558 3(3)
for Privacy Protection Date: 2025-02-14
purposes. It follows directly from the wording in Article 77(1) that the data subject must
bring forward that their personal data has been processed in a way that infringes the
Regulation.
Consequently, the complainant’s submission to IMY does not constitute a complaint
within the meaning of Article 77 GDPR.
Having considered the above, the complaint shall be rejected in accordance with
Article 60(8) GDPR.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision