Privacy Protection 1(2)
B/Br B /• Authority
Reference
number: Decisions under the General Data
IMY-2024-3911
Protection Regulation
Date:
2025-02-21
Decision of the Privacy Protection Authority
Case closed.
Presentation of the case
On 17 March 2024, you submitted a complaint to the Swedish Data Protection
Authority (IMY). Your complaint shows that Norwegian Air shared your and leaked your
personaldata. IMY has submitted your complaint to the Norwegian Supervisory
Authority (Datatilsynet) as lead supervisory authority pursuant to Article 56 of the Data
Protection Regulation1. In accordance with Article 60(3), the DPA has submitted a draft
decision (seeAnnex) to the other supervisory authorities concerned. None of the
supervisoryauthorities concerned has objected to the draft.
Reasons for the decision
Pursuant to Article 57(1)(f) of the GDPR, supervisory authorities are to process
complaints from a data subject and, where appropriate, investigate the subject matter
of the complaint. On behalf of the Swedish Data Protection Authority, IMY has given
you the opportunity to complete the case on two occasions on 22 October and 2
December 2024. You have not submitted any additional documents.
The Swedish Data Protection Authority’s draft decision states, inter alia, the following.
In view of the fact that the complainant has not submitted any evidence in support of its
complaint, the Swedish Data Protection Authority considers that there are no grounds
for further investigation of the complaint. Since none of the supervisory authorities
concerned has objected tothe DPA’s draft decision, the draft decision is binding under
Article 60(6) of the GDPR. Against this background, IMY is to adopt a decision closing
the case.
The case should therefore be closed.
Postal address: 1(2)
Box 8114
104 20 Stockholm
Website:
www.imy.se
E-mail:
[email protected]
Telephone: 1 Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protection of natural
08-657 61 00 persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Reference number: 2(2)
Date: 2025-02-21
Annex:
The Swedish Data Protection Authority's draft decision translated into Swedish
How to appeal
If you want to appeal the decision, you should write to the Privacy Protection Authority.
Please indicate in your letter the decision you are appealing against and the
amendment you are requesting. The appeal must have been received by the Integrity
Protection Authority no later than three weeks from the day you received the decision.
If the appeal has been received in due time, the Integrity Protection Authority will
forward it to the Administrative Court in Stockholm for consideration.
N may email the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. The contact details of the
authority can be found on the first page of the decision