Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s final decision. Only the Swedish version is authentic. 1(5)
COMPLAINANT
See appendix
CONTROLLER
Boozt Fashion AB
Swedish ref.:
IMY-2024-11472 Final decision under the General Data
FI SA ref: Protection Regulation – Boozt
TSV/224/2022
IMI case register:
Fashion AB
156643
Date:
2025-04-04
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Boozt Fashion AB,
(Swedish company register no. 556710-4699), has complied with the complainant’s
request for erasure. Therefore, IMY finds no reason to investigate the case further.
The case is closed.
Presentation of the supervisory case
IMY has initiated supervision regarding Boozt Fashion AB (hereinafter Boozt/the
company) due to a complaint. The complaint has been submitted to IMY, as lead
supervisory authority pursuant to Article 56 of the GDPR. The handover has been
made from the supervisory authority of the country where the complaint has been
lodged (Finland) in accordance with the provisions of the GDPR on cooperation in
cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. Relevant supervisory authorities
have been the data protection authorities in Austria, Denmark, France, Germany, Italy,
Norway, Poland and Spain.
The investigation in the case concerns whether the company handled the
complainant’s request for erasure in accordance with more Article 17 of the GDPR.1
Postal address:
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 5
Swedish Authority Our ref.: IMY-2024-11472 2(5)
for Privacy Protection Date: 2025-04-04
The complaint
The complaint states, in essence, as follows. The complainant has attempted to order
goods from the company’s online store in January 2022. The company has then
informed the complainant that she is blocked from shopping with the company under
its FairUse policy based on the complainant’s previous purchasing behaviour. The
complainant previously placed orders with the company between 2012– 2017. During
this period, she placed a total of 43 orders, of which 26 orders have been returned fully
or partly. The company’s customer service has informed the complainant that she will
be permanently blocked from purchasing from the company in accordance with the
FairUse policy. The complainant has requested the erasure of her personal data.
Boozt has not erased all personal data regarding the complainant. In a reply to the
complainant regarding her request for erasure, the company stated that the personal
data processed for the purpose of enforcing your FairUse policy will be erased after
three years or, in exceptional cases, the data will be stored until further notice. The
complainant questions why her personal data has been retained.
Boozt Fashion AB´s statements
Boozt Fashion AB has essentially stated the following. The company has complied
with the complainant’s request for erasure to the extent possible at the time of the
request. This means that data regarding the complainant’s orders that was necessary
retain in order to comply with the Swedish Accounting Act (1999:1078) and the data
that was necessary to maintain the shopping restriction under the FairUse policy was
retained. In accordance with the principle of data minimisation, the data has
subsequently been subject to further erasure as it was no longer necessary to retain it
with the expiry of the retention period for a number of orders. Since January 2024, the
company also no longer processes the complainant’s data for the purposes of the
FairUse policy. However, Boozt continues to process data regarding the complaint that
is still necessary to retain for a number of orders placed between 2019 and 2022. The
company will delete this data when the retention period under the Swedish Accounting
Act has expired, which is the seventh year after the end of the calendar year in which
the transaction took place. Boozt continues to process contact information and logs
related to the request for deletion that is necessary to comply with the principle of
liability under the GDPR. The company will erase the data when the data are no longer
necessary for demonstrating that the company is fulfilling its obligations.
The complainant´s statement
The complainant was given the opportunity to comment on Boozt’s statement and
stated, inter alia, the following. The complainant has no objection to the fact that Boozt
processes data relating to her previous orders in accordance with the Swedish
Accounting Act. However, the complainant is of the opinion that Boozt did not comply
with her request for erasure, presented in January 2022, within a reasonable time with
regards to the data processed by Boozt for the purpose of maintaining its FairUse
policy. In support of this, the complainant attached an email of January 7th, 2022 from
the company’s customer service stating that her shopping restriction is valid until
further notice. This must be understood as meaning that the data processed to
maintain the restriction will never be erased. According to the company's terms of sale,
a permanent restriction may be considered in certain serious cases. The complainant
Page 2 of 5
Swedish Authority Our ref.: IMY-2024-11472 3(5)
for Privacy Protection Date: 2025-04-04
wishes to point out that Boozt has not presented how her previous orders have
violated the FairUse-policy. The company's actions appear to be arbitrary. The
FairUse-policy only became binding for the complainant when Boozt included the
policy in the terms of purchase and the complainant has accepted the terms. The
orders in question were placed in 2021 and 2022 and were cancelled by the company
in accordance with the FairUse-policy. Thus, the restriction appears to have been
based on orders placed by the complainant before the FairUse-policy became binding
for the complainant. The complainant therefore requested access to her personal data
in order to investigate the matter, but the register extract did not provide any answers
as to when the breaches of the policy have been committed.
Motivation for the decision
Applicable provisions, etc.
Pursuant to Article 17(1) of the GDPR, the data subject shall have the right to obtain
from the controller the erasure of personal data concerning him or her without undue
delay and the controller shall be obliged to erase personal data without undue delay
where one of the situations set out in points (a) to (f) applies. It follows from Article
17(1)(d) that the controller must delete the data if they have been processed
unlawfully.
Article 17(3) provides for a number of exceptions to the right to erasure. According to
Article 17(3)(b), the data subject does not have the right to have his or her data erased
pursuant to Article 17(1) if the processing is necessary for compliance with a legal
obligation requiring processing under Union or Member State law to which the
controller is subject.
In order for the processing to be lawful, the controller must rely on one of the legal
bases referred to in Article 6(1). According to Article 6(1)(c), processing is lawful if it is
necessary for compliance with a legal obligation to which the controller is subject.
Under Article 6(1)(f), processing is lawful if it is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party, unless the interests or
fundamental rights and freedoms of the data subject override and require the
protection of personal data.
It follows from Article 57(1)(f) of the GDPR that IMY must process complaints from
data subjects who consider that their personal data has been processed in breach of
the GDPR. It is also apparent from the provision that IMY is to examine, where
appropriate, the subject matter of the complaint. The CJEU has stated that the
supervisory authority must investigate such complaints with due care.2
Assessment
Processing of the complainant’s personal data on the basis of a legal obligation
The company states that it continues to process certain necessary data on orders
placed by the applicant in 2019-2022 due to the requirements of Chapter 7, Section 2
of the Swedish Accounting Act.
IMY does not find that there is any reason to question the legality or the necessity of
the company's processing of the complainant's personal data for the purposes of the
2 Judgment in SCHUFA Holding, Cases C-26/22 and C-64/22, EU:C:2023:958, paragraph 56.
Page 3 of 5
Swedish Authority Our ref.: IMY-2024-11472 4(5)
for Privacy Protection Date: 2025-04-04
company’s compliance to the Swedish Account Act on the basis of Article 6(1)(c) of the
GDPR. IMY therefore concludes that, at the time of the complainant’s request for
erasure, Boozt was not under an obligation to erase the data under Article 17.
Processing of the complainant’s personal data for the purpose of maintaining
the company’s FairUse-policy
It is apparent from the investigation in the case that Boozt has processed the
complainant’s personal data for the purpose of maintaining its FairUse-policy. The
complainant claims that, in January 2022, she received information from Boozt’s
customer service that her personal data would be processed indefinitely for this
purpose. However, Boozt has stated that the company has erased the complainant’s
personal data that was processed for this purpose in January 2024. IMY finds no
reason to question that the data is now erased. Therefore, IMY concludes that Boozt
has thereby complied with the complainant’s right to erasure of the personal data.
The complainant has claimed that Boozt unlawfully processed her personal data for
the purpose in question and that Boozt, under Article 17(1)(d) of the GDPR, was
obliged to erase the personal data when she made her request for erasure. In a
previous complaint-based supervisory case3, IMY has concluded that Boozt did not
have the right to continue processing another data subject’s personal data, in order to
maintain its FairUse-policy, on the basis of the legal basis invoked by the company
under Article 6(1)(f) of the GDPR after the person requested erasure. IMY based this
decision on the finding that the data subjects could not reasonably expect the
processing in question considering the information provided by the company in its
privacy policy.4 In view of the fact that the present case concerns the same processing
that took place during the same time period as in the previous supervisory case, IMY
considers that the complainant’s objection appears reasonable. However, in order for
IMY to be able to establish that there has been a breach in the present case, it would
be necessary to take further investigative measures in the case. Given that the
complainant’s personal data has now been erased and that the erasure was done
before IMY launched the present supervision, IMY considers that it is not proportionate
to take such measures. In these circumstances, and in the light of the fact that a long
period has elapsed since the alleged breach took place, IMY considers that the
complaint has been adequately investigated.
The case should therefore be closed.
This decision has been approved by specially appointed decision maker Maja
Welander after presentation by legal advisor Matilda Koistinen.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
3 IMY’s decision of January 5th, 2024 in DI-2020-10540.
4 The decision was based, inter alia, on documentation in the form of Boozt’s privacy policy from 2021.
Page 4 of 5
Swedish Authority Our ref.: IMY-2024-11472 5(5)
for Privacy Protection Date: 2025-04-04
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.
Page 5 of 5