Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(5)
COMPLAINANT
See appendix
CONTROLLER
Aller Media AB
Swedish ref.:
IMY-2023-16452 Final decision under the General Data
Austrian ref: Protection Regulation – Aller Media
D130.868
IMI case register:
AB
378702
Date:
2025-04-28
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Aller Media AB (556002-
8325) has processed personal data in breach of Article 6(1)(f) of the General Data
Protection Regulation (GDPR)1 by processing the complainant´s personal data without
legal basis.
IMY issues a reprimand to Aller Media AB pursuant to Article 58(2)(b) of the GDPR.
Presentation of the supervisory case
IMY has initiated supervision regarding Aller Media AB (Aller or the company) due to a
complaint. The complaint is one of several complaints filed with the European Data
Protection Authorities regarding cookies and cookie banners. The complaints mainly
concern the design of cookie banners, the placement of cookies and the subsequent
processing of personal data after the cookies have been placed on the complainant's
browser or device. To facilitate cooperation on these complaints, a ‘Cookie Banner
Taskforce’ was created within the European Data Protection Board (EDPB).
In view of the cross-border nature of the processing, IMY has made use of the
cooperation and consistency mechanisms provided for in Chapter VII of the GDPR.
The supervisory authorities concerned have been the Data Protection Authority in
Austria, Denmark and Italy.
The complainant has essentially stated the following. Aller has not had a legal basis to
process the complainant’s personal data through the use of cookies on its website
Postal address:
recept.se on 21 May 2021. There was no legitimate interest or valid consent. By
Box 8114
104 20 Stockholm
reinforcing in the cookie banner that consent is the legal basis, Aller has led data
Sweden subjects to believe that they do not have a choice to object under Article 6(1)(f). It has
Website:
not been possible to object to the processing in the first layer and there has been no
www.imy.se other easy way to exercise their right to object to the processing. The only option to
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2023-16452 2(5)
for Privacy Protection Date: 2025-04-28
object has been hidden in the banner. Nor has it been possible to refuse cookies in the
first layer and the company has thus made it more difficult to refuse the processing of
personal data. The design of the cookie banner has through colour selection, contrast
and links also been misleading, which means that it has not been possible to give an
informed and voluntary consent in accordance with the GDPR. This is also contrary to
the principle of transparency and information.
Aller has essentially stated the following. In 2021, Aller used both legitimate interest
and consent as the legal basis, following the recommendation of the company's
Consent Management Platform (CMP) provider to meet both the requirements of the
GDPR and to comply with the recommendations of the Interactive Advertising Bureau
(IAB). Legitimate interest was thus retained but the company made adjustments in
accordance with IAB's requirements as well as an adaptation in the text by explicitly
mentioning the requirement for consent in the cookie banner. Aller's assessment is
that, at least since 2023, only consent is the legal basis. Aller has only two purposes
that are always active and these are necessary cookies and the visitor's privacy
choices.
When given the opportunity to comment on Aller’s statement, the complainant stated
that the parts of the complaint relating to the possibility of refusing cookies in the first
layer, misleading link design, misleading colour and contrast on buttons and that it was
not as easy to withdraw as to give consent have been remedied. The complainant also
stated that Aller does not have a legal basis for storing data relating to the non-consent
of visitors and that it shares that information with other companies. The complainant
submitted screenshots from Aller’s website from 2024.
The scope of the case
The Swedish Post and Telecom Authority is the sole competent supervisory authority
over the Electronic Communications Act (2022:482), which contains specific
requirements for the storage of cookies in terminal equipment or the collection of data
from such equipment. However, the personal data processing that takes place after
collection, such as analysis or profiling, is subject to the provisions of the GDPR,
where IMY is the competent supervisory authority. Against that background, IMY’s
investigation has been limited to the processing of personal data that took place after
the data was collected and the deficiencies stated in the complaint relating to that
subsequent processing.
During the handling of the case, the complainant has stated that the parts concerning
the possibility to refuse in the first layer, misleading link design, misleading colour and
contrast on buttons and that it has not been as easy to withdraw as to give consent
have now been remedied. IMY therefore finds no reason to investigate this further.
IMY’s assessment in this case is whether Aller has had a legal basis to process the
complainant’s personal data through the use of cookies on its website on 21 May
2021. The complainant raised new objections to Aller’s processing of personal data
relating to the design of the cookie banner in 2024. IMY considers that the complaint
has been adequately investigated without extending it and will therefore not take a
position regarding these objections.
Swedish Authority Our ref.: IMY-2023-16452 3(5)
for Privacy Protection Date: 2025-04-28
Motivation for the decision
Applicable provisions, etc.
According to the principle of accountability, the controller must be able to demonstrate
that the processing of personal data is carried out in accordance with data protection
rules.2
Processing of personal data is only lawful if one of the conditions set out in Article 6 of
the GDPR is met. Legitimate interest according to 6(1)(f) is one of the legal grounds
that can justify a personal data processing.
In order for processing to be based on a balancing of interests (also called legitimate
interest) pursuant to Article 6(1)(f) of the GDPR, three conditions must be met. First,
the controller or third party must have a legitimate interest. Secondly, the processing of
personal data must be necessary to meet the legitimate interest in question. Thirdly,
the interests or fundamental rights and freedoms of data subjects must not override
the legitimate interests (balancing of interests).3
Recital 47 states that a legitimate interest may exist, for example, where there is a
relevant and appropriate relationship between the data subject and the controller, such
as the data subject being a customer of or working for the controller. In any event, a
legitimate interest requires a careful assessment, including whether the data subject
can reasonably expect, at the time and in connection with the collection of personal
data, that data processing for this purpose may take place. In particular, the interests
and fundamental rights of the data subject could override the interests of the controller
where personal data are processed in circumstances where the data subject cannot
reasonably expect any further processing.
The EDPB Guidelines on the processing of personal data based on Article 6(1)(f)
GDPR state that three criteria are required for a legitimate interest to exist.4 The
interest must be lawful, which means that it must not conflict with EU or national law.
Whether the interest is commercial does not determine its legality, what is decisive is
whether it is lawful, specific and constitutes a genuine and present interest.5
Furthermore, the interest must be clearly articulated and relate to an actual interest
that exists at the time of the processing and is not hypothetical.6
Assessment
The question in the case is whether Aller was able to justify the processing of the
complainant’s personal data on 21 May 2021 on the basis of Article 6(1)(f) of the
GDPR.
2 Articles 5(2) and 24 of the GDPR.
3 See judgments of the Court of Justice of 4 May 2017, Rīgas satiksme, C‐13/16, EU:C:2017:336, paragraph 28; of 11
December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 40; of 17 June
2021, M.I.C.M., C-597/19, EU:C:2020:1063, paragraph 106; and of 4 July 2023, Meta Platforms and Others, C-
252/21, EU:C:2023:537, paragraph 106.
4 See EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0, paragraph
17.
5 See judgment of the Court of Justice of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C-621/22,
EU:C:2024:857, paragraph 49.
6 See CJEU, C-708/18, paragraph 44.
Swedish Authority Our ref.: IMY-2023-16452 4(5)
for Privacy Protection Date: 2025-04-28
Aller provides information that cookies are used on the website in a so-called cookie
banner that is displayed, among other things, when the user first enters the website. In
the first layer of the cookie banner, as it appeared at the time of the complaint, there
was a consent button and a link to display purposes. The information text in the first
layer stated that you can consent or manage your choices, including the right to object
where legitimate interest is used. The possibility to object did not exist in the first layer
of the banner. It was further stated that the company processes data in order to offer
the use of precise geodata, create personalised advertising and create a personal
profile. In order to refuse any type of processing, a data subject first had to refuse
consent and then go ahead and find the option to object to processing for certain
purposes.
The following assessment is based on this cookie banner and the company's website
at the time.
Aller has stated in its cookie banner that the company has a legitimate interest in
processing data for profiling and precise geodata. In its communication with IMY, the
company has not argued that it actually had a legitimate interest in processing the
data. Aller has instead referred to their CMP provider recommending the company to
have both consent and legitimate interest as a legal basis for this type of personal data
processing. With regard to the accountability in the GDPR, IMY does not consider that
a controller can disclaim the responsibility to ensure that there is a legal basis for the
company's personal data processing by referring to a supplier's recommendations.
IMY therefore finds that Aller is responsible for ensuring that there is a legal basis for
the processing of personal data by the company.
IMY believes that the requirement for consent to collect data via cookies7 provides a
particularly strong privacy protection and gives data subjects the opportunity to choose
and control how their personal data is used. If the collected data is further processed
at a later stage on the basis of legitimate interest as a legal basis, this specific privacy
protection risks being eroded. This particular privacy protection of the data subject
should therefore be considered in the balancing of interests under Article 6(1)(f).
During IMY's investigation of the case, Aller has not clearly stated what their legitimate
interest in the personal data processing in question was, or how a balance of interests
has been made. IMY’s assessment is that the complainant could not expected such
processing of personal data merely by visiting Aller’s website. Furthermore, the
complainant was only able to object to processing after having refused consent in the
cookie banner. In the light of this, IMY’s assessment is that Aller has not demonstrated
that it was able to justify the processing of personal data on the legal basis of
legitimate interest. In conclusion, Aller has infringed Article 6(1)(f) of the GDPR by
processing the complainant’s personal data without a lawful basis.
Choice of corrective measure
Pursuant to Article 58(2) and Article 83(2) of the GDPR, IMY has the power to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to or instead of the other
measures referred to in Article 58(2), such as injunctions and prohibitions.
Furthermore, Article 83(2) determines the factors to be considered when imposing
7 Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the
processing of personal data and the protection of privacy in the electronic communications sector (Directive on
privacy and electronic communications) and Chapter 9, Section 28 of the Electronic Communications Act (2022:482).
Swedish Authority Our ref.: IMY-2023-16452 5(5)
for Privacy Protection Date: 2025-04-28
administrative fines and when determining the amount of the fine. In the case of a
minor infringement, IMY may, as stated in recital 148, instead of imposing a fine, issue
a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating circumstances of
the case need to be taken into consideration. These could include the nature, gravity
and duration of the infringement as well as past infringements of relevance.
IMY notes the following relevant facts. The current supervision includes an
examination of whether Aller had a legal basis to process an individual complainant's
personal data. IMY has assessed that the company has not had a legal basis to
process the complainant's personal data. Aller has since IMY initiated the supervision
made some changes to its cookie banner and now states that they have consent as a
legal basis. The company has not previously been found to have infringed the GDPR.
Against this background, IMY considers this a minor infringement within the meaning
of recital 148 and that Aller Media AB is to be given a reprimand pursuant to Article
58(2)(b) of the GDPR.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.