Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(2)
COMPLAINANT
See appendix
CONTROLLER
Easypark AB
Swedish ref.:
IMY-2025-2171 Final decision pursuant to Article 60
Dutch ref: under the General Data Protection
2024-002798
IMI case register:
Regulation – Easypark AB
724983
Date:
2025-05-29
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection finds that Easypark AB, 556626-7893,
has complied with the complainant’s request for access. In the light of the above, IMY
finds no reason to take any further action in this case.
The case should therefore be closed.
Presentation of the supervisory case
IMY has initiated supervision regarding Easypark AB (Easypark or the company) due
to a complaint that concerns the right to erasure. The complaint has been submitted to
IMY, as lead supervisory authority pursuant to Article 56 of the GDPR. The handover
has been made from the supervisory authority of the country where the complaint has
been lodged (The Netherlands) in accordance with the provisions of the GDPR on
cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR.
The complainant has essentially stated the following. The complainant has requested
erasure of his personal data by e-mail after that Easypark was subject to a
cyberattack. The complainant was then asked to fill in a form on the company’s
website which required him to fill in his personal data again, something he did not want
to do because he lacked trust for the company’s processing of personal data. The
Postal address:
complainant considers that his e-mail must have been sufficient to deal with his
Box 8114
104 20 Stockholm
request.
Sweden
Website:
Easypark has essentially stated the following. The reason why the complainant’s
www.imy.se request for erasure by e-mail was not handled was due to human error. The
E-mail:
complainant’s personal data was deleted on January, 31 2025. Following a cyber
[email protected] attack in December 2023, the company received a large number of requests during the
Telephone: period in question. During that period, the web form, which was not mandatory to use,
+46 (8) 657 61 00 was the preferred method for submitting requests. The structured format of the web
Page 1 of 2
Swedish Authority Our ref.: IMY-2025-2171 2(2)
for Privacy Protection Date: 2025-05-29
form helped Easypark to gather all information necessary and thereby streamlining the
handling of these requests. The company now has an updated process to handle the
increased number of requests and has also expanded its workforce and provided
additional training about the data subject request process. EasyPark processes all
requests received through various channels, such as telephone and e-mail, provided
that the individual's identity can be securely verified. All verifiable requests, regardless
of submission method, will be handled in accordance with applicable data protection
regulations.
The applicant has been given the opportunity to comment on Easypark’s statement
and has stated, inter alia, that he wishes confirmation of the erasure of his data.
Easypark has therefore submitted a screenshot from its customer management
system which, according to Easypark, shows that no search results were found when
searching for the applicant’s personal data.
Motivation for the decision
The complainant has requested the erasure of his personal data pursuant to Article 17
in the GDPR. The provision means that the controller is obliged, under certain
circumstances, to erase the personal data of a data subject when receiving such
request.
Easypark has informed IMY that the company erased the complainant’s personal data
in January 2025 and has also submitted a screenshot from its customer management
system to support this fact. IMY finds no reason to question the company’s information
and therefore notes that Easypark has now complied with the complainant’s right to
erasure. Furthermore, the company states that it has taken steps to ensure that all
verified requests are met regardless of the channel through which they were
submitted. In the light of the above, IMY finds no reason to take any further action in
the case.
The case should therefore be closed.
This decision has been made by the specially appointed decision maker
.
Appendix
The complainant’s personal data
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.
Page 2 of 2