Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s final decision. Only the Swedish version is authentic. 1(3)
Swedish ref.:
IMY-2022-7457 Final decision under the General Data
Nat ref: Protection Regulation
5605/157/19
IMI case register:
439503
Date:
Decision of the Swedish Authority for Privacy
2025-06-27 Protection
The case is closed.
Reasons for the decision
You have lodged a complaint with The Office of the Data Protection Ombudsman
against Etraveli group AB. The complaint has been submitted to the Swedish Data
Protection Authority (IMY), which is the lead supervisory authority pursuant to Article
56(1) of the General Data Protection Regulation (GDPR)1.
IMY shall process complaints about incorrect processing of personal data and, where
appropriate, investigate the subject matter of the complaint Article 57.1 f GDPR.
Article 77 of the GDPR provides for the rights of individuals to lodged a complaint with
a supervisory authority about an alleged breach of their personal data. Any data
subject who considers that the processing of personal data concerning him or her
infringes this regulation shall have the right to lodge a complaint with a supervisory
authority.
The main points of your complaint are as follows. You claim that you have bought a
flight ticket through supersaver.fi-website (which is owned by Etraveli group AB). While
doing so, you were asked to tick a box if you wished not to receive marketing. You
claim that this way of obtaining concent is in violation of the rules of the GDPR.
IMY notes that it is not apparent from the letter that your personal data has been
processed through the receipt of marketing via e-mail. Therefore, you are not
considered to be a data subject within the meaning of Article 77. The letter does not
Postal address:
Box 8114 therefore constitute a complaint within the meaning of the GDPR.
104 20 Stockholm
Sweden When examining the documentation in the case, IMY also considers that Etraveli
Website: group AB has not claimed that they support their processing of personal data to send
www.imy.se marketing on the legal basis of consent. According to IMY’s assessment, the reply
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2022-7457 2(3)
for Privacy Protection Date: 2025-06-27
from Etraveli group AB indicates that they support their processing on the basis of a
balancing of interests in Article 6(1)(f) of the GDPR.
The lawfulness of the processing of personal data requires the existence of a legal
basis in Article 6(1) of the GDPR. Consent is only one of a total of six legal grounds
that can provide support for the processing of personal data. Personal data may be
processed on the basis of a balancing of interests pursuant to Article 6(1)(f), if the
processing is necessary for the purposes of legitimate interests and the interests of the
data subject do not prevail. Marketing is, according to recital 47 of the GDPR, an
example of purposes that can provide support for processing personal data on the
basis of a balance of interests. When assessing whether a processing can be based
on a balancing of interests, account may be taken, among other things, of whether the
specific interest may conflict with other legislation. In Swedish national law, the
Marketing Act (2008:486) becomes applicable to the sending of marketing by e-mail.
Under Section 19(2) of the Marketing Act, a trader may, under certain conditions, use
e-mail without consent when marketing to a natural person. This applies if the natural
person has not objected to the use of the electronic address for marketing purposes
using electronic mail, the marketing relates to the trader’s own similar products, and
the natural person is clearly given the opportunity to object, free of charge and easily,
to the use of the information for marketing purposes when it is collected and at each
subsequent marketing message.
According to IMY’s assessment, there is no national obstacle to processing personal
data in the manner alleged in the case on the basis of a balance of interests in Article
6(1)(f) of the GDPR.
IMY considers that the information contained in the complaint does not call into
question the validity of any of the other legal bases for the processing in question.
Therefore, what you have stated does not give IMY reason to suspect any deficiency
in relation to the provisions of the GDPR.
The case should therefore be closed.
Swedish Authority Our ref.: IMY-2022-7457 3(3)
for Privacy Protection Date: 2025-06-27
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.