Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s final decision. Only the Swedish version is authentic. 1(3)
CONTROLLER
Netlens Scandinavia AB
Swedish reference number:
DI-2021-10455 Final decision pursuant to Article 60
The Finnish SA reference under the General Data Protection
number:
In the former system:
257/182/2020, in the current
Regulation – Netlens Scandinavia AB
system: TSV/12/2020
IMI case register:
156781
Decision of the Swedish Authority for Privacy
Date: Protection
2025-07-28
The Swedish Authority for Privacy Protection finds that Netlens Scandinavia AB has
now complied with the complainant’s request for erasure. In the light of the above, IMY
finds no reason to take any further action in this case.
The case will hereby be closed.
Presentation of the supervisory case
On December 15th 2021, the Swedish Authority for Privacy Protection,
Integritetsskyddsmyndigheten (IMY), has initiated a supervision regarding Netlens
Scandinavia AB (Netlens) due to a complaint. The complaint has been submitted to
IMY, as lead supervisory authority pursuant to Article 56 of the General Data
Protection Regulation (GDPR)1. The handover has been made from the supervisory
authority of the country where the complaint has been lodged (The Office of the Data
Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland) in accordance with
the provisions of the GDPR on cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authority has been the data protection authority in Finland.
Netlens is a former warehouse company for the company that from
September 3rd 2022 is named Wanda the Dragon AB.
Postal address:
Box 8114
104 20 Stockholm
The complainant has essentially stated the following. He has requested erasure of his
Sweden social security number from Netlens on several occasions. Furthermore, it is a security
Website:
risk that his social security number is his password on Netlens' website.
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: DI-2021-10455 2(3)
for Privacy Protection Date: 2025-07-28
On December 22nd 2021 Netlens has essentially stated the following. They are the
controller concerning the processing to which the complaint relates. They have
received the complainant’s request for erasure on July 4th 2019. The complainant’s
social security number has been deleted from their system on July 31st 2019. Due to a
human error, they have failed to inform the complainant that the deletion was carried
out. They normally have a routine of sending a message of confirmation to a customer
who has made this type of request, once the request has been complied with. At the
time of the complaint, they did not have a fully automated system for notifying their
customers when changes of the customer profiles were done. Such a notification to a
customer had to be carried out manually. They have now updated their procedures for
their customer service staff with a clear checklist of what to do if a customer requests a
change or deletion of their personal data in their system. One of the bullet points on
the checklist is to notify the customer of the outcome of the customer’s request, as
long as the customer has not explicitly requested to not be further contacted by them.
On January 21st 2022, within the supervision, they have informed the complainant that
his request for erasure was complied with on July 31st 2019.
Furthermore, Netlens states that customer login on their website requires both
username and password. It is not possible for a user to only log in with their social
security number. The customer's social security number is also not the customer's
password. Their system automatically creates a new unique password when a
customer account is created upon the customer's first order with them. The customer
can choose a new password of their choice and even if the customer would then
choose to change their password to become identical to their social security number,
this information alone is not enough to log in. The customer also needs to provide a
username when creating a new customer account. If a customer creates an account
before placing their first order, they choose their own password.
IMY has sent Netlens' statement to the Finnish supervisory authority on
September 20th 2024, asking them to give the complainant the opportunity to comment
on it. On October 2nd 2024, the Finnish supervisory authority has forwarded the
information that the complainant has stated that the complaint is no longer relevant.
On March 27th 2025, the Finnish supervisory authority confirmed that they have not
heard any further from the complainant regarding this case which, in their point of
view, can lead to the assumption that the complainant is satisfied with the outcome, as
his request for erasure had been fulfilled by the controller.
Motivation for the decision
The applicant has requested erasure. According to Article 17(1) GDPR, the data
subject shall have the right to obtain from the controller the erasure of his or her
personal data without undue delay and the controller shall be obliged to erase
personal data without undue delay, under certain conditions set out in the relevant
article.
Both the complainant and Netlens have indicated to IMY that Netlens has now deleted
the complainant’s personal data in accordance with his request. IMY finds no reason to
question that this has happened. IMY therefore finds that Netlens has thus complied
with the complainant's right to erasure, Against this background, IMY finds no reason
to take any further action in the case.
The case should therefore be closed.
Swedish Authority Our ref.: DI-2021-10455 3(3)
for Privacy Protection Date: 2025-07-28
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.