Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
23/03231-11 03.04.2025
Final decision - closure of case
Datatilsynet refers to your complaint dated 23 August 2023 regarding the collection and use
of your personal data, in addition to Datatilsynet’s letter to you on 9 December 2024 where
we asked for your comments to the case.
Decision
Datatilsynet rejects your complaint.
Background
We informed you on 18 January 2024 that this is a so-called cross-border case. The case is
cross-border because Ellos Group Sweden AB’s (hereinafter «Ellos») processing of personal
data substantially affects data subjects in more than one Member State. To ensure uniform
application of the GDPR in the EEA, data protection authorities across the EEA must
cooperate in the handling of cross-border cases.
The Swedish Data Protection Authority (also known as “IMY”) has acted as lead supervisory
authority in the handling of your complaint. We, and one other supervisory authority, have
been involved as concerned supervisory authorities.
Reasoning for our decision
The Swedish Data Protection Authority has investigated the subject matter of your complaint,
i.e., whether Ellos had legal basis to access your personal data from Folkeregisteret. Based on
their investigation, they have found that Ellos is not the controller for this processing, but
Ressurs Bank AB.
Ellos has acted as a processor for Ressurs Bank AB in connection with Ressurs Bank AB’s
regarding a factoring agreement, where Ressurs Bank AB has a customer relationship with
you. Processors shall act on behalf of the controller and Ressurs Bank AB is therefore
responsible for complying with the legal framework.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
The Swedish Data Protection Authority has therefore concluded that your complaint should
be rejected and that the case should be closed. All concerned supervisory authorities,
including us, agree with such conclusion.
You can submit a new complaint against Ressurs Bank AB whom is responsible for the
processing if you wish.
Please find below information from the Swedish Data Protection Authority. This information
explains how your complaint has been handled and the reasons as to why your complaint
should be rejected. As your complaint is to be rejected, the supervisory authority that received
your complaint – in this case us – is the one which will adopt the final decision pursuant to
Article 60(8) GDPR.
Since the case is cross-border, the following information is written in English. We can help to
translate it if needed. If so, we ask you to contact us.
Presentation of the supervisory case
IMY has initiated supervision regarding Ellos Group Sweden AB on November 22nd,
2024.
The supervision was initiated due to a complaint that has been submitted to IMY, as
lead supervisory authority pursuant to Article 56 of the GDPR. The handover has
been made from the supervisory authority of Norway where the complaint was lodged
in accordance with the provisions of the GDPR on cooperation in cross-border
processing.
The complaint stated i.e, that the complainant questioned the legal basis on which
Ellos Group Sweden AB (the company) had obtained the complainant’s data from the
Norwegian population register.
Ellos Group Sweden AB (‘the company’) submitted its statement on December 2nd,
2024, in which Ellos Group Sweden AB stated that the company is not the controller
of the processing of the personal data at issue. The company essentially stated the
following.
Resurs Bank AB (Swedish corporate identity number 516401-0208) is the data
controller for the described data processing. The company acts as a data processor
for Resurs Bank AB regarding a factoring arrangement, where the company acts as a
creditor to its e-commerce customers and where Resurs Bank AB purchases the
individual invoices. Resurs Bank AB thus has a customer relationship with the same
customer. The company has undertaken in its capacity as data processor to ensure
that Resurs Bank AB has accurate information about its customer and collects in
connection with the current address information.
The complainant has been given the opportunity to give a statement on the company’s
statement through the Norwegian Data Protection Authority, but has not given a
2
statement.
Grounds for the decision
Ellos Group AB has stated that the company is not the data controller for the
processing of personal data that is subject to supervision. The data controller is
according to the definition in Article 4(7) GDPR the legal person which, alone or
jointly with others, determines the purposes and means of the processing of personal
data. IMY finds no reason to question the company's information that Ellos Group
Sweden AB is not the data controller for the processing of data at issue. The case
should therefore be closed.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the
GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant
to Section 22(2) of the Norwegian Personal Data Act (in Norwegian:
personopplysningsloven). This decision can nevertheless be challenged before Norwegian
courts in accordance with Article 78(1) GDPR.
Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian
Public Administration Act regarding the information they receive about the complainant’s
identity, personal matters and other identifying information, and such information can only be
used to the extent necessary to safeguard their interests in this case. Any breach of this duty of
confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Kind regards
Head of Section
juridisk seniorrådgiver
This letter has electronic approval and is therefore not signed
3