3(9)
The Swedish Data Protection Authority
Reference number: IMY-2024-735
Date: 2025-08-07
Nota bene: This is an unofficial translation of the decision from the Swedish Authority for
Privacy Protection. Only the Swedish original is authentic.
Complainant
See appendix
Controller
Lindex AB
Reference no:
IMY-2024-735 Final decision after supervision under the
Finnish reference no: General Data Protection Regulation -
1621/161/2020
Date:
Lindex AB
2025-08-07
Decision of the Swedish Authority for Privacy
Protection
The (IMY) decides that Lindex AB (corporate identity number 556452-6514) has failed
to fulfil its obligation under Article 13(1)(c) of the GDPR1.
IMY decides that the corrective powers should not be used in the present case.
Case closed.
Presentation of the supervisory case
Background to the supervisory case
IMY has initiated supervision against Lindex in order to investigate a complaint against
the company.
The complaint has been transmitted by the supervisory authority of the country where
the complainant lodged his/her complaint (Finland) in accordance with the provisions of
the GDPR on cooperation in cross-border processing. IMY has handled the complaint
Postal address: as lead supervisory authority under Article 56 of the GDPR.
Box 8114
104 20 Stockholm
The questions in the case have been:
Website:
www.imy.se
E-mail: - If Lindex has had a legal basis for the processing of the complainant's personal
[email protected] data covered by the complaint,
Telephone:
08-657 61 00 - If Lindex has stored the complainant's personal data for a longer period than is
necessary for the purposes for which the personal data have been processed,
- If Lindex has handled the complainant's objection to processing for direct
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
Page 1 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
marketing, and
- If Lindex has informed the complainant about the purpose of, and the legal
basis for, the personal data processing covered by the complaint.
What the complainant has stated
The complainant has stated, inter alia, the following. In February 2020, she returned
goods to Lindex. The store then required her to write down her first name, last name
and phone number on the return receipt in order to carry out the return, despite the fact
that she had paid in cash. Lindex collects unnecessary personal data. She asked why
the personal data was collected and the store clerk replied that it follows from the
company's privacy policy. She asked to see the privacy policy but it was only available
on Lindex website and she does not have access to the internet on her phone. When
she later read the privacy policy, she discovered that there is a lack of information
about why personal data is collected when returning goods that have been paid for in
cash. Lindex has thus failed to state the purpose and legal basis of the collection, even
though she has specifically asked about this. She has also raised objections to the
collection of personal data and to processing for direct marketing purposes, but neither
the shop assistant nor the company's customer service has handled her objections.
What Lindex has stated
Lindex has stated, inter alia, the following.
Lindex collects the customer's name and telephone number in connection with the
return of goods paid for either in cash or by card, in order to handle (i) customer service
matters, such as returns, complaints, and warranty issues, and (ii) to prevent abuse of
Lindex’s return terms and conditions and, where applicable, to prevent and investigate
crimes against the company, particularly receipt fraud involving customers or
employees. Receipt fraud can occur, for example, when a customer creates false
receipt copies based on a previously issued original receipt. If discrepancies are
detected in the transaction system, Lindex may manually review return receipts from
the relevant days and, using the name and telephone number listed on those receipts,
follow up to determine whether the return was legitimate. The information on return
receipts is not collected or used for direct marketing purposes.
Lindex processes the data for the above-mentioned purposes on the basis of Lindex's
legitimate interest pursuant to Article 6(1)(f) of the GDPR. If the complainant’s data
should be considered constituting information about criminal offences within the
meaning of Article 10 of the GDPR, the data is processed pursuant to Section 5(1) of
the Swedish ordinance (2018:219) containing supplementary provisions to the GDPR.
The data should then be considered processed for the purpose of establishing,
exercising, or defending legal claims.
Lindex has a legitimate interest in processing names and telephone numbers on return
receipts in order to protect its business from the effects of criminal activity. Lindex
considers that this objective cannot be achieved through less intrusive means.
Therefore, the company considers that the processing of customers’ names and
telephone numbers is both necessary and proportionate. By limiting the collection to
names and telephone numbers, Lindex ensures that no more personal data is collected
than necessary. The data and its context are also of a relatively low sensitivity. In
addition, Lindex has implemented security measures to protect the data, as it is only
handled manually after the return has taken place. Lindex therefore considers that
Page 2 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
collecting this data for the stated purpose does not result in an undue intrusion into the
customer's personal privacy. In its balancing of interests, Lindex concludes that the
company’s legitimate interest outweighs that of the customer.
Each store’s plastic box containing return receipts is retained during the current year
and is manually cleared by Lindex at the end of the following calendar year. In
accordance with Lindex’s erasure procedures, the complainant’s data was erased at
the end of 2021. A retention period of 13 to 24 months is considered necessary to fulfil
the purpose of the processing. A shorter retention period would involve a clear risk that
return receipts could be discarded before potential legal claims are identified and
asserted. Deviations in transaction patterns need to be reviewed over an extended
period of time.
In its reply to the Finnish Data Protection Authority in 2020, Lindex stated that the
complainant’s objection had been dealt with. However, as Lindex only keeps
correspondence in customer service cases for three years, the company cannot go
back to 2020 to verify the complainant’s objection in this specific case.
Lindex informs its customers about Lindex privacy policy both on the purchase receipt
and the return receipt. The privacy policy is available on Lindex website where the
customer can read how Lindex processes personal data. Lindex's privacy policy from
2020 contained information that customers' personal data could be processed to (i)
handle returns and warranty matters, (ii) handle customer service matters and (iii)
prevent, prevent and investigate crimes against the company and that this was done in
order to fulfil agreements with the customer and with the support of Lindex's legitimate
interest. Since then, Lindex has changed the legal basis for the first purpose and now
relies on legitimate interest also for this purpose.
To support its statements, Lindex has submitted the company's privacy policy from
2020.
IMY’s investigation
The case was handled through an exchange of letters. Due to the cross-border nature
of the supervisory matter, IMY made use of the cooperation and consistency
mechanisms set out in Chapter VII of the GDPR. The relevant supervisory authorities
included the data protection authorities of Finland, Ireland, Norway, Latvia, France,
Estonia, Slovenia, Denmark, Spain, and Slovakia.
On 25 June 2024, IMY asked the Finnish Data Protection Authority to forward Lindex
submissions to the complainant. IMY also requested that the Finnish authority inform
the complainant that failure to respond within two weeks might result in IMY settling the
case based on the materials already on file.
On 14 August 2024, the Finnish Data Protection Authority confirmed that the
complainant had been given the opportunity to comment on the company’s
submissions, but had not provided a response.
Reasons for the decision
Applicable provisions, etc.
It follows from Article 57(1)(f) of the GDPR that IMY must process complaints from data
Page 3 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
subjects who consider that their personal data are being processed in breach of the
GDPR. It also follows from that provision that IMY is to examine, where appropriate, the
subject matter of the complaint. The CJEU has stated that the supervisory authority
must investigate such complaints with due care.2
Under Section 23 of the Swedish Administrative Procedure Act (2017:900), an authority
must ensure that a case is investigated to the extent required by its nature.
Processing is lawful only if and to the extent that one of the conditions of Article 6 of the
GDPR is met. Article 6(1)(f) states that processing is lawful if it is necessary for the
purposes of the legitimate interests pursued by the controller or by a third party, unless
the interests or fundamental rights and freedoms of the data subject override and
require the protection of personal data.
Under Article 5(1)(e) of the GDPR, personal data may not be kept in a form which
permits identification of the data subject for longer than is necessary for the purposes
for which the personal data are processed (storage limitation).
Pursuant to Article 21(2) of the GDPR, the data subject shall have the right to object at
any time to processing of personal data concerning him or her for direct marketing
purposes. Where the data subject objects to the processing for direct marketing
purposes, the personal data pursuant to Article 21(3) shall no longer be processed for
such purposes.
It follows from Article 13(1)(c) of the GDPR that, where personal data are collected from
the data subject, the controller must inform the data subject, inter alia, of the purpose
of, and legal basis for, the processing.
The controller shall take appropriate measures to provide the data subject with all
information referred to in, inter alia, Article 13 in a concise, transparent, intelligible and
easily accessible form, using clear and plain language. The information shall be
provided in writing, or in any other form, including, where appropriate, in electronic
form. If requested by the data subject, the information may be provided orally, provided
that the identity of the data subject is proven by other means.
IMY’s assessment
IMY's duty of investigation
IMY has asked questions to Lindex about the complaint. The complainant was then
given the opportunity to comment on Lindex’s answers to the questions. IMY has
therefore investigated the case to the extent required by Article 57(1)(f) of the GDPR
and Section 23 of the Swedish Administrative Procedure Act.
Legal basis, storage limitation and right to object
IMY considers that Lindex had a legitimate interest in protecting its operations against
criminal activities such as receipt fraud. IMY also finds that, based on the information in
the case, there is no reason to question whether the processing of personal data was
necessary to achieve that purpose. Furthermore, IMY notes that the personal data in
question was not of a sensitive nature and that the processing was limited in scope.
The interests or fundamental rights and freedoms of the complainant do not override
Lindex’s legitimate interest, and the processing cannot be considered disproportionate.
2 Court of Justice of the European Union, Judgment in Case C-311/18, EU:C:2020:559 (Schrems II), para. 109.
Page 4 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
IMY therefore concludes that the investigation does not indicate that Lindex acted in
breach of Article 6 of the GDPR in the manner alleged by the complainant.
IMY considers that there is no reason to question that the data was erased in the
manner stated by Lindex. IMY also finds no reason to question the retention period in
light of the purpose of the processing. IMY therefore concludes that the investigation
does not indicate that Lindex breached Article 5(1)(e) of the GDPR in the manner
alleged by the complainant.
Lindex states that it has addressed the complainant’s objection but has not been able
to substantiate its position due to the time that has elapsed since the complainant’s
data was last processed. IMY considers that Lindex has reasonable grounds for not
providing evidence to support its position. The complainant has been given the
opportunity to comment on Lindex’s statements but has not responded.
Nor is there any information suggesting that Lindex used the personal data at issue in
the complaint for direct marketing purposes. In light of these factors, IMY considers that
the investigation does not show that Lindex acted in breach of Article 21 of the GDPR
in the manner alleged by the complainant.
Information about the processing of personal data
IMY notes that the controller is responsible for taking appropriate measures under
Article 12 of the GDPR to provide the information referred to, inter alia, in Article 13.
The controller should take into account all the circumstances surrounding the collection
and processing of data when deciding on the appropriate conditions and formats when
providing this information. In particular, the appropriate measures must be assessed in
light of the experience of the product/service user.3 The controller must take active
steps to provide the relevant information to the data subject or clearly direct the data
subject to where the information can be found. The information addressed to data
subjects should be made available in a single location or document (e.g. in digital form
on a website or in paper format) that is easily accessible to data subjects who wish to
review the full content. 4
Regardless of the format used, the most important information should generally be
provided at the first point of contact with the data subject. This key information includes
the purposes of the processing, the identity of the controller, the data subject’s rights,
and any main consequences of the processing, particularly aspects that may be
unexpected or surprising to the data subject. A summary of the information required
under, inter alia, Article 13 of the GDPR may for example, be provided by sending a
copy of the privacy policy by email or sharing it during a phone call with the data
subject.5
IMY has reviewed the privacy policy that Lindex submitted at the time of the complaint.
The policy stated, among other things, that Lindex processed personal data to prevent
misuse of a service, to prevent and investigate crimes against the company, and to
investigate or prevent fraud or other violations of the law – for example, through
incident reporting in stores. The legal basis for the processing of personal data for
these purposes was either a legal obligation or Lindex’s legitimate interest in preventing
misuse of a service and in preventing and investigating crimes against the company.
3 Article 29 Working Party, Guidelines on transparency under Regulation (EU) 2016/679, WP260rev.01, adopted on 29
November 2017, p. 24.
4 WP260 rev.01, p. 33.
5 WP260 rev.01, p. 38.
Page 5 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
The categories of personal data processed for these purposes included purchase and
user-generated data (such as mouse clicks and visit history), social security numbers,
video recordings from surveillance cameras, data related to the devices used by the
customer and their settings (such as language preference, IP address, browser
settings, time zone, operating system, screen resolution, and platform), as well as
information about how Lindex’s digital services were used.
The privacy policy further stated that Lindex processed personal data in order to handle
customer service matters, such as communicating with customers and responding to
inquiries received via telephone or through digital channels. It also stated that personal
data was processed to enable identification and to investigate complaints and support
matters. The legal basis for processing personal data for these purposes was the
fulfillment of the purchase agreement. The categories of personal data processed
included name and contact details (e.g. address, email address, and telephone
number).
IMY considers that there is no reason to question Lindex’s statement that the
complainant received information about the company’s privacy policy both through the
purchase receipt and the return receipt, and that the policy was available on Lindex’s
website. However, IMY notes that when a data subject has limited access to the privacy
policy, the controller should take appropriate steps to provide at least the most
important information by other means – for example, by sending a copy of the policy via
email, reading it aloud, or providing it in physical format.
IMY considers that the case does not contain sufficiently specific information about the
meeting in question between the complainant and Lindex staff to conclude that the
company failed to take appropriate steps, in the individual case, to provide the
information in an alternative manner. However, IMY notes that the version of the
privacy policy in force at the time lacked information indicating that the name and
telephone number were specifically processed for the purpose of preventing abuse, or
for investigating or preventing fraud or other violations of the law.
Due to the way the privacy policy was designed, IMY considers that the complainant
cannot be regarded as having received accurate information about the purpose and
legal basis for the personal data processing in question. IMY therefore concludes that
Lindex failed to fulfill its obligation under Article 13(1)(c) of the GDPR.
Choice of intervention
In the event of infringements of the GDPR, IMY has a number of corrective powers,
including reprimands, injunctions and fines. This follows from Article 58(2)(a) to (j) of
the GDPR. According to recital 129 of the GDPR, IMY must take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. In the case of a minor infringement, IMY may, as stated in recital 148 of
the GDPR, instead of imposing a fine, issue a reprimand pursuant to Article 58(2)(b).
Aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement and previous relevant infringements, must be taken into
account.
Page 6 of
of 10
11
The Swedish authority for Privacy Reference number: IMY-2024-735 8(9)
Protection Date: 2025-08-07
The CJEU has stated that, with regard to the remedial measures listed in Article 58(2)
of the GDPR, the supervisory authority has a margin of discretion as to the choice of
appropriate and necessary measures.6
IMY notes the following relevant facts. The current supervision concerns an individual
complaint against Lindex, and more than four years have passed since the event to
which the complaint relates. The case involves the processing of a limited amount of
personal data of a less privacy-sensitive nature. At the time of the processing, Lindex’s
privacy policy included the information that names and telephone numbers were
processed, although for purposes other than preventing abuse, investigating or
preventing fraud or other violations of the law. The policy also included information that
Lindex processed personal data other than names and telephone numbers for the
purpose of preventing abuse and investigating or preventing fraud or other legal
violations. In light of this, IMY considers that the identified deficiency was of a less
severe nature. Lindex has not previously been found to have infringed the GDPR.
Following an overall assessment of the circumstances of the infringement, IMY
considers that there is no need to exercise corrective powers in this case.
This decision was taken by the decision-maker after a presentation
by the legal officer .
6 Court of Justice of the European Union, Judgment of 7 December 2023, Joined Cases of C-26-22 and C-64-22 ((UF
and AB v Land Hessen and Schufa Holding AG), para. 68.
Page 7 of
of 10
11
ty for Privacy Reference number: IMY-2024-735 8(9)
Date: 2025-08-07
Appendix
Complainant’s personal data
Page 8 of
of 10
11
The Privacy Protection Authority Reference number: IMY-2024-735 9(9)
Date: 2025-06-18
How to appeal
If you wish to appeal the decision, you should write to IMY. Please indicate in your letter
the decision you are appealing against and the amendment you are requesting. The
appeal must be received by IMY within three weeks of the date on which you received
the decision. However, if you are a party representing the public, the appeal must be
received within three weeks of the date of notification of the decision. If the appeal has
been received in due time, IMY will forward it to the Administrative Court in Stockholm
for consideration.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. The contact details of the
authority can be found on the first page of the decision.
Page 9 of
of 10
11
1(1)
Privacy Protection
B/Br B 7e Authority
Annex to draft supervisory decision -
Complainant's personal data
Name:
Reference
number:
IMY-2024-735
Date: 2025-06-
18
Postal address:
Box 8114
104 20 Stockholm
Website:
www.imy.se
E-mail:
[email protected]
Telephone: 08-
657 61 00
Page 10 of
of 10
11
The Swedish Data Protection Authority
Reference number: IMY-2024-735
Date: 2025-08-07
Nota bene: This is an unofficial translation of the decision from the Swedish Authority for
Privacy Protection. Only the Swedish original is authentic.
Appendix to final decision –
complainant’s personal data
Reference no:
IMY-2024-735
Finnish reference no: Name:
1621/161/2020
Date:
2025-08-07
Postal address:
Box 8114
104 20 Stockholm
Website:
Postadress:
www.imy.se
Box 8114
104 20 Stockholm
E-mail:
[email protected]
Webbplats:
Telephone:
www.imy.se
08-657 61 00
E-post:
[email protected]
Telefon:
08-657 61 00
Page 11 of 11