Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic.
1(3)
COMPLAINANT
See app
CONTROLLER
Unilever Sverige AB
Swedish ref.:
IMY-2024-5687 Decision pursuant to Article 60 under
IMI case register: the General Data Protection
CR 631039
Date:
Regulation – Unilever Sverige AB
2025-11-18
Decision of the Swedish Authority for Privacy
Protection
The case is closed.
Presentation of the supervisory case
IMY has initiated supervision regarding Unilever Sverige AB (the company) due to a
complaint. The complaint has been submitted to IMY, as lead supervisory authority
pursuant to Article 56 of the GDPR. The handover has been made from the
supervisory authority of the country where the complaint has been lodged in
accordance with the provisions of the GDPR on cooperation in cross-border
processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authorities have been the data protection authorities in Luxemburg, Germany, Estonia,
Hungary, Italy, Norway and Denmark.
The complainant states that the company did not have a legal basis for processing the
complainant's personal data through the use of cookies on its website. There was no
valid consent in accordance with the GDPR. Nor was the complainant able to withdraw
his consent as easily as he had given it.
In its response, Unilever Sverige AB essentially stated that it had processed the
complainant's personal data on the basis of Article 6(1)(a) of the GDPR, that consent
Postal address:
had been obtained, that clear information had been provided on how consent could be
Box 8114
104 20 Stockholm
withdrawn, and that consent could be withdrawn by clicking on a floating banner.
Sweden
Website:
On September 11, 2025, the Austrian Data Protection Authority announced that the
www.imy.se complainant would like to withdraw her complaint.
E-mail:
[email protected]
Telephone:
+46 8-657 61 00
Swedish Authority for Privacy Our ref.: IMY-2024-5687 2(3)
Protection Date: 2025-11-18
Motivation for the decision
IMY shall handle complaints about incorrect processing of personal data and, where
appropriate, investigate the matter to which the complaint relates (Article 57(1)(f) of the
GDPR). The Court of Justice of the European Union has stated that the supervisory
authority shall investigate such complaints with due care.1 According to Section 23 of
the Administrative Procedure Act (2017:900), an authority shall ensure that a case is
investigated to the extent required by its nature.
The complainant has announced that she wishes to withdraw her complaint. Against
this background, IMY finds no reason to take any further action in the case.
The case is therefore closed.
__________________________
This decision has been made by specially appointed decision maker
after presentation by legal advisor .
Appendix
The complainant’s personal data
Swedish Authority for Privacy Our ref.: IMY-2024-5687 3(3)
Protection Date: 2025-11-18
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.