1(5)
COMPLAINANT
See appendix
CONTROLLER
Ted Valentin Travel Labs AB
Swedish ref.:
IMY-2025-6716 Decision pursuant to Article 60 under
German ref: the General Data Protection
115/4-1.43
IMI case register:
Regulation – Ted Valentin Travel Labs
756408 AB
Date:
2025-11-25
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that the investigation does
not show that Ted Valentin Travel Labs AB has failed to comply with the Data
Protection Regulation (GDPR)1 in the manner alleged in the complaint.
The case is closed.
Presentation of the supervisory case
IMY has initiated a supervision against Ted Valentin Travel Holding AB with regard to
a complaint. The complaint was submitted to IMY as lead supervisory authority
pursuant to Article 56 of the GDPR. The handover was made from the supervisory
authority of the country where the complaint was lodged (Germany, Saxony-Anhalt) in
accordance with the provisions of the GDPR on cooperation in cross-border
processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authorities have been the data protection authorities in Austria, Germany, France, and
Italy.
The complainant has essentially stated the following.
Postal address:
Box 8114
The complainant discovered that information about her now terminated hairdressing
104 20 Stockholm
business, including her personal data, appears on the website www.gofriseur.de. The
Sweden
complainant states that the hairdressing business closed nine years ago and that the
Website:
information is therefore no longer relevant. According to the website's privacy policy
www.imy.se
section, the data controller for the processing of personal data on www.gofriseur.de is
E-mail:
[email protected] 1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 (8) 657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2025-6716 2(5)
for Privacy Protection Date: 2025-11-25
Heyplaces.co.uk (Heyplaces). The complainant contacted Heyplaces on several
occasions via the email address available on the website in question and requested
erasure of her personal data. Heyplaces has not complied with the complainant's
request.
The complainant found out that the domain owner of www.gofriseur.de is the company
Ted Valentin Holding AB. According to the information in the complaint, Ted Valentin
Holding AB is presumed to be the data controller for the processing of personal data
on the website www.gofriseur.de. However, the investigation has been directed
towards the company Ted Valentin Travel Labs AB (company registration number
5567126791), as the investigation has revealed that Ted Valentin Travel Labs AB is
responsible for the publication of personal data on the website. The investigation has
also shown that the two companies have the same owner.
IMY has asked Ted Valentin Travel Labs (hereinafter referred to as Ted Valentin)
questions regarding the complaint. On 11 July 2025, Ted Valentin answered that, after
receiving IMY's letter, they have removed the personal data referred to in the
complaint from the website www.gofriseur.de.
IMY has, via the German supervisory authority, given the complainant the opportunity
to comment on Ted Valentin's response. The complainant has not responded.
Motivation for the decision
Applicable provisions, etc.
The Swedish Data Protection Authority (IMY) shall handle complaints and, where
appropriate, investigate the matter to which the complaint relates (Article 57(1)(f) of the
GDPR).
It follows from Article 57(1)(f) of the GDPR that the IMY shall handle complaints from
data subjects who consider that their personal data are being processed in a manner
that infringes the GDPR. The provision further states that the IMY shall, where
appropriate, investigate the matter to which the complaint relates.
Recital 141 of the GDPR states that the investigation of complaints should be carried
out to the extent appropriate in the individual case. The Court of Justice of the
European Union has stated that the supervisory authority shall investigate such
complaints with due care.2 According to Section 9 of the Swedish Administrative
Procedure Act (2017:900)3, a case shall be handled as simply, quickly and cost-
effectively as possible without compromising legal certainty. According to Section 23 of
the Administrative Procedure Act, an authority shall ensure that a case is investigated
to the extent required by its nature.
The provision in Article 57(1)(f) of the Data Protection Regulation means that the
scope of the supervisory authority's investigation and assessment depends on the
circumstances of the individual case. When assessing the extent to which a complaint
should be investigated, consideration must be given to, among other things, the
seriousness of the alleged infringement and the interests of both the complainant and
the subject of the supervision in a swift and effective handling of the case. An
2
Schrems II judgment, Case C-311/18, EU:C:2020:559, paragraph 109.
3
Förvaltningslag (2017:900).
Swedish Authority Our ref.: IMY-2025-6716 3(5)
for Privacy Protection Date: 2025-11-25
exhaustive investigation of all legal and factual circumstances arising in connection
with the complaint is not required; rather, it is up to the supervisory authority to decide
to what extent the complaint should be investigated.4 IMY is therefore under no
obligation to use all the investigative powers available in each individual case.
Assessment
The investigation has shown that Ted Valentin Travel Labs AB is responsible for
assessing and deciding whether the personal data published on the website
www.gofriseur.de should be removed and is responsible for the removal of the
personal data. Against this background, IMY considers that the company can be
regarded as exercising decisive influence over the processing of personal data in such
a way that the company can be regarded as determining the purposes and means of
the processing.5 IMY therefore considers that Ted Valentin Travel Labs AB is the data
controller for the processing within the meaning of Article 4.7 of the Data Protection
Regulation.
The documents in the case show that Ted Valentin has now deleted the personal data
referred to in the complaint. The complainant has been given the opportunity to
comment on the company's response but has not responded. Against this background,
IMY finds no reason to take any further action in the case.
In summary, IMY finds that the investigation of the case does not show that Ted
Valentin Travel Labs AB has failed to comply with the Data Protection Regulation in
the manner alleged in the complaint.
The case shall therefore be closed.
This draft decision has been approved by Head of Unit after
presentation by legal advisor
4
This general consideration regarding the scope of the obligation to investigate are set out in Article 4 of the proposal
for a regulation laying down procedural rules for cross-border cases under the Data Protection Regulation, which the
Commission presented earlier. See in particular Article 4 and recital 6 of the proposal for a regulation. se https://eur-
lex.europa.eu/resource.html?uri=cellar:d02eb625-1a4d-11ee-806b-01aa75ed71a1.0005.02/DOC_1&format=PDF.
5
See the European Data Protection Board (EDPB) Guidelines 2020/07 on the concepts of controller and processor in
the GDPR, paragraph 35.
Swedish Authority Our ref.: IMY-2025-6716 4(5)
for Privacy Protection Date: 2025-11-25
Appendix
The complainant’s personal data
Swedish Authority Our ref.: IMY-2025-6716 5(5)
for Privacy Protection Date: 2025-11-25
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.