FiS - 13308-22

Summary

The Stockholm Administrative Court ruled that individuals filing GDPR complaints have party status and can demand a decision within six months, even if the Data Protection Authority (DPA) is conducting a parallel investigation. This decision upholds the complainant's right to an effective remedy and prevents them from being disadvantaged by the DPA's procedural choices.

Full text

Help FiS - 13308-22: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 13:45, 13 June 2023 view sourceNg (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators206 edits← Older edit Latest revision as of 08:49, 24 June 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators117 edits Line 12: Line 12: |ECLI=|ECLI= |Original_Source_Name_1=|Original_Source_Name_1=IMY |Original_Source_Link_1=https://gdprhub.eu/images/c/c2/Priloga_1_-_sodba_13308-22.pdf|Original_Source_Link_1=https://gdprhub.eu/images/c/c2/Priloga_1_-_sodba_13308-22.pdf |Original_Source_Language_1=Swedish|Original_Source_Language_1=Swedish Latest revision as of 08:49, 24 June 2026 FiS - 13308-22 Court: FiS (Sweden) Jurisdiction: Sweden Relevant Law: Article 57(1)(f) GDPR Article 60(8) GDPR Article 77 GDPR Article 78 GDPR § 12 Förvaltningslagen (2017:900) Decided: 31.10.2022 Published: Parties: Spotify RR National Case Number/Name: 13308-22 European Case Law Identifier: Appeal from: IMY (Sweden) Appeal to: Original Language(s): Swedish Original Source: IMY (in Swedish) Initial Contributor: n/a The Stockholm Administrative Court held that Swedish law does not deny complainants under Article 77 GDPR to have party status. Consequently, they may demand a decision after six months under Swedish Administrative law. This also applies if the DPA opened a parallel ex officio investigation into a similar matter and the same company. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months. The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under Article 77 GDPR as the complainant in such a case does not have a party status, according to the preparatory work of the Act. Holding The Administrative Court held that in light of recitals 141 and 143 of the GDPR, Article 8 of the CFR, Articles 57(1)(f), 77, and 78 GDPR a complainant has a number of individual rights. In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22). A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation. In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four weeks. The case was referred back to the IMY for reconsideration. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details. Page 1 (9) ADMINISTRATIVE COURT JUDGMENT Case no IN STOCKHOLM 2022-10-31 13308-22 Department 5 Announced in Stockholm COMPLAINT [REDACTED] Agent: Lawyer COUNTERPART The Swedish Privacy Protection Authority OVERRULED DECISION The Data Protection Authority's decision 2022-05-31, see appendix 1 THE MATTER Rejected request for case to be settled _____________________ DECISION OF THE ADMINISTRATIVE COURT The administrative court approves the appeal and cancels the appealed the decision and refers the case back to the Privacy Protection Authority for processing in accordance with what is stated below. 3 3 Visiting address Opening hours Postal address E-mail 4 Tegeluddsvägen 1 Monday–Friday avd31 fst@dom.se 1 08:00–16:00 115 76 Stockholm . Phone Website o 08-561 680 00 www.domstol.se/forvaltningsratten-i- D Stockholm/ Page 2 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM CLAIMS, M.M. claims that the administrative court must establish that he has standing as a party to the supervisory case and show the case back to the Privacy Protection Authority heten (IMY) for review in substance according to § 12 of the Administration Act (2017:900), FL. He brings forward i.a. following. There is no express legal support in Swedish law for a complainant shall not have standing as a party to a complaint relating to his or her rights. This includes i.a. the right of access under Article 15 i regulation 2016/679/EU on the protection of natural persons with regard to processing of personal data and on the free flow of such data and on the repeal of Directive 95/46/EC (hereinafter the data protection regulation or GDPR). The Court of Appeal in Stockholm has in a judgment on 18 May 2022 in case no. 1426- 22 held that when IMY has initiated supervision due to a complaint, it shall appellants have the right to appeal IMY's decision in the supervisory matter. On this basis point of view, he has the right to appeal IMY's future decision in the supervisory matter, and should he reasonably also be a party during the authority's proceedings. The assessment that he lacks party status is also not compatible with GDPR and EU legal principles. According to these, the supervisory authority is obliged to process and investigate the complaints that each has the right to file, and the complainant have the right to an effective remedy, i.a. if the supervisory authority fails to process a complaint. By being denied party status, he does not get the opportunity to ensure that his affairs are dealt with impartially, fairly and within reasonable time. In this way, he lacks the opportunity to exercise his rights according to GDPR, which means that these become ineffective in practice. He has filed his complaint because he wishes to enforce his own right to access according to Article 15 of the GDPR and actually receive their personal data from the relevant personal data controller. This is an individual right which Doc.Id 1554333 Page 3 ADMINISTRATIVE COURT JUDGMENT 13308-22 IN STOCKHOLM protected by Article 8.2 of the Charter of the European Union on the fundamentals the rights. In accordance with the principle of the autonomy of EU law, the concept of complaint i the data protection regulation is also interpreted in the light of the data protection regulation and Article 8 of the EU Charter of Rights and not solely with the support of national preparatory works. Furthermore, an appellant is described in the preparatory work as the person who appeals an administrative decision, which was also not the situation when the notification was made the Austrian supervisory authority. IMY in and of itself has the opportunity to initiate supervisory matters on its own initiative against an object of supervision, but by consistently converting complaint cases to general supervisory matters on IMY's own initiative are undermined by the appellant possibility to effectively demand their rights according to data protection the regulation. IMY claim

Entities