noyb takes Swedish DPA to the Court Over GDPR Complaint Handling
The ongoing case involving noyb and the Swedish Data Protection Authority (IMY) shows noyb’s concerns regarding the enforcement of data protection rights under EU law. Despite being a nation known for its ombudsman system, Sweden’s IMY has been criticized for treating complaints as optional rather than mandatory. According to EU regulations, a Data Protection Authority (DPA) is obligated to investigate every complaint and remedy any violations. However, the IMY has consistently operated as if it can choose which complaints to address, undermining the fundamental rights of citizens.
Max Schrems, a prominent figure in data protection advocacy, has voiced strong objections to the IMY’s approach. He emphasizes that six years after the General Data Protection Regulation (GDPR) came into effect, authorities continue to act as if they can ignore their responsibilities. The IMY’s failure to recognize the right to appeal against its decisions has been a notable issue. However, a ruling by the Supreme Administrative Court of Sweden in November 2023 established that complainants are entitled to a decision, reinforcing the importance of addressing complaints rather than dismissing them.
In response to the Supreme Administrative Court ruling, the IMY has adopted a practice of attaching an “appeal form” to its decisions without conducting proper investigations. Instead of thoroughly examining complaints, the IMY often forwards them to the offending entity and closes the case. This practice raises concerns about the authority’s commitment to enforcing data protection rights, as seen in a recent case where a complaint regarding a recorded phone call was simply forwarded without investigation.
The European Court of Justice has made it clear that every DPA must handle complaints diligently and take necessary actions to stop violations. In light of the Swedish first instance court’s agreement with the IMY’s approach, noyb has filed an appeal with the second instance court to ensure that all complaints are properly addressed in Sweden. Schrems has stated that if necessary, the matter may be taken back to the Court of Justice to ensure compliance with EU law and protect citizens’ rights.
