Swedish court confirms that authority must investigate complaints
The Stockholm administrative court held that a complainant under Article 77 GDPR has the right to request a decision from the Swedish Data Protection Authority (IMY) after six months.
So far, the IMY took the view that users are not a party in procedures concerning their own GDPR rights. The right to get a decision within six months also applies if the IMY opens a parallel ex officio investigation into the same company.
In January 2019, a user filed a complaint with the Austrian DSB in response to Spotify’s insufficient answer to his access request. The complaint was forwarded to the Swedish IMY, which is responsible for Spotify. Since then, the case has not been decided. Instead, the Swedish DPA claimed to have a broader investigation into Spotify – for more than three years by now.
The Swedish court ordered the IMY to process and investigate the complaint. The decision has a wider effect for all users in Sweden, as they can rely on the court ruling when enforcing their rights via the IMY.
Source: GDPR Rights in Sweden
