Bonnier News AB – €1,144,000 Fine (Sweden, 2023)

Bonnier News AB (now Expressen Lifestyle), the controller, is a media company in Sweden. The Bonnier group processed their customers' data for, among other reasons, marketing purposes. They compiled profiles on their users and made these available to affiliated companies who then provided targeted advertisements for their own products and services through direct mail and telemarketing. They relied on legitimate interests under Article 6(1)(f) GDPR to do so. At the time of the investigation,which followed a complaint from a data subject, there were 15 such affiliated companies, with the personal data being collected from users and website visitors being stored in two group-wide data bases from which it was then shared with the affiliate companies. One of these databases was a “behavioral data base”. The personal data recorded in this database, by means of a cookie identifier, included the URL that the user visited, as well as its category and content type, information on the user’s device and their IP address, behavioral data in terms of time spent and the time the page was viewed and also whether the user logged into the website. In some instances, this data could be linked with the user’s data in the customer data base, resulting in a full behavior profile including the user’s age, gender, their car ownership and some variable based on the users’ residential area, such as their life phase, housing type and purchasing power. During the course of the investigation, the controller argued that they are not joint controllers in respect of the personal data, and that after the affiliated companies access the data provided in the databases, that they alone are responsible for the legality of that processing. The controller further argued that while the personal data in the customer database was personal data, the data in the behavioral database was comprised of anonymous data and as such was not personal data under Article 4(1) GDPR. The controller stated that they rely on legitimate interest as a lawful basis for the profiling of their customers and users to provide personalised advertisements. The controller identified the legitimate interest as being the need to ensure relevant content and advertisements for their customers so that they can offer competitive services and have attractive advertising spaces. The controller also submitted that this interest outweighed the interest of their customers in the protection of their personal data. The controller claimed that such was the case as the customers could object to the profiling, that the customers already have a direct relationship with one (or more) of the affiliates, either from having purchased from their websites or having visited their website, that the processing was unlikely to adversely affect the data subject’s interests as their interaction with the affiliates was voluntary and, finally, that the processing is consistent with the reasonable expectations of the data subjects. The IMY (Swedish DPA), after highlighting the fact that Bonnier set up the framework for the accessing of the personal data by the affiliate countries, held that Bonnier News AB was a joint controller in respect of the processing activities. This included the initial collection of the data, the storage of that data in the databases, the profiling of the data subjects and the use of the data for the purposes of customised advertisements and direct marketing. The IMY further reasoned that as the behavioral data base distinguished users based on cookie identifiers, and the users can be individually identified from them, the behavioral data base constituted personal data. The IMY then considered the validity of the controller’s reliance on legitimate interest as a lawful basis for the profiling of user data. It was found that the interest being pursued was legitimate, and the processing in question necessary for the pursuit of the interest. The IMY then turned to assess the balancing of interests. In respect of the making available of completed behavior profiles, it was noted that the overall benefit of the processing was for the controller to generate revenue from advertisements. The IMY disagreed with the controller’s assertion that the processing would be consistent with the reasonable expectations of the data subject, finding that the profiling was extensive in nature and not something which could be reasonably expected without consenting. The IMY thus found that the privacy interests of the data subjects outweighed the interest being pursued by the controller and as such, the controller infringed Article 6(1) GDPR. With respect to the processing of simple behavioral profiles, allowing for the mapping of individuals through observation and the use of cookies, the IMY again held that the data subject’s interest in privacy outweighs the interests of the controller. The IMY reasoned that the monitoring of data subject behavior to provide targeted advertisements could give the data subject’s the feeling that they are being monitored. The IMY thus found that the controller had processed personal data for profiling based on behavioral data for the purposes of enabling targeted advertisements without a lawful basis, infringing Article 6(1) GDPR. The IMY issued a fine of SEK 13,000,000 (€1,157,483.21).