- Enforcing jurisdiction
- Luxembourg · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Swedish Tax Authority – Court Ruling (Luxembourg, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Luxembourgish Tax Authority asked a company to provide tax information about Swedish residents. The company initially refused to give a complete list of data subjects but later complied after a court ruling. This case highlights the importance of complying with data requests from authorities.
What happened
The Luxembourgish Tax Authority requested tax-related information from a company about Swedish residents.
Who was affected
Swedish residents whose tax information was requested by the Luxembourgish Tax Authority.
What the authority found
The court ruled that the company did not fully comply with the request and reduced the fine to €12,500.
Why this matters
This ruling emphasizes that companies must comply with valid requests from tax authorities, even when it involves sensitive data. Businesses should ensure they understand their obligations under data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 16 May 2026.
Processing notes: amount discrepancy, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2025, the Luxembourgish Tax Authority (the controller) requested a Luxembourgish company to provide it with tax related information from several Swedish data subjects, following a request for assistance from the Swedish Tax Authority. The controller requested information related to one specific data subject, but also requested a complete list of data subjects who held a specific type of loan with the company (including Swedish residents). The purpose was to verify data subjects’ tax situation. The company filed a case with the Administrative Court in September 2025, seeking to appeal the request. The court dismissed this decision, and the company provided the controller with the information. The company anonymised the data that was not related to the specific data subject and Swedish residents in order to comply with data minimisation requirements under the GDPR (Article 5(1)(c) GDPR). The controller requested the complete information, and fined the company €79,000 for refusing to provide it. The company filed a claim with the Administrative Court, who dismissed it and upheld the fine. The decision was then appealed by the company to the court, seeking to overturn the fine. The company argued that it had complied with the controller’s request while complying with the GDPR, and that information of data subjects that were not tax residents in Sweden would likely not be relevant for the controller. The controller argued that the request was justified under national law. The court dismissed the company’s appeal regarding data minimisation, but partly upheld the appeal regarding the fine. The court considered that the company did not comply with the controller’s decision, as it did not provide a complete list of data subjects holding a specific loan type with the company. The court dismissed the company’s data minimisation argument; according to the court, the company did not substantiate its argument as it did not refer to specific articles of the GDPR. Finally, the court considered that the full information was relevant for the Swedish tax authority, and therefore, the request for information was not disproportionate in light of the principle of data minimisation. However, the court reduced the fine to €12.500.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Swedish Tax Authority in LU
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Swedish Tax Authority - Luxembourg (2026). Retrieved from cookiefines.eu
Last updated: