DPA case IMY-2022-1621 – Complaint Upheld (Sweden, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company providing background check services in Sweden faced complaints for processing sensitive health data without proper legal grounds. The Swedish Data Protection Authority upheld the complaints, indicating that the company did not comply with data protection laws. This case serves as a warning to businesses about the importance of respecting privacy rights when handling sensitive information.
What happened
A background check company processed sensitive health data without a valid legal basis.
Who was affected
Individuals whose sensitive health information was included in the background checks.
What the authority found
The Swedish Data Protection Authority found that the company did not respect data protection laws regarding sensitive information.
Why this matters
This ruling emphasizes the need for companies to ensure they have a valid legal basis for processing sensitive data, particularly health-related information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller was a company which provided background check services in Sweden. For this purpose, it made publicly available a database, which contained legal and financial information of both legal and natural persons, collected among others from court decisions from 2008 onwards. The database included specific search fields for "name", "personal identity number", "city/address" and "free text search". On top of that, an additional "background check extension service" enabled customers, through a consent request from the person to whom the background check related, to obtain a report on any current or past legal disputes regarding compulsory care due to mental illness or addiction. The Swedish DPA received multiple complaints from data subjects about the service of the controller, especially the processing of sensitive data relating to health. The DPA initiated its own investigation in order to find out whether the controller was subject to and respected the applicable data protection laws. The controller alleged that the GDPR did not apply to its service because it was constitutionally protected under the [https://lagen.nu/1991:1469 Swedish Freedom of Expression Act]. To illustrate the issue at hand, Swedish law contained exceptions on the applicability of the GDPR in favour of freedom of expression. Member States have the possibility to introduce such exceptions provided in Article 85 GDPR. The specific provision, [https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218 Chapter 1.7 Paragraph 1 of the Swedish Data Protection Act,] states that the GDPR and the implementing national law shall not apply to the extent that this would conflict, among others, with the [https://lagen.nu/1991:1469 Freedom of Expression Act]. Under this law, the GDPR generally applies to online publications. As a way of exception, publications using databases developed from publicly available information,
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IMY-2022-1621 in SE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case IMY-2022-1621 - Sweden (2022). Retrieved from cookiefines.eu
Last updated: