DPA case IMY-2022-9442 – Complaint Upheld (Sweden, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A former employee and customer of a Swedish train operator complained that they couldn't access all their personal data. The Swedish data protection authority found that the company didn't provide complete information and failed to inform the person about how to access missing data. This case emphasizes the need for companies to ensure users can easily access their personal information.
What happened
A former employee and customer requested access to their personal data from a Swedish train operator but received incomplete information.
Who was affected
The former employee and customer of SJ AB, a train operator in Sweden.
What the authority found
The Swedish data protection authority ruled that SJ AB did not fully comply with the request for access to personal data.
Why this matters
This ruling highlights the importance of transparency and thoroughness in how companies handle data access requests. Businesses should ensure they provide complete and clear information to users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was both a former employee and a customer at SJ AB, a train operator in Sweden (“the controller”). On 9 February 2022, the data subject emailed the controller to request access. Although the controller provided a portal for such requests within the customer profile, technical problems with bank ID verification prevented access. On 15 February 2022, the controller contacted the data subject with a request for additional information to manually identify the data subject. The verification was done by the data subject on 19 April 2022 by mobile bank ID. The documents the data subject requested were then sent in two batches. The first batch was sent on 3 May 2022 regarding the processing of personal data in the data subject’s capacity as a former employee of the controller. However, the provided information only covered the data subject’s employment from 2008 onwards and excluded any data of a technical nature. The controller later sent a cover letter explaining to the data subject how to request this additional information. The second batch was sent on 18 May 2022 regarding the processing of personal data in the data subject’s capacity as a customer. By mistake, the information was not provided in full, however, the controller argued that the full information was easily accessible on their website. The data subject was not informed how to access the missing information. In the light of this, on 18 November 2022, the data subject lodged a complaint with the Swedish DPA (“IMY”) against the controller. The controller explained that personal data about the data subject in their customer case system was not included in the copy of the personal data provided to the subject, as a search for the data subject's email address in lower case did not produce any result in the system. The controller did not know the system was case sensitive, and only found out later that using the data subject’s email address in capital letters would result in finding the customer
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IMY-2022-9442 in SE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case IMY-2022-9442 - Sweden (2023). Retrieved from cookiefines.eu
Last updated: