DPA case IMY-2023 4458 – Violation Found (Sweden, 2025)

Several data subjects lodged a complaint with the Swedish Privacy Protection Authority (IMY) after receiving received personalized video greetings from the Moderate Party’s national organization , the controller, ahead of the 2022 parliamentary elections. The video greetings featured by the party leader, addressing data subjects by their first names and urging them to vote. The controller engaged the company SEEN AS as a data processor to produce and distribute the videos. In total, about 980,000 video greetings were sent. The controller claimed its legal basis was legitimate interest under Article 6(1)(f) GDPR , arguing it was necessary for political communication and that data subjects' rights did not outweigh this interest. Data subjects were informed about the sender and linked to the controller’s privacy policy, which stated that data was processed based on legitimate interest. IMY initiated an investigation. IMY held that the Moderate Party was the data controller under Article 4(7) GDPR, as they determined the purpose and means of the processing, even though they did not have direct access to the personal data. IMY found no valid legal basis for the processing. To rely on legitimate interest as a legal basis under Article 6(1)(f) GDPR, three conditions must be met: a legitimate interest, necessity, and a balance of interests. While the controller’s interest in informing voters was considered legitimate, and the processing was deemed necessary for achieving that communication purpose, IMY held that the third condition, the balancing of interests, was not fulfilled. Sending unsolicited political text messages without prior consent was considered intrusive, and since the data subjects had no prior relationship with the controller and had not provided their data, the processing fell outside reasonable expectations. IMY also held that the controller violated Article 14 GDPR by failing to provide adequate information to data subjects. The privacy policy did no