Swedbank AB – Court Ruling (Sweden, 2022)

The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead. The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case. Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR. According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data. In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other r