Polismyndigheten – Court Ruling (Sweden, 2023)

The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases. The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities. The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed. The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data s