Polismyndigheten – Court Ruling (Sweden, 2023)

The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases. The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities. The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed. The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data subject, and that 2) the Police had indeed informed the data subject about the purposes of the processing activities. Firstly, the Court established that 1) according to Chapter 4, Section 3 of the Swedish Criminal Data Act, the data controller must inform the person who requests it, without undue delay, provide written information on whether personal data concerning him or her is being processed. Secondly, the Court established that 2) Article 15 GDPR includes essentially equivalent regulations. The Court assessed if the Police had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and Article 15 GDPR, as applicable. The Court viewed that the GDPR applies to processing in archived criminal investigations, and that the Swedish Criminal Data Act applies to processing in ongoing criminal investigations. The Court held, that Article 15(1)(c) GDPR must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means that the controller is required to provide the data subject with information of the actual identity of the recipients, unless an exemption under Article 12(5) GDPR applies. The Court viewed that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients under the Swedish Criminal Data Act. Firstly, the Court stated that the information provided by the Police was too general, as the Police has provided only information on the categories of personal data normally processed in those kind of criminal investigation cases. The Court ruled that the Police had therefore not fulfilled the requirements of Article 15 GDPR or the Chapter 4 Section 3 of the Swedish Criminal Data Act. Secondly, The Court did not question the Police’s argument that, with regard to archived criminal investigations, they don't have information about the actual identities of recipients of the data. With regard to the ongoing criminal investigation activities, the Court viewed that the Police did not indicate any reason why they only provided information on the prospective recipients and not the actual recipients. The Court decided that the Police had not fulfilled its obligations either in this respect under Chapter 4, section 3 of the Criminal Data Act and Article 15(1) GDPR, but that the Police had provided sufficient information about the purposes of processing. The Court annulled the lower courts' decision in the aforementioned parts, and the case was returned to the Police for a new assessment.