IMY – Court Ruling (Sweden, 2023)

The data subject complained to the Swedish DPA that his neighbors were conducting camera surveillance with cameras aimed at other’s plots and a common access road. The DPA investigated and concluded that the neighbours were not processing personal data. The GDPR was therefore not applicable and the case was closed. This decision was appealed by the data subject to Stockholm’s Administrative Court who dismissed the case. It reasoned that that the appealed decision did not affect the data subject in such a way that it is appealable. The data subject appealed the rejection to the Stockholm Court of Appeal. The Court of Appeal referred the case back to the Administrative Court. It stated that the Swedish DPA ruled on the substance of the data subject's complaint by rejecting it. The data subject should have an effective remedy under the GDPR. This decision by the Court of Appeal was appealed by the Swedish DPA to Stockholm’s Supreme Administrative Court. They argued that while data subjects have the right to an effective legal remedy, the decision to not open a case or close a case do not have any legal effects or significant consequences. The question for the Supreme Administrative Court was whether the Swedish DPA’s decision to close a supervisory case without action is appealable. The court decided that the data subject had the right to appeal. The right to an effective judicial remedy before the competent national court when a decision has legal consequences is outlined in Article 78(1) GDPR. To have legal consequences the complaint must be a legally binding decision and this includes decisions where the authority has dismissed a complaint. The same situation will arise as if the complaint case was directly closed without hearing the complaint. To ensure the right to an effective remedy, such a decision must also be considered as a legally binding decision within the meaning of Article 78(1) GDPR. Therefore, the appeal of the Swedish DPA is dismissed and the