Sweden: Announced IMY investigation into its decisions in complaints against holders of voluntary issuance certificates following Court of Appeal ruling on GDPR precedence

On 15 March 2024, the Swedish Data Protection Authority (IMY) announced a review of its handling of complaints against holders of voluntary publication licenses under the EU Data Protection Regulation (GDPR). This decision was made following the ruling in Case 6027-23 of the Administrative Court of Appeal. The Court ruled that constitutional protection of publication certificates does not always take precedence over the GDPR. IMY has received several complaints regarding holders of publication licenses, particularly companies that provide online search services with personal data. A recent court decision marks a departure from previous court practices, requiring IMY to analyse the implications for its handling of complaints against publication certificate holders. This analysis may lead to the initiation of supervision in response to such complaints.