In most countries, the government knows when you were born, your social security number, where you live, how much you earn and how much your house is worth. Sweden is a bit different though. There, the tax authority doesn’t just use this information for administrative purposes – but sells it to data brokers who publish it online. This is a violation of EU law. Earlier this year, a Swedish data subject asked the country’s tax authority to stop selling his data. The country’s Supreme Court has recently ruled that freedom of information and privacy rights must be balanced and data must be marked as confidential, if the recipient is likely to process it in conflict with the GDPR. The tax authority rejected the request, claiming it simply follows the Swedish constitutional principle of transparency rather than the ruling by the Supreme Court. noyb now takes the authority to court.
- noyb appeal (SE)
- Ruling by the Swedish Supreme Court (SE)
- Ruling by the Swedish Supreme Court (English Translation)
Personal data sold to private companies. It’s not unusual for your country of residence’s government to have a variety of data about you. This can include information such as your marital status, your income, your place of residence, the value of your house, your social security number and date of birth. After all, this information might be needed to collect taxes. It is unusual though, that in Sweden, the tax authority not only collects, but also sells this personal information to third party companies – who subsequently publish it online for everyone to see. This includes data brokers like MrKoll, which make a profit from selling the data to anyone who’s interested without a single safeguard or restriction. The Swedish approach to “transparency” therefore goes far beyond what is necessary and proportionate for transparency or journalistic purposes, but amounts to full access by purely commercial data brokers to government data.
Joakim Söderberg, data protection lawyer at noyb: ”When I pay taxes in my home country, I expect the tax authority to use my data for this exact purpose, and not to feed commercial data brokers for them to make a profit. Publishing people’s tax data for everyone to see, clearly violates the fundamental right to data protection. The tax authority needs to reconsider their data sharing practices after the Supreme court judgement – and start marking things confidential as soon as possible.”
Swedish Supreme Court requires “balancing”. Fortunately for consumers, there are clear legal exceptions to the sharing of this data. The Swedish Supreme Court has recently decided on the conflict between Swedish freedom of information law and EU data protection law. The Supreme Court concluded, that these conflicting rights must be balanced. If data is likely to be processed in breach of the GDPR, it must be marked as confidential. This confidentiality should prohibit data brokers from obtaining the personal data of people living in Sweden. At least if the tax authority actually followed the court ruling. At the moment, it unfortunately doesn’t.
Request to suspend data sale rejected. Earlier this year, a data subject requested that the Swedish tax authority stop selling his data, arguing that the processing is illegal and should therefore be restricted. The authority summarily rejected the request, arguing that it was only exercising its public authority by handing over his personal data to profit-seeking companies. The tax authority operates the statens personadressregister (Swedish state personal address register), which contains the personal data of all people residing in Sweden. According to national law, companies can access people’s personal data in this database to “update, supplement and verify personal information or select names and addresses for direct marketing, public service announcements or other comparable activities”.
Here’s a few examples of confirmed recipients of tax authority data: Dun and Bradstreet explicitly operates a database that is maintained with data from the state’s address register – and is used to help other companies to build their own database with people’s personal data. A company called Kalenderförlaget, on the other hand, publishes a so-called taxation calendar – which includes data on the income of all people in Sweden. Similarly, “The Intelligence Company” states that it has access to the data of all Swedish residents over the age of 15 – and that it comes from the tax authority. Them being recipients of tax authority data can easily be verified by anyone with an E-ID.
Joakim Söderberg, data protection lawyer at noyb: ”It doesn’t make sense that companies like Dun and Bradstreet, the Intelligence Company and Kalenderförlaget should have access to the tax data of all Swedes. Sweden prides itself as being a country where human rights are high on the agenda, but apparently the government does not respect the fundamental right to privacy or data protection.
Appeal filed with Swedish court. noyb has therefore filed an appeal with the Stockholm Administrative Court, requesting that the tax authority restrict the sharing of the data subject’s personal information with third parties. The Supreme Court’s decision makes it clear that the sharing of all this data with data brokers should be prohibited, because it is clear that they will process data in violation of the GDPR. Selling the personal data of millions of Swedes to anyone who’s interested deprives people of their fundamental right to privacy. On top of that, the GDPR’s purpose limitation principle states that “personal data shall be collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes”. Data brokers selling the data online clearly don’t comply with these rules.
