Enforcement · Data Protection Authority of Sweden EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

H&M Hennes & Mauritz GBC AB: Insufficient fulfilment of data subjects rights

€30,000 Fine
H&M Hennes & Mauritz GBC AB
SWEDEN
Art. 12 GDPR Art. 21 GDPR
Right to Object Data Subject Rights Exercise Modalities and Procedures Direct Marketing Controllers Marketing Personal Data Processing Agreement Supervisory Authorities
Oct 17, 2023 Source

How it connects

Related across sources

Case Law Google LLC v CNIL CJEU Case Law Google Spain SL and Google Inc. v AEPD and Mario Costeja González CJEU Case Law CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is CJEU Case Law HvJ EU 9 januari 2025, C‑394/23 (Mousse). CJEU Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance EDPB Annual Report 2021 EDPB

Full text

The Swedish DPA has imposed a fine of EUR 30,000 on H&M for sending out marketing messages, despite the fact that data subjects had exercised their right to objection. Six data subjects had filed a complaint against the controller with the DPA. The DPA found that the controller did not have sufficient systems and procedures in place to facilitate data subjects exercising their right to object to direct marketing.

Industry: Industry and Commerce

Original document at the source www.imy.se

Similar Content