# IMY (Sweden) - IMY-2025-11707 - Type: Enforcement - Source: IMY - Date: 2026-11-09 - Original: https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_IMY-2025-11707 - Canonical: https://overview.legal/posts/608808 ## Cited law provisions (23) ### GDPR — gdpr-art-4-par-7-en ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ### GDPR — gdpr-art-5-par-1-en Personal data shall be: ### GDPR — gdpr-art-5-par-1-pnt-a-en processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); ### GDPR — gdpr-art-5-par-2-en The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). ### GDPR — gdpr-art-6-par-1-pnt-e-en processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ### GDPR — gdpr-art-6-par-1-pnt-f-en processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ### GDPR — gdpr-art-12-par-1-en The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. ### GDPR — gdpr-art-12-par-3-en The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. ### GDPR — gdpr-art-17-par-1-en The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ### GDPR — gdpr-art-17-par-1-pnt-c-en the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); ### GDPR — gdpr-art-17-par-3-en Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: ### GDPR — gdpr-art-21-par-1-en The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-58-par-2-pnt-b-en to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation; ### GDPR — gdpr-art-83-par-2-en Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: ### GDPR — gdpr-art-85-par-1-en Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. ### GDPR — gdpr-art-85-par-2-en For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-17-en Right to erasure (‘right to be forgotten’) ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-77-en Right to lodge a complaint with a supervisory authority ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines ### GDPR — gdpr-art-85-en Processing and freedom of expression and information --- Generated by overview.legal · https://overview.legal/posts/608808 · 2026-11-14