Sweden

Tele2 Sverige Aktiebolag

1,000,000 €

GDPR enforcement action by Data Protection Authority of Sweden on 2023-06-30.

Rank · Sector

#48

of 369 in Media, Telecoms and Broadcasting

Rank · Sweden

#12

of 46

Rank · All fines

#170

of 3,050

Case details

Authority: Data Protection Authority of Sweden
Date: 2023-06-30
Controller / Processor: Tele2 Sverige Aktiebolag
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 44 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Swedish DPA has imposed a fine of EUR 1 million on Tele2 Sverige Aktiebolag. The Austrian organization None of your Business (NOYB) had filed a complaint against the company in light of the Schrems II judgment, stating that the company was unlawfully transferring personal data to the US. The company had used Google Analytics for visitor statistics and based the data processing by the statistics tool on the EU standard contractual clauses, as no adequacy decision had been issued by the EU Commission for the USA. In the course of its investigation, the DPA determined that the use of the standard contractual clauses was not sufficient to guarantee a level of protection equivalent to that of the EU.
---UPDATE---
Following an appeal to the Administrative Court of Appeal, the court upheld the DPA's decision.

Open original source Links to the regulator's original publication or another source.