Cybersecurity Policy Report, EU Complaint Targets Data Broker Claiming Journalist Protections, (Mar 15, 2024)

By Tony Foley

The European Center for Digital Rights (NOYB) has filed a complaint with the Swedish data protection authority (IMY) alleging that data brokers in the country have used a loophole in Swedish law to avoid their responsibilities under the European Union’s General Data Protection Regulation (GDPR).

In a news release, NOYB noted that, under Swedish law, “anyone can get a media license, and get exempt from the GDPR.” Article 85 of the GDPR allows member states to limit the application of some elements of the GDPR to news organizations to protect sources or undercover investigations. But NOYB said Sweden took a “brute force approach” to the exception. Swedish law makes it easy to obtain a media license, even when a company’s activities are generally unrelated to those of a news outlet and are clearly focused on sharing and selling personal data, NOYB said. Data brokers can use the loophole to exempt themselves from their data protection obligations, the group added.

The complaint, lodged against MrKroll, one of the country’s largest data brokers, alleged that the company had data on almost all Swedish citizens and profited by selling the data “without a single safeguard or restriction.” Listing a variety of examples of the negative impacts of sales of data by such brokers, NOYB said that, contrary to the requirements of GDPR article 17, there was no way for an individual to object to the use of their data or to request that it be removed from MrKroll’s website.

The unnamed subject of NOYB’s complaint had requested that MrKroll delete his data, but the request was denied based on the company’s contention that its database was exempt from GDPR requirements thanks to its media license. NOYB has asked IMY to order MrKroll to delete the data and to notify all recipients of the data of its deletion and to prohibit any further processing of the complainant’s data. In the event of an unfavorable ruling, NOYB said it was prepared to appeal the matter to the Stockholm Court to “stop the misuse of media licenses by data brokers in general.”

News: LitigationEnforcement DataPrivacy GDPR DataSecurity