Should public institutions profit from citizens' personal information? Noyb questions the Swedish Tax Agency

The claimant asserts that the Swedish Tax Agency's processing of personal information through SPAR does not meet the GDPR requirement of there being a valid public interest, as the Swedish Tax Agency utilises SPAR for disclosures that largely benefit private entities rather than fulfilling state functions, such as tax collection or administration of the population register. The claimant also questions whether recipients like Dun & Bradstreet and Kalenderförlaget handle the retrieved data according to GDPR principles, especially in relation to its transparency requirements and purpose limitation. Further, the appeal seeks to answer the question of whether the Swedish Public Access to Information and Secrecy Act (Sw. Offentlighets- och sekretesslag) and the SPAR Act (lag 1998:527) demonstrate an adequate balance between the right to access public records and the fundamental right to privacy.

Following a recent judgement from the Swedish Supreme Court, Noyb emphasises that the Swedish Tax Agency must assess, prior to disclosure, whether there is a risk of data being processed in violation of the GDPR by the recipient. If the answer is affirmative, conditions should be imposed, or disclosure should be withheld altogether.

In its initial response to Noyb, the Swedish Tax Agency maintained that it does not bear a responsibility for verifying GDPR compliance on the part of third-party recipients and that the Swedish constitutional freedoms can supersede GDPR considerations in cases of public access to data.

Noyb's legal arguments focus on ensuring that personal data collected for an official function, i.e. taxation and population registration, are not subsequently exploited for unrelated and/or commercial means. It may be argued that the principle of access to public information should not be overridden simply because the collecting entity happens to profit from the records by assembling them or making them searchable - these records are supposed to be accessible. Blocking disclosure based on a mere suspicion of a potential future GDPR violation will undoubtedly lead to subjective assessments.