Background information
- Date of decision: 17 October 2023
- Cross-border case or national case: Cross-border case
- LSA: SE
- CSAs: PL, IT, DE, SI, FR, DK, ES, NO, FI, PL, BE, PT, CY, EE, NL
- Controller: H&M
- Legal references: Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 6 (Lawfulness of processing)
- Decision: Administrative fine
- Key words: Data subject rights, Direct marketing
Summary of the Decision
Origin of the case
IMY has initiated a supervision of H&M due to six complaints from individuals who objected to receiving direct marketing from the company. The complaints come from people among other in Poland and Italy but have been handed over to IMY because H&M has its headquarters in Sweden.
Key Findings
In its decision, IMY states that H&M has violated the GDPR by not ceasing to handle the complainants' personal data for direct marketing without undue delay, despite the complainants objecting to this.
The decision states that the company did not have sufficient systems and routines in place to make it easier for those who complained to exercise their right to object to direct marketing.
Decision
IMY issues an administrative fine of SEK 350,000 (approximately 28 500 EUR) against the company for violations of the GDPR.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.