What happened
The authority found that SJ AB had breached Article 12(3) by not meeting an access request without undue delay, Articles 15(1)(a) to (h) and 15(2) by not giving the requester, in their capacity as a customer, all the information those provisions list, and Article 15(3) because the copy did not give access to every piece of personal data the company processes about them. It issued a reprimand under Article 58(2)(b) and ordered the company to meet the request within two weeks of the decision becoming final. The company's own account, recorded in the decision, was that its routine did not search the email system at all; that the customer case system was searched on the address in lower case, returned nothing, and that section of the extract was therefore deleted as empty; that travel history was searched only on the contact details in the customer profile and not on the address and telephone number given with the request, so bookings made under those were missing; and that the personnel system covered employment from 2008 onwards, with older files held by a processor. The decision records that the full text about the processing was available on the company's website and that this did not remedy the omission.
What changes at the desk
The copy you send is a claim about the search you ran, so write the search down: which systems, which identifiers, and which of those the requester gave you rather than the ones already on their profile. Case sensitivity, a mailbox outside the ticketing system and an archive held by a processor are three places a bundle that looks complete goes wrong. An empty section is a result to report, not a section to delete. And information published on your website is not information provided in the answer.
Primary source
DecisionSweden29 Jun 2023
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.