IMY reviews Upplysning.se and Mrkoll — focus on the right to erasure
The Data Protection Agency is intensifying its scrutiny of search services that publish extensive personal data under a publishing certificate. Need guidance on how the rules affect your operations? Our GDPR consultants can help.
The Data Protection Agency has received a very large number of complaints from individuals who requested erasure of their data from Upplysning.se and Mrkoll.se, yet whose data continue to be processed and made publicly accessible. The Agency will now examine whether the companies are violating the GDPR, for example by failing to act on erasure requests.
- Two new supervisory investigations: Upplysning Checknode AB (Upplysning.se) and Nusvar AB (Mrkoll.se).
- Extensive mapping: The services allow searches for family relationships, housing type and financial circumstances for large parts of Sweden’s population.
- Substantial complaints: The Data Protection Agency will not handle individual complaints at this stage, but will assess the companies’ routines and overall GDPR compliance.
What the Data Protection Agency will investigate – context for GDPR consulting services
The investigations target some of the most fundamental GDPR requirements. The Agency will assess both whether the right to erasure is respected and whether there is a lawful basis for publication. These are core issues for all organisations that make personal data widely available.
- Article 17 GDPR compliance: Whether the companies erase personal data when the data subject requests it, as part of robust data subject rights management.
- Application of Article 6 GDPR: Whether there is a valid legal basis for continued publication, in line with transparency requirements under the GDPR.
The data subject’s right to erasure is a fundamental GDPR right, but in these cases the companies argue their publication is constitutionally protected as they hold a voluntary publishing certificate from the Swedish Media Authority (Mediemyndigheten). The Agency’s decision to review these two search services signals increased emphasis on how commercial databases handle erasure requests, and a clear focus on whether the publication is carried out as part of journalistic activity, as indicated by explicit questions to the companies on that point. As noted in our earlier post on publication of criminal judgments, the Agency already signalled in April that it may also examine other categories of personal data, such as financial information and family relationships. This follow-up review has now commenced.
What the investigations mean for you – aligning with GDPR consulting services
The ongoing investigations indicate a clear tightening of supervision of public services that make large volumes of personal data available under a publishing certificate. If you operate searchable databases, you may need to reassess both technology and procedures.
- Heightened regulatory risk: If you process personal data in searchable databases, ensure clear routines for erasure and defensible GDPR compliance assessment.
- Transparency obligations: Data subjects must be able to exercise their rights easily—ensure contact details are easy to find and that you apply clear processes for requests.
- Documentation: Maintain records that show how and why erasure requests are granted or refused, supported by GDPR documentation templates and a structured GDPR gap analysis.
How we can help – GDPR consulting services
Morling Consulting provides hands-on support when you need to interpret the Data Protection Agency’s requirements and adapt your processes. Our services include acting as an external data protection officer, offering outsourced DPO or fractional DPO models, and providing interim DPO capacity across Europe. We also deliver GDPR risk assessment and data subject rights management frameworks that align with transparency requirements under the GDPR.
For organisations that process and publish large volumes of personal data, our GDPR consulting services can help you design clear erasure workflows, define lawful bases, and strengthen governance fast and effectively.
