Sweden SA (IMY) issues administrative fine against H&M for making it difficult to avoid marketing

17 October 2023

Background information

  • Date of decision: 17 October 2023
  • Cross-border case or national case: Cross-border case
  • LSA: SE
  • CSAs: PL, IT, DE, SI, FR, DK, ES, NO, FI, PL, BE, PT, CY, EE, NL
  • Controller: H&M
  • Legal references: Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 6 (Lawfulness of processing)
  • Decision: Administrative fine
  • Key words: Data subject rights, Direct marketing


Summary of the Decision


Origin of the case

IMY has initiated a supervision of H&M due to six complaints from individuals who objected to receiving direct marketing from the company. The complaints come from people among other in Poland and Italy but have been handed over to IMY because H&M has its headquarters in Sweden.


Key Findings

In its decision, IMY states that H&M has violated the GDPR by not ceasing to handle the complainants' personal data for direct marketing without undue delay, despite the complainants objecting to this.

The decision states that the company did not have sufficient systems and routines in place to make it easier for those who complained to exercise their right to object to direct marketing.



IMY issues an administrative fine of SEK 350,000 (approximately 28 500 EUR) against the company for violations of the GDPR.


For further information:

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.