Datatilsynet (Denmark) - 2021-31-4650

Datatilsynet (Denmark) - 2021-31-4650
Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	24.11.2021
Fine:	None
Parties:	Catholic Church in Denmark
National Case Number/Name:	2021-31-4650
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Danish
Original Source:	datatilsynet.dk (in DA)
Initial Contributor:	Frederick Antonovics

The Danish DPA issued a reprimand against the Catholic Church of Denmark for its inadequate response to an access request, and ordered it to reassess the complainant's original request.

English Summary

Facts

The complainant is an woman whose husband wanted to remarry in the Catholic Church, which required their marriage to be annulled. For this to happen, witnesses had to be called to testify before the Church about the complainant's and her ex-husband's previous life and marriage, as well as the reason for their divorce.

After this interview, the complainant contacted the Catholic Church to find out what questions the witnesses were asked about the her private life and what their answers were.

Holding

The Church and the complainant's arguments

The Catholic Church rejected this access request, arguing that the complainant's right of access under Article 22 of the Danish Data Protection Act could be waived because her interest in the information given by the witnesses was outweighed by the interest of the complainant's ex-husband - especially considering the testimonies in question were given by members of the complainant's ex-husband's family. The Church also highlighted that the ex-husband's freedom of religion, the confidentiality of clergy and, in particular, the rights of witnesses to have their statements protected, outweigh in this context the complainant's interest in having access to the information. In support of this assessment, it cited Article 22(1) of the Danish Data Protection Act, under which the controller may refuse to comply with an access request per Article 15 GDPR if, in a specific assessment, "the data subject’s interest in this information is found to be overridden by essential considerations of private interests."

Further, the Catholic Church expressed that whilst it understood that the complainant found the processing of her information unpleasant, as she did not wish to participate in the process herself, the interests of her ex-husband prevailed in this case, as the processing was necessary for him to practise his religion and to comply with the religious conditions of the Catholic Church for remarriage.

In addition, it submitted that the purpose of processing the data relating to the complainant had been solely for the processing of her ex-husband's application, and that in this context the Church processed the data relating to her pursuant to Article 6(1)(f) GDPR and Article 9(2)(d) GDPR.

In response, the complainant argued that she disagreed with all the points made by the Church, and that her complaint specifically related to the lack of insight she was given as to what the witnesses in the case were asked and what they answered.

The Danish DPA's ruling

First, the Danish DPA stated that a balancing of the opposing interests must be made.

After reviewing the case, it held that the Catholic Church failed to prove that consideration for the complainant's ex-husband's religious freedom, the priests' duty of confidentiality and the rights of the witnesses could justify its refusal to provide a copy of what the witnesses were asked about the complainant's previous marriage, as well as what their answers were.

The DPA emphasised that an exception from the right of access can only be made where there is an imminent danger that private interests will suffer significant damage. It held that in the present case, the Catholic Church failed to prove that the complainant's ex-husband's religious freedom, the priests' duty of confidentiality, and the witnesses' rights were in imminent danger of suffering significant damage when providing the information.

The DPA also emphasised that the Catholic Church could not show it made a balanced assessment of the case based on the facts, but simply refused to hand over a copy of the information. As such, it held that the Catholic Church's processing of personal data has not taken place in accordance with Article 15 GDPR.

The DPA therefore issued a reprimand against the Catholic Church of Denmark for its inadequate response to the access request and ordered the Catholic Church to reconsider the complainant's request, as well as specifically:

• to determine whether the conditions for providing access to complaints under Article 15 GDPR are met, and
• to notify complaints whether the request for access is granted or whether the request for access is rejected.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.

The Catholic Church receives criticism and orders to process requests for access
Date: 24-11-2021
Decision

In a complaint, the Danish Data Protection Agency has expressed criticism of the Catholic Church in Denmark's response to a request for insight. The Danish Data Protection Agency has also issued an order to the Catholic Church to carry out a reassessment of the complainant's request for access.

Journal number: 2021-31-4650.
The Danish Data Protection Agency hereby returns to the case where XX (hereinafter ‘complainant’) on 17 February 2021 has complained to the Authority about the Catholic Church in Denmark (hereinafter ‘the Catholic Church’) refusal of her request for access under the data protection rules.
Decision
Following an examination of the case, the Danish Data Protection Agency finds that there are grounds for expressing criticism that the Catholic Church's response to the complainant's request for access did not take place in accordance with the rules in Article 15 of the Data Protection Regulation [1].
Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision.
2. Order
The Danish Data Protection Agency also issues an order to the Catholic Church to re-evaluate the complainant's request for insight and in this connection:

to determine whether the conditions for providing access to complaints under Article 15 of the Data Protection Regulation are met, and
to notify complaints whether the request for access is granted or whether the request for access is rejected.

If the Catholic Church deems that the request for insight (in whole or in part) must be granted, the Catholic Church must, as part of the order, provide complainants with a copy of the personal information together with the notice.
If the Catholic Church deems that the request for insight cannot be granted, the Catholic Church must, as part of the injunction, provide complainants with information about the reason for this. This is also true if the Catholic Church provides only partial insight into complaints.
The order is issued pursuant to Article 58 (1) of the Data Protection Regulation. 2, letter c, and the deadline for compliance with the order is 6 weeks. The Danish Data Protection Agency requests the Catholic Church to inform the Authority within the same deadline of its response to complaints.
3. Case presentation
It appears from the case that the complainant's ex-husband has had a desire to remarry in the Catholic Church. In order for this to be possible, the previous marriage of the complainant and the complainant's ex-husband must be annulled. In this connection, the complainant's ex-husband has given an explanation as to why he believes that their previous marriage should be annulled. Complaints have been sent to the explanation and read through.
In order for the marriage to be fully annulled by the Catholic Church, witnesses must be called who testify about the complaints and the complainant's ex-husband's previous life and marriage, as well as the reason why they were divorced. In this connection, the complainant's ex-husband has chosen his mother and brother as witnesses.
Complainants then chose to contact the Catholic Church to gain insight into what questions the witnesses were asked about the complainant's privacy and what the witnesses answered.
360 Law Firm has in the case represented the Catholic Church, and has by letter of 12 May 2021 issued a statement in the case.
3.1. The remarks of the Catholic Church
The Catholic Church has generally stated that complainants can be exempted from their right of access pursuant to section 22 of the Data Protection Act [2], as the consideration of complainants must give way to decisive considerations for the complainant's ex-husband. In this connection, the Catholic Church has stated that the complainants are not seen to have had a legal interest in the case, including the testimony in question, as these are of no significance to the complainants and submitted by the complainant's ex - husband's family members. The Catholic Church has further emphasized that the consideration for the complainant's ex - husband's religious freedom, the priests 'duty of confidentiality and especially the witnesses' rights to keep their statements protected in this context outweighs the complainant's interest in gaining access to the information.
The Catholic Church has explained that a person who wishes to have the validity of his marriage tested by the Church Court (hereinafter 'the Court') must submit an application to the Court, which must briefly describe the process before and after the wedding and the reason for the divorce. At the same time, the applicant is asked to consent to the processing of personal data, and the applicant has thus given consent to the Court's processing of data, which is also obtained in connection with the processing of the case. The consent also includes permission for the application to be sent to the former spouse.
After consideration by the Court, the application is forwarded to the other party to the proceedings with a view to indicating whether or not he or she will take part in the proceedings. The other party must in any case be made aware of the charges in the application. If the other party does not wish to participate, the other party is declared absent by decree. In the specific case, complainants have refused to participate in the processing of the case.
If the decision ends with the marriage between the complainant and the complainant's ex - husband being declared invalid, it will be possible for the complainant's ex - husband to enter into marriage in a Catholic church. On this basis, the Catholic Church has assessed that the complainant's ex-husband has a great and religious interest in the case being processed, as the case processing is a prerequisite for him to be able to marry in the Catholic Church with his fiancée.
The Catholic Church has further expressed understanding that complainants perceive the processing of information about her as unpleasant, as she does not want to participate in the process herself, but that the consideration of her ex-husband in this case must weigh heavier, as the processing is necessary for he can practice his religion and abide by the religious conditions of the Catholic Church in order to remarry. The Catholic Church has further argued that the purpose of processing information on complaints was solely for the purpose of processing her ex-husband's application, and that the church in that connection processes the information about her pursuant to Article 6 (1) of the Data Protection Regulation. Article 9 (1) (f) and Article 9 (1) 2, letter d.
With regard to the summons of the complainant's ex - husband's mother and brother as witnesses, the Catholic Church has stated that witnesses in a case never have free access to personal or sensitive information about the parties other than that one of the parties wants the marriage annulled. The witnesses thus do not have access to the application for annulment of the marriage or the other party's submissions. In this connection, the witnesses are typically asked about their relationship with the parties and how long they have known them. The witnesses are also asked about their subjective perception of both parties as well as their now concluded marriage.
In relation to the statement that the complainants did not want to participate in the process, the Catholic Church has claimed that the complainants have waived their rights in the case. However, according to the rules of data protection law, complainants are still entitled to be informed whether information about her has been registered, which has, however, been rejected, cf. section 22 (1) of the Data Protection Act. 1.
The Catholic Church has further stated that according to the Data Protection Act § 22, para. 1, the data controller may refuse to disclose information, just as the data controller is not obliged to disclose a number of information to the data subject if the data subject's interest in the information, after a specific assessment, is found to give way to decisive considerations for private interests.
In this connection, the Catholic Church has referred to e.g. Danish Act 2-5-20, the Civil Service Act, the Administration of Justice Act, the Penal Code and the Public Administration Act and has argued that the Court is subject to the same duty of confidentiality as priests in Denmark. The Court's processing of testimonies is subject to the same confidentiality, which means that these testimonies may not be handed over by the Court. In addition, the witnesses have only given explanations for the purpose of the complainant's ex - husband's case and in this connection concrete support for her ex - husband's wish for the annulment of the marriage. The witnesses have given their explanations with the certainty that they could give explanations in a free forum and without risk to your right of access.
3.2. Complainant's remarks
Complainants have generally stated that her complaint specifically relates to a lack of insight into what the two witnesses in the case have been asked and what they have answered.
Complainants have stated that she has been informed by the Catholic Church that at some point she will be allowed to read the testimonies through by showing up at their office and under supervision will have the opportunity to read them. Complainants have also been in contact with a person affiliated with the church, who stated that the case was closed and that she could not gain insight into the witness statements unless the witnesses gave their consent for her to gain insight. In this connection, the complainant requested that the reply be sent in writing, which, however, could not be done.
Complainants have stated that she acknowledges her ex-husband's desire to marry a Catholic and that she has no objections to the statements he has made in connection with his application to invalidate their marriage. Throughout the process, this has been emphasized by complaints to the Catholic Church.
Complainants have further stated that the Catholic Church has not been sufficiently transparent in their description of the process, as she i.a. was not initially informed of the role of the two witnesses in the further course, and that she only found out at a subsequent conversation with her ex-husband that the witnesses would be asked the question regarding their previous marriage. When she then asked to be made aware of what questions the witnesses were asked regarding their previous marriage and the answers to it, she was informed that if she wanted to participate in the process, she would have the right to see all witnesses' answers and questions eventually in the course. However, complainants were also informed by a later e-mail that in cases such as the present, nothing was ever handed over to either of the parties, whether or not they participated.
Complainant has also rejected the Catholic Church's claim that she has repeatedly refused to participate in the proceedings.
As regards the Catholic Church's assessment that the consideration of the complainant's ex - husband outweighs the consideration of the complainant's interests in the present case, the complainant has stated that it is offensive that someone has commented on her privacy and has come up with subjective views on the reason why her marriage has ended. Complainants are of the opinion that she has the right to see what has been asked in to and what the witnesses have answered. Complainants also disagree that her complaint can be rejected on the basis of the Catholic Church's desire to protect her ex - husband's religious freedom, the priests' duty of confidentiality and the witnesses in relation to their statements.
4. Justification for the Danish Data Protection Agency's decision
The case concerns the complainant's request for insight into information about what the two witnesses in the case have been asked regarding her and her ex-husband's previous marriage, and what the witnesses have answered.
It also appears that the Catholic Church has rejected the complainant's request for insight on the basis of the Data Protection Act, section 22, subsection. 1, as the consideration of complaints must give way to decisive considerations of the complainant's ex - husband's religious freedom, the priests 'duty of confidentiality and in particular the witnesses' rights that their statements remain protected.
It follows from Article 15 of the Data Protection Regulation that data subjects have the right to receive the data controller's confirmation of the processing of personal data concerning him or her and, where appropriate, access to the personal data and a number of additional data. Pursuant to Article 15 (1) 3, the data controller shall provide a copy of the personal data being processed.
Of the Data Protection Act, section 22, subsection Paragraph 1 states that an exception to Article 15 of the Regulation may be made if the data subject's interest in the information is found to give way to overriding reasons relating to private interests, including the interests of the data subject himself.
It thus follows from the Data Protection Act, section 22, subsection 1, that a concrete balancing of the opposing interests must be made.
After reviewing the case, the Danish Data Protection Agency finds that the Catholic Church has not made it probable that consideration of the complainant's ex - husband's religious freedom, the priests' duty of confidentiality and the rights of witnesses could lead to the Catholic Church generally refusing to provide a copy of the witnesses have been asked about the previous marriage of the complainant and her ex-husband, as well as what the witnesses have answered.
In this connection, the Danish Data Protection Agency has emphasized that an exception from the right of access can only be made where there is an imminent danger that private interests will suffer significant damage. On the basis of what was stated in the case, the Danish Data Protection Agency assesses that the Catholic Church has not made it probable that neither the complainant's ex - husband's religious freedom, the priests 'duty of confidentiality or the witnesses' rights are in imminent danger of suffering significant damage when providing the information.
The Danish Data Protection Agency has also emphasized that the Catholic Church is not seen to have made a concrete balance in relation to the individual information, but simply generally refused to hand over a copy of the information.
The Danish Data Protection Agency then finds that the Catholic Church's processing of personal data has not taken place in accordance with Article 15 of the Data Protection Ordinance, which gives the Danish Data Protection Agency the opportunity to express criticism.
The Danish Data Protection Agency also finds reason to issue an order to the Catholic Church to reconsider the complainant's request for insight and in this connection:

to determine whether the conditions for providing access to complaints under Article 15 of the Data Protection Regulation are met, and
to notify complaints whether the request for access is granted or whether the request for access is rejected.

If the Catholic Church deems that the request for insight (in whole or in part) must be granted, the Catholic Church must, as part of the order, provide complainants with a copy of the personal information together with the notice.
If the Catholic Church deems that the request for insight cannot be granted, the Catholic Church must, as part of the injunction, provide complainants with information about the reason for this. This is also true if the Catholic Church provides only partial insight into complaints.
The order is issued pursuant to Article 58 (1) of the Data Protection Regulation. 2, letter c, and the deadline for compliance with the order is 6 weeks. The Danish Data Protection Agency requests the Catholic Church to inform the Authority of its response to complaints within the same deadline.
According to the Data Protection Act, section 41, subsection 2, no. 5, is punishable by a fine or imprisonment for up to 6 months for anyone who fails to comply with an order issued by the Danish Data Protection Agency pursuant to Article 58 (1) of the Data Protection Regulation. 2, letter c.


[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation).
[2] Act No. 502 of 23 May 2018 on supplementary provisions to the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Act).