Datatilsynet (Denmark) - 2019-32-0639: Difference between revisions

From GDPRhub
No edit summary
 
(6 intermediate revisions by 4 users not shown)
Line 1: Line 1:
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
{{DPAdecisionBOX
! colspan="2" |Datatilsynet - 2019-32-0639
|-
| colspan="2" style="padding: 20px;" |[[File:logoDK.png|center|250px]]
|-
|Authority:||[[Datatilsynet (Denmark)]]
|-
|Jurisdiction:||[[:Category:Denmark|Denmark]]
|-
|Relevant Law:||[[Article 5 GDPR#1a|Article 5(1)(a) GDPR]] [[Category:Article 5(1)(a) GDPR]]


[[Article 12 GDPR#1|Article 12(1) GDPR]] [[Category:Article 12(1) GDPR]]
|Jurisdiction=Denmark
|DPA-BG-Color=
|DPAlogo=LogoDK.png
|DPA_Abbrevation=Datatilsynet (Denmark)
|DPA_With_Country=Datatilsynet (Denmark)


[[Article 14 GDPR#1c|Article 14(1)(c) GDPR]] [[Category:Article 14(1)(c) GDPR]]
|Case_Number_Name=2019-32-0639
|ECLI=


[[Article 14 GDPR#2|Article 14(2) GDPR]] [[Category:Article 14(2)GDPR]]
|Original_Source_Name_1=Datatilsynet
|Original_Source_Link_1=https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2019/dec/arbejdsmarkedets-feriefonds-iagttagelse-af-oplysningspligt-og-brug-af-samtykke/
|Original_Source_Language_1=Danish
|Original_Source_Language__Code_1=DA


[[Article 14 GDPR#3|Article 14(3) GDPR]] [[Category:Article 14(3)GDPR]]
|Type=Complaint
|-
|Outcome=Upheld
|Type:||Complaint
|Date_Started=
|-
|Date_Decided=
|Outcome:||Upheld
|Date_Published=20.12.2019
|-
|Year=
|Decided:||n/a
|Fine=None
|-
|Currency=
|Published:||20.12.2019
 
|-
|GDPR_Article_1=Article 5(1)(a) GDPR
|Fine:||none
|GDPR_Article_Link_1=Article 5 GDPR#1a
|-
|GDPR_Article_2=Article 12(1) GDPR
|Parties:||Arbejdsmarkedets Feriefond v. Anonymous
|GDPR_Article_Link_2=Article 12 GDPR#1
|-
|GDPR_Article_3=Article 14(1)(c) GDPR
|National Case Number:||2019-32-0639
|GDPR_Article_Link_3=Article 14 GDPR#1c
|-
|GDPR_Article_4=Article 14(2) GDPR
|European Case Law Identifier:||n/a
|GDPR_Article_Link_4=Article 14 GDPR#2
|-
|GDPR_Article_5=Article 14(3) GDPR
|Appeal:||n/a
|GDPR_Article_Link_5=Article 14 GDPR#3
|-
 
|Original Language:||Danish
 
|-
 
|Original Source:||[https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2019/dec/arbejdsmarkedets-feriefonds-iagttagelse-af-oplysningspligt-og-brug-af-samtykke/ Datatilsynet (in DK)]
|Party_Name_1=Arbejdsmarkedets Feriefond
|}The ''Datatilsynet'' issued severe criticism of ''Arbejdsmarkedets Feriefond'', a Danish self-governing institution, for not providing a data subject with sufficient information in a timely manner, thereby not fulfilling their duties as controllers and breaching Article 12(1) and Article 14 of GDPR. In addition, Datatilsynet also issued criticism in relation to Article 5(1)(a) GDPR for the controller’s attempt to collect consent for the processing of the personal data after the data subject contacted the controller, as another legal basis was already relied upon to process the data.
|Party_Link_1=
|Party_Name_2=Anonymous
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=
 
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=
 
|Initial_Contributor=
|
}}
 
The ''Datatilsynet'' issued severe criticism of ''Arbejdsmarkedets Feriefond'', a Danish self-governing institution, for not providing a data subject with sufficient information in a timely manner, thereby breaching Articles 12(1), 14(1)(c), 14(2) and 14(3) GDPR. In addition, Datatilsynet also issued criticism in relation to Article 5(1)(a) GDPR for the controller’s attempt to collect consent for the processing of the personal data after the data subject contacted the controller, as another legal basis was already relied upon to process the data.
==English Summary==
==English Summary==
===Facts===
===Facts===
Line 52: Line 70:


===Holding===
===Holding===
Datatilsynet found that the information given did not provide information about the legal basis of the processing operation (Article 14(1)(c)) and the recipients of the personal data (Article 14(1) and (2) GDPR). As such, Datatilsynet found that the controller did not fulfil its duty to inform under Article 14 GDPR.
Datatilsynet found that the information given did not provide information about the legal basis of the processing operation (Article 14(1)(c) GDPR) and the recipients of the personal data (Article 14(1) and (2) GDPR). As such, Datatilsynet found that the controller did not fulfil its duty to inform under Article 14 GDPR and thus Article 12(1) GDPR.


Furthermore, Datatilsynet found that the information should have been provided in the first letter on the 28 January. Instead, part of the information was provided in letters dated on 14 February and 28 March. As such, Datatilsynet found this to be a breach of Article 14(3) GDPR.
Furthermore, Datatilsynet found that the information should have been provided in the first letter on the 28 January. Instead, part of the information was provided in letters dated on 14 February and 28 March. As such, Datatilsynet found this to be a breach of Article 14(3) GDPR.
Line 65: Line 83:
The decision below is a machine translation of the original. Please refer to the Danish original for more details.<pre>
The decision below is a machine translation of the original. Please refer to the Danish original for more details.<pre>


Insight into medical consultant reviews
The Labor Market Holiday Fund's observance of the obligation to provide information and the use of consent
Published 18-11-2019
Published 20-12-2019
Decision Private companies The Danish
Decision Private companies


Data Protection Agency has decided on a case in which a citizen complained that his pension company refused to give him insight into a medical consultant assessment that was prepared in connection with his case. In the case, the Danish Data Protection Agency found it necessary to issue serious criticism and to issue an injunction to the pension company.
The Data Inspectorate is seriously criticizing the Labor Market Holiday Fund, because did not adequately comply with its disclosure requirements in connection with the Fund's handling of a specific case for the payment of holiday pay.


Journal number: 2019-31-1424Agency
Journal number 2019-32-0639
Summary The Danish
CV


Data Protectionhas decided in a case in which a citizen complained that his pension company, the Jurists and Economists' Pension Fund (JØP), refused to give him access to a medical consultant's assessment.
The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.


In the case in question, JØP had refused to provide insights into the medical consultant's assessment in question, i.a. because it is a firm business practice for the company to obtain assessments from medical consultants to use the company's internal handling of the cases, and it is a common practice that these assessments are not shared with the clients as these are internal documents.
As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.


In its decision, the Data Inspectorate laid down, inter alia, emphasis is that, as a general rule, insight should be given to personal data and that a concrete assessment must always be made as to whether insight can be refused according to the exception rules. Therefore, JØP could not - as was the case in this case - generally cut off certain types of information from the right of access.
The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third


In the opinion of the Danish Data Protection Agency, JØP had not acted in accordance with Article 15 of the Data Protection Regulation on the right of access, which caused the Authority to give serious criticism.
In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.


Against this background, the Danish Data Protection Agency issued an injunction to make a concrete assessment of whether complaints can be given insight into personal data on complaints contained in the medical consultant assessment.
In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.
Decision The Danish


Data Protection Agency hereby returns to the case where on February 4, 2019, the Complaints complained to the Supervisor of a reply from the Jurisprudence and Economists' Pension Fund (hereafter JØP) of his request for insight under the Data Protection Regulation.
The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision


The Data Inspectorate has understood the complainant's request as a complaint about JØP's refusal of access to documents prepared by JØP's medical consultant and correspondence between JØP and the medical consultant, which was entered into the case regarding the grant of disability pension to the complainant.
The Danish Data Protection Authority hereby returns to the case where XX (hereafter complained) on 17 February 2019 complained to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Decision


The matter was discussed at a meeting of the Data Council.
Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.
1. Mandatory


It is DPA's opinion that JØP has not acted in accordance with the Data Protection Regulation [1] Article 15
Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.


Data Protection Agency is therefore reason to express severe criticism that JØP have not dealt with the complainant's request for access in accordance with Article 15
The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making


Data Protection must then give JØP orders to make a concrete assessment of whether complainants can be given insight into personal data on complaints contained in the medical consultant assessment. The order is issued pursuant to Article 58 (2) of the Data Protection Regulation. 2, point c.
It is apparent from the case file that on 28 January 2019, the complainant received a letter from the Labor Market Holiday Fund, qui a été fundé en toute transparency, a été modified, à the Board of Labor Market and Recruitment, to avoir des truffes de qualité, à Complainant unjustly, pour the avoir of the holiday money paid out, a pour avoir un ciel bleu les les bétons jusqu'à The Labor Market Holiday Fund.


The deadline for complying with the order is 18 December 2019. Data Protection Agency must request the same date to receive a confirmation that the order is complied with, and a copy of JØP's reassessment of the question of insight and answers for complaints.
The letter from the Labor Market Holiday Fund for complaints also stated:


According to section 41 (1) of the Data Protection Act [2]. Paragraph 2 (5) shall be punishable by a fine or imprisonment for up to 6 months to a person who fails to comply with an order issued by the Data Inspectorate pursuant to Article 58 (2) of the Data Protection Regulation. 2.
"We would like to note that the Labor Market Holiday Fund has registered your social security number, name, address, account number and information regarding this debt ratio in the Fund's case management system and financial system, respectively."
2. Presentation


of the case It appears from the case that complaints in connection with an objection request did not receive a number of documents and internal correspondence between JØP and a medical consultant.
On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.


JØP has refused to give complaints to the medical consultant's opinion.
In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that in the letter of 28 January 2019, the Fund's decision to place a place on the Holiday Fund, as a system of management of the Marques de Fabrics and Marques de Commerce , in terms of the system of registration of the person's names, addresses and names of the domain, in the case of the fund and the systems of management of the marque of the factory of the cadre of economic system. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.
2.1. JØP's comments


JØP has generally stated that by letter of 6 December 2018, JØP has met the complainant's request for insight, however, so that a medical consultant's assessment was excluded from insight. This medical consultant assessment is part of JØP's decision basis for awarding disability pension complaints in accordance with his application.
The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. Le Fund Holiday Fund and a crèche for aider les persones à se sentir plus à laise et à se sentir plus accountables.


The medical examiner's assessment was made on the basis of material that complainants are fully aware of, including specialist medical statements and supplementary health information, which complaints have been submitted to JØP.
Summary


JØP has stated that complaints have gained insight into all the personal data processed by the insurance company about him, however, the medical consultant assessment has been denied.
The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.


JØP has stated that it is a firm business practice at JØP - as is generally the case in the insurance and pension industry - that assessments are obtained from medical consultants for the purpose of JØP's internal handling of the cases. In this case, the medical consultant's task is to assess medical issues for use in JØP's decision on the case.
As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.


It is a common practice throughout the industry that the medical consultants' internal assessment and medical advice to the injury practitioners are not shared with the clients to whom the assessments relate. In order to ensure adequate and professional injury treatment, it is essential that the injury practitioners can obtain medical advice in confidence.
The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third


The need for confidentiality is partly due to the fact that medical assessments by nature contain uncertainties and arguments for and against a result. The internal assessment of the medical consultant must thus be comparable to an internal legal memorandum. On that basis, the medical consultant assessment is considered to be covered by the right to exempt internal assessments in accordance with section 22 (2) of the Data Protection Act. 1.
In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.


Confidentiality also ensures that, in the interaction between the claims officer and the medical consultant, all relevant questions are asked so that the whole case is covered. Confidentiality is thus in effect also for the sake of complaints themselves.
In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.


Furthermore, in the opinion of the JØP, the medical consultant's assessment can be exempted from the right of access for reasons of JØP's private interests, including the consideration of JØP's business basis and business practices and the possibility of defending his interests in any dispute cases.
The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision


JØP has finally stated that these are business secrets that can be exempted from the right of access under Article 15 (1) of the Data Protection Regulation. 4. 
The Danish Data Protection Authority hereby returns to the case where, on 17 February 2019, XX (hereafter) complains to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
2.2. Complainant's comments
1. Decision


Complainant has generally stated that complainants do not recognize that there should be business secrets or a violation of the freedoms of others.
Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.


Furthermore, the complainant states that JØP's refusal of access to the information in question means that the complainant cannot verify the accuracy of the personal data that has been processed.
Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.


Furthermore, complainants have stated that the opinion of the medical consultant is seen to have legal effect, as JØP has stated complaints that the medical consultant has assessed that complaints cannot be awarded permanent permanent pension at this time.  
The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2.3. Forsikring & Pension's comments
2. Case making


Forsikring & Pension has, as an industry organization, at the request of JØP submitted a statement to use the case. Forsikring & Pension finds that this is a fundamental problem for the insurance and pension industry.
It is apparent from the case file that on January 28, 2019, complaints were received by a letter from the Labor Market Holiday Fund, in which the Fund stated complaints that it had received notification that the Agency for Labor Market and Recruitment had decided that complaints had been unlawfully paid holiday pay, and that the amount owed should be paid into the Labor Market Holiday Fund.


Forsikring & Pension has confirmed that medical consultants' assessments are, as a rule, not shared with clients / injured parties. The assessments are intended to contribute to the company's decision-making basis, but are not in themselves conclusive.
The letter from the Labor Market Holiday Fund for complaints also stated:


Forsikring & Pension has stated that if it is not possible to secure a room for internal assessment, there is a risk that either statements will not be obtained or that the statements will be incomplete, because doctors are aware that later insight can be given. This could damage the policyholder's case.
“We note that the Labor Market Holiday Fund has registered your social security number, name, address, account number. as well as information regarding the debt ratio in question in the Fund's case management system and financial system, respectively. "


Finally, Forsikring & Pension argues that a further argument that these statements can be exempted under section 22 (2) of the Data Protection Act. 1, is the consideration of the policyholder himself. Medical assessments may include some uncertainties and considerations that may cause misunderstanding and unnecessary concern on the part of the policyholder.
On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.
3. Legal basis
3.1. The concept of personal data


The term personal data is defined in Article 4 (1) of the Data Protection Regulation as any form of information about an identified or identifiable natural person ('the data subject'). An identifiable natural person means a natural person who, on the basis of the information, can be identified directly or indirectly.
In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that, in the letter of 28 January 2019, the Fund had informed her that the Fund had received notification from the Danish Labor Market and Recruitment Agency and that the Fund had registered her social security number, name, address and information on the debt ratio in question in the Fund's case management system and financial system, respectively. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.
3.2. The right of access for data protection Article 15


According to the data protection of Article 15 that the data subject has the right to have the controller's confirmation of whether personal data concerning him processed and, where appropriate, access to personal information and the following information:
The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. The Labor Market Holiday Fund referred complaints to read more on the fund's website about how the fund processes personal data.


    purposes of the processing
The Labor Market Holiday Fund also stated that it does not require consent when the Labor Market Holiday Fund registers personal data in order to pursue a claim that a higher authority has decided to pay to the Fund. As a result, consent cannot be revoked either.
    concerned categories of personal data means
    the recipients or categories of recipients to whom the personal data is or will be disclosed, in particular recipients in third countries or international organizations, where possible, the intended period for which the personal data will be stored or, if this is not possible, the criteria used for determining that period the
    right to request the data controller to correct or delete personal data or to limit the processing of personal data concerning the data subject or to object to such processing theobject
    right toprovide a complaint to a supervisory authority with
    all available information on where the personal data originates if it is not collected from the registered
    occurrence of automatic decisions, including profiling, as referred to in Article 22 (2). 1 and 4, and at least meaningful information about the logic therein, as well as the significance and expected consequences of such processing for the data subject.


The Data Protection Regulation's preamble recital No 63 states, inter alia, the following:
In addition, the Labor Market Holiday Fund stated in its letter of complaint of February 14, 2019 that she had applied to the Labor Market Holiday Fund both through the Fund's regular contact form and through the Fund's contact form to DPO, which stated on both forms:


“A data subject should have the right to access personal data collected about him and to exercise that right easily and at reasonable intervals in order to ascertain and verify the legality of a processing. This includes the right of data subjects to access their health information, e.g. data in their medical records on diagnoses, examination results, medical assessments as well as any treatment and any intervention made. […] This right should not infringe on the rights or freedoms of others, including trade secrets or intellectual property, in particular the copyright of the programs. […] ”However, the
"When you as a citizen apply to the Labor Market Holiday Fund, you consent to the Fund having to register your personal information (name, address, CPR number) in the Fund's case management system and / or financial system, depending on what is necessary for the Fund to process your inquiry."


right of access is limited by Article 15 (2) of the Regulation. 4, according to which the right to receive a copy of the personal data processed must not infringe on the rights and freedoms of others.
Subsequently, the complainant entered into an agreement on repayment of holiday money, which the Labor Market Holiday Fund confirmed in a letter of 6 March 2019. In the letter, the Labor Market Holiday Fund again stated that the fund had registered her social security number, name, address, account number and information regarding the debt ratio in the fund's case management system and financial system.


Furthermore, section 22 of the Data Protection Act contains restrictions on the right of access. The right to access is limited, among other things. pursuant to section 22 (2) of the Act. 1, according to which the right of access does not apply if the data subject's interest in the information is found to depart from the imperative of private interests, including the interests of the data subject himself.
The complainant subsequently settled the claim of the fund, which the fund acknowledged in a letter of March 28, 2019. In this connection, the fund stated that her personal information would be disclosed to the National Archives in accordance with the archive rules.
3.3. Case law of the European Court


In Joined Cases C-141/12 and C-372/12 YS and M and S v Minister for Immigration, Integration and Asylum (hereinafter the Immigration case), stated that a legal analysis prepared in an internal administrative document with a case manager's reason for draft decision in connection with an asylum applicant's application for a residence permit is not a personal information about the asylum seeker. The judgment states, inter alia, the following:
By letter of 19 March 2019, the Danish Data Protection Agency requested the Labor Market Holiday Fund for an opinion in the case, which the Authority received on 28 March 2019.
2.1. The complainant's remarks


”40. As the Advocate General essentially states in paragraph 59 of the Opinion, and as the Netherlands, Czech and French Governments state, such a legal analysis does not constitute information on the applicant for a residence permit, but rather in so far as: it is not limited to a purely abstract interpretation of the legal rules, information on the assessment of the competent authority and the application of those legal rules in relation to the applicant's situation. is determined on the basis of the personal data of the applicant's person at the disposal of the authority. […]
The complainant has generally stated that the Labor Market Holiday Fund did not comply with its duty of disclosure by informing her only of what personal data the Fund processes about her. The complainant adds that the duty of disclosure implies that the data controller - in addition to informing the data subject about the information being processed about the data subject - must also provide the data subject with a number of information about the data processing.


44. As regards the rights of the data subject within the meaning of Directive 95/46, it should be noted that the protection of the fundamental right to respect for privacy inter alia: implies that the data subject must be able to ensure that the personal data of the person concerned is correct and legally processed. […]
In addition, complainants state that the Labor Market Holiday Fund's request for consent to processing personal data in connection with her request to the Fund's data protection adviser did not comply with the data protection rules, including that the consent was not voluntarily given, as the complainant could not really decide whether she would give consent or not.
2.2. Comments from the Labor Market Holiday Fund
2.2.1.


45. Contrary to the information relating to an applicant for a residence permit contained in a statement and which may constitute the factual basis for the legal analysis of the statement, such analysis - as the Netherlands and French Governments have stated - is thus not in itself subject to the applicant's verification of its correctness and to an amendment under Article 12 (b) of Directive 95/46.
The Labor Market Holiday Fund has stated that the Fund is a self-governing institution under the state administration and that it is incumbent on the Labor Market Holiday Fund to recover the Fund's (state's) claim for unduly paid holiday allowance as a result of decisions taken by the Danish Labor Market and Recruitment Agency or by the Ankur.


46. ​​In those circumstances, extending the right of access for an applicant for a residence permit to the legal analysis does not really serve the purpose of the directive to safeguard that applicant's right to privacy when processing information about the applicant, but the purpose to secure the right to access administrative documents in question, which, however, is not covered by Directive 95/46.
In relation to the specific case, the Labor Market Holiday Fund stated that on January 28, 2019, the Fund received information on complaints from the Board of Labor and Recruitment in the form of a copy of the Board's decision of 18 May 2018 to complaints about unjustified payment of holiday pay, which subsequently was confirmed by the National Board of Appeal on January 25, 2019.


47. In a similar context, as regards the processing of personal data by the Union institutions, governed by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data personal data in the Community institutions and bodies and on the free exchange of such information (OJ 2001 L 8, p. 1) and, secondly, Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 on public access to European Parliament , Council and Commission documents (OJ 1998 L 145, p. 43), the Court has already stated in paragraph 49 of Commission v Bavarian Lager (C-28/08 P, EU: C: 2010: 378) that these regulations differ and Regulation No 45/2001, unlike Regulation No 1049/2001, does not aim to ensure transparency in the decision-making process of public authorities and to promote good administrative practice by facilitating the exercise of the right of access. That finding also applies to Directive 95/46, the purpose of which essentially corresponds to the purpose of Regulation No 45/2001.
Furthermore, the Labor Market Holiday Fund states that by letter of 28 January 2019, the Fund stated complaints that the Fund had registered information on her social security number, name, address, account number and information on the debt ratio in question in the Fund's case management system and financial system.


48. It follows from all the foregoing considerations that the first and second questions in Case C-141/12 and the fifth question in Case C-372/12 must be answered by the fact that Article 2 (a) of Directive 95 / 46 is to be interpreted as meaning that the particulars relating to an applicant for a residence permit contained in a statement and, where applicable, the information contained in the legal analysis of the statement constitute 'personal data' within the meaning of this provision, the legal analysis, on the other hand, cannot in itself be classified in the same way. ”
In addition, in a letter dated February 14, 2019 to the complainant, the fund stated that the fund would forward the complainant's personal information to the fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. In the letter, the Labor Market Holiday Fund also referred complaints to read more about the Fund's personal data policy on the Fund's website.


In Case C-434/16 Peter Nowak v Data Protection Commissioner (hereinafter the Nowak case), the European Court of Justice has further stated that a written reply, as a participant has provided in connection with a professional test, and any examiners' corrections and comments on this answer are considered to be personal information. The judgment states, inter alia, the following:
The Labor Market Holiday Fund has stated that the purpose of the Fund's treatment of complainant's personal data is clearly stated in the context, as complaints in the Board of Labor Market and Recruitment's decision of 18 May 2018 were informed that the case would be transferred to the Labor Market Holiday Fund for the purpose of recovery of the claim.


”34. The use of the term 'any type of information' in the definition of the term 'personal data' in Article 2 (a) of Directive 95/46 reflects that the EU legislature intended to give this concept a broad meaning, since it is not limited to sensitive or private information, but potentially includes any form of information, both objective and subjective in the form of expressions of opinion or judgment, provided that the information is "about" the person concerned.
The Labor Market Holiday Fund has also stated that in its letter of 28 March 2019 to complaints the Fund informed her that her personal information would be disclosed to the National Archives.


35. As regards the latter condition, it is fulfilled if, because of its content, purpose or effect, the information is linked to a particular person. […]
The Labor Market Holiday Fund has stated that on this basis it is the Fund's view that the Fund's handling of information duty has been in accordance with Articles 13 and 14 of the Data Protection Regulation.
2.2.2.


42. Regarding the examiner's corrections and comments on the participant's answer, it should be noted that these, like the answer given by the participant in the examination, constitute information about this participant.
The Labor Market Holiday Fund states that the Fund has processed non-sensitive personal data on complaints under Article 6 (2) of the Data Protection Regulation. Article 11 (1) (c) and (e). Information on the complainant's social security number has been processed on the basis of section 11 (1) of the Data Protection Act [2]. First


43. The content of these corrections and comments thus reflects the examiner's opinion or assessment of the participant's individual performance in the exam, and in particular of his knowledge and competence in the field concerned. Moreover, the corrections and comments are intended precisely to document the examiner's evaluation of the participant's performance and may thus have an effect on the latter as stated in paragraph 39 of this judgment. […]
The Labor Market Holiday Fund has stated that complaints in the specific case subsequently applied to the Fund through the Fund's standard contact form and standard DPO contact form, which are forms that can be used by citizens who apply, regardless of whether the fund has already registered personal information about those concerned. Against this background, the Labor Market Holiday Fund, by default, states on the forms that an inquiry will entail registration of personal data and that the person submitting the contact form gives consent for this.


46. ​​Contrary to the data protection supervisor and Ireland's where applicable, the qualification of the answer given by the participant in the course of a professional test, and any examiners' corrections and comments on that answer as personal data shall not be affected by the fact that this qualification, in principle, entitles the participant to insight and rectification. of Article 12 (a) and (b) of Directive 95/46. " 
The Labor Market Holiday Fund has stated that complaints in the specific case did not appear with personal data that the Fund had not already registered as part of the processing of the pending complaint regarding the payment of holiday pay. Thus, the complainant's personal information was not processed on the basis of consent.
Justification of the Danish Data Protection Agency's decision on access to medical consultant assessments
3. Justification for the Danish Data Protection Agency's decision
3.1.


According to the case information, there is no agreement between the parties as to whether complaints - in addition to medical consultancy assessments - have been received insight.
It follows from Article 14 (1) of the Data Protection Regulation. 1 and 2, that the data controller - if the information is not collected from the data subject - must provide the data subject with a number of information, including: to ensure fair and transparent treatment of the data subject.


The Data Inspectorate finds no basis for infringing JØP's information that JØP does not process more information about complaints than the personal data already disclosed and personal data contained in the medical consultant assessment in this case.
Pursuant to Article 14 (1) of the Data Protection Regulation. 3, the data controller shall provide the information referred to in paragraph 1. 1 and 2, at the latest at the time of the first communication with the data subject if the information is to be used to communicate with the data subject, and otherwise within one month after the collection of the information. The information can be given to the data subject, for example in a direct link.


In this connection, the Data Inspectorate notes that the audit only deals with cases on a written basis and that the audit therefore does not have the opportunity to conduct an actual investigation of the case. The final assessment of such evidentiary issues may be made by the courts, which, unlike the Data Inspectorate, have the opportunity to elucidate the situation in detail, including by hearing witnesses.
In addition, pursuant to Article 12 (2), the data controller must: 2. In accordance with paragraph 1, appropriate measures shall be taken to provide any information referred to in Articles 13 and 14 on treatment to the data subject in a concise, transparent, easily understandable and easily accessible form and in a clear and simple language.
4.1. Is it personal data?


The question of whether insight should be given to the medical consultant assessment depends initially on whether the assessment can be considered to be personal data.
The Data Inspectorate assumes that personal data on complaints were not collected from the registered self, but were received from the Danish Labor Market and Recruitment Agency on January 28, 2019.


Personal information is defined as any kind of information about an identified or identifiable natural person. Thus, there is no doubt that information about pensioners, which appears in the underlying material, including specialist medical statements, patient records, etc., must be considered personal data.
In addition, the Data Inspectorate assumes that the Labor Market Holiday Fund, in a letter of 28 January 2019, stated complaints that the Fund processed information on the complainant's social security number, name, address, account number and information on the current debt ratio, that the Labor Market Holiday Fund in a letter of 14 February 2019 stated at the request of the complainant that the information could be disclosed to a lawyer and that in the letter of 28 March 2019, the Labor Market Holiday Fund stated complaints that the information would be disclosed to the National Archives.


The question then is whether the medical assessment carried out by a medical consultant on the basis of this material can also be considered as personal data.
In addition, the Data Inspectorate assumes that in the letter of 14 February 2019, the Labor Market Holiday Fund - in response to inquiries from complaints - referred complaints to read more about the Fund's personal data policy on the Fund's website.


In the opinion of the Data Inspectorate, a medical assessment differs from a legal analysis - as referred to in the Immigration case - in several respects. First, the medical assessment differs from the legal analysis in that in the present case, the medical assessment will be based on personal data. A legal analysis, on the other hand, will not in the same way depend on personal data about a specific person, but will instead be based on a set of rules, processes, case law, etc. with a view to subsuming the facts of the case in relation to the given legal basis.
The version of the Fund's personal data policy in force at the time stated:


Furthermore, a medical assessment is in itself seen as being able to lead to new personal data. The actual assessment of the medical material involves a new assessment of the person's health conditions and thus specific statements about the person's health conditions, which in itself must be considered personal data. In this context, reference is made to the Article 29 Working Party's opinion on personal data [3], which refers to information about a person when the information relates to the person, and it is clear that the results of a medical analysis are considered personal data.
    identity and contact information of the data controller
    contact information for any data protection adviser
    the purposes of the Fund's processing of information
    the categories of personal data concerned
    how long the information was stored
    information on the rights of data subjects
    the right to lodge a complaint with a supervisory authority (which was incorrectly stated to be the Danish Labor and Employment Agency)
    where the information came from


The opinion of the Article 29 Working Party also states that: will be personal data when there is a "purpose element", ie. when the information is used or can be expected to be used for the purpose of assessing a person, treating that person in a particular way, or influencing that person's status or behavior. In line with this, the opinion of the European Court of Justice in the Nowak case shows that an examiner's corrections and comments constitute personal information about the person who wrote the answer. The content of the corrections and comments reflect the examiner's opinion or judgment of the person's performance. The corrections and comments are intended to document the examiner's evaluation of the participant's performance.  
Thus, the personal data policy included not information on the legal basis for the processing (Article 14 (1) (c)) and information on possible recipients of personal data (Article 14 (1) (e)).


Overall, the Data Protection Agency considers that the contents of a medical consultant analysis approaches must be considered to be personal data to the extent that there is information relating to an identified or identifiable natural person referred to in. Article 4. 1.
Accordingly, the Data Inspectorate finds that the Labor Market Holiday Fund did not sufficiently comply with its duty of disclosure towards complaints, in accordance with Article 14 (1) of the Data Protection Regulation. 1 and 2.


The fact that the qualification of the content of a medical consultant assessment as a personal data means that such an opinion will be covered by the Data Protection Regulation and the rights that follow, - as stated in para. 46 in the Nowak case - does not in itself affect the qualification.
The Data Inspectorate further finds that the Labor Market Holiday Fund did not fulfill its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. 3. The Data Inspectorate hereby emphasizes that in its first letter of 28 January 2019, the Labor Market Holiday Fund should have given complaints all the information covered by the disclosure obligation, but that a number of the information was first communicated to complaints on 14 February 2019 and 28. March 2019.
4.2. Is the information subject to the right of access?


The Data Protection Authority is of the opinion that it follows from the Data Protection Regulation that, as a general rule, access to personal data must be provided and that a concrete assessment must always be made as to whether access can be refused according to the exception rules. Thus, as is seen in the present case, JØP cannot generally cut off certain types of information from the right of access.
In addition, the Data Inspectorate finds that the Labor Market Holiday Fund has not complied with Article 12 (2) of the Data Protection Regulation. 1, in connection with the processing of the complainant's personal data. The Data Inspectorate has hereby emphasized that, by communicating complaints, the Labor Market Holiday Fund, step by step, in the course of the case processing rather than in a single communication, has not taken appropriate measures to provide any information referred to in Article 14 in a concise, transparent, easily understandable and easily accessible form.


When the content of medical consultancy assessments is classified as personal data, the complainant is in principle entitled to access the personal data in the opinions under Article 15 of the
Against this background, the Data Inspectorate finds a basis for expressing serious criticism of the Labor Market Holiday Fund's processing of complainant's personal data.
3.2.


Data Protection Regulation. The Data Inspectorate furthermore states that it follows from preamble recital 63 that the right of access includes the right to access health information, f. eg. medical assessments.
As regards the part of the complaint relating to obtaining consent, the Data Inspectorate notes that Article 5 of the Data Protection Regulation contains general principles for the processing of personal data. It appears, among other things, of Article 5 (2); 2. Paragraph 1 (a) requires that personal data be legally, reasonably and transparently processed.
4.2.1. Exemption under Article 15 (1) of the Data Protection Regulation. 4 The


right to access is limited, among other things. Article 15 (1) of the Data Protection Regulation. 4, according to which the right of access must not infringe the rights or liberties of others. The rights or freedoms of others may include: business secrets.
The Labor Market Holiday Fund has stated that the processing of the information at issue is based on Article 6 (2) of the Data Protection Regulation. 1, c and e, and section 11 (1) of the Data Protection Act. 1, cf. section 2.2.2. above. The processing is thus conducted on a basis other than consent, which is why obtaining the complainant's consent is not in accordance with Article 5 (2). 1, point a.


JØP has not given any detailed reasons why these are business secrets and therefore information that can be exempted from the right of access under Article 15 (2) of the Regulation. 4.
Against this background, the Data Inspectorate finds a basis for criticizing the Labor Market Holiday Fund.
4th


In the light of the information provided by the Data Inspectorate, the personal data appearing from the medical consultant assessment from JØP's medical consultant cannot be considered as trade secrets, in particular because it has not been established that the information has a commercial value or otherwise way includes what might otherwise be considered business secrets. In this connection, the Data Inspectorate has also emphasized that JØP itself has informed the Authority of its treatment of injury cases, etc., including for what purposes and how the opinions of medical consultants are obtained. Furthermore, according to the report, there is a firm practice throughout the industry, which is why insights in these statements, in the opinion of the Authority, cannot be considered a business secret.
It is added that if the Labor Market Holiday Fund also processes personal data which the Labor Market Holiday Fund believes can only be done on the basis of consent, the Data Inspectorate must point out that it follows from Article 4 (11) of the Data Protection Regulation that consent is understood as any voluntary, specific, informed and unambiguous disclosure by the data subject, whereby the data subject, by declaration or clear confirmation, consents to the processing of personal data relating to the data subject. It also follows from Article 7 (1) of the Data Protection Regulation. 3 that the data subject has the right at any time to withdraw his consent.


Against this background, the Data Inspectorate finds that JØP does not refer to Article 15 (2) of the Regulation. 4, may refuse to provide insight into personal data on complaints contained in medical consultant reviews.
It is the opinion of the Data Inspectorate that the consent that the complainant made in connection with his inquiries to the Labor Market Holiday Data Protection Advisor does not meet the conditions for a valid consent, i.a. because it cannot be considered voluntary, as complainants had no alternative but to consent to the treatment if complainants would contact the Data Protection Advisor.
4.2.2. Exemption under section 22 (2) of the Data Protection Act. 11) of the
 
According to section 22 (Data Protection Act. In accordance with paragraph 1, the right of access may be restricted if the data subject's interest in the information should be found to depart from the overriding considerations of private interests, including the interests of the person concerned.
 
Under this provision, JØP may, after a specific assessment, refuse to provide information if it will cause the company's business base, business practices or know-how to suffer material damage. Furthermore, after a specific assessment, it will be possible to refuse insight into internal assessments of whether the company will enter into a contractual relationship on the basis of available information, change an existing contractual relationship, impose special conditions for continuation, possibly terminate a contractual relationship and similar cases. Similarly, it will be possible to refuse insight into e.g. a note assessing whether there is a prospect of winning a particular lawsuit against a customer, or an internal note in a case that points to possible evidence that a customer has attempted to pursue insurance fraud against an insurance company or attempted to evade the obligation under e.g. a loan contract. [4]
 
There must be "decisive considerations", which means that exceptions to the right of access can only be made in cases where there is a nearby danger that private interests will suffer material damage.
 
It is clear from the Register Committee's report no. 1345/1997 on the processing of personal data, p. 311, that it is recognized that private data controllers like public data controllers need to be able to protect internal decision-making to some extent. The right of access may be limited on the basis of the company's decisive interest in being free to assess, among other things, the conclusion of contracts and existing customer relationships, and to prevent competitors from obtaining information that is purely internal assessments or business secrets. The Committee therefore considered that the right of access should be limited if disclosure of information in the specific situation would entail an imminent risk of harm. On the other hand, the fact that these are internal assessments, etc., cannot in itself justify a refusal of a request for access.
 
In the opinion of the Data Inspectorate, the personal data in the medical consultancy assessment are not, as a general rule, internal information that can be exempted from insight under section 22 (2) of the Data Protection Act. 1.
 
It is hereby emphasized that there are no such internal documents referred to in the comments to the provision, which state that exceptions to the right of access can only be made if there is an obvious danger that: private interests will suffer material damage. Concrete statements about medical conditions from medical consultants are not seen to have any content that could cause such an imminent danger that private interests will suffer material damage.
 
Nor does the fact that the statements can be involved in connection with any complaints or litigation against JØP, does not mean that the personal data in the statements can be exempted from insight according to section 22 (2) of the Act. 1. Thus, it does not appear to be notes in which it is assessed whether there is a prospect that a particular lawsuit against a customer can be won, nor is it an internal note in a case that points to possible evidence that a customer has attempted to carry out insurance fraud against an insurance company or has attempted to evade the obligation under, for example, a loan contract or other matters of a similar nature. It is, on the other hand, a contribution to the decision-making basis for the overall assessment and thus for the decision taken by JØP on the grant of invalidity pension.
 
The need for confidentiality in order to create a freer framework for being able to ask questions to the medical consultant and for the medical consultant to comment cannot, in the opinion of the Danish Data Protection Agency, justify the exclusion of personal data in the opinions.
 
The fact that JØP regards the medical consultant assessment as an internal document and as part of JØP's decision-making basis, which is requested to be confidential, and that the opinions could potentially be involved in any subsequent disputes with pensioners, does not appear to be of such crucial importance under the Data Protection Act. Section 22 (2). 1 that the data subject's right to access - and thus, among other things, the possibility of verifying the accuracy of personal data - generally can be overridden.
 
Finally, the consideration of the data subject itself does not appear to be able to result in the assessments generally being exempt from the right of access. The fact that the data subject is given insight into the information being processed about the person, and thus knowledge of any misunderstandings or erroneous information, is generally considered to weigh more heavily.
 
It should be noted that the Data Inspectorate considers that the exceptions to the right of access are very narrow. In this connection, the Danish Data Protection Authority attaches particular importance to the fact that the right of access gives the data subject access to verify the accuracy of the personal data and the lawfulness of the processing, and that this principle can only exceptionally be waived.
 
Accordingly, it is the opinion of the Data Inspectorate that JØP, when dealing with the question of access to the medical consultancy assessment, did not act in accordance with Article 15 of the
 
Data Protection Regulation. 15. The
 
Data Inspectorate must then notify JØP of a specific assessment of whether complaints can be given insight into personal data on complaints contained in the medical consultant assessment. The order is issued pursuant to Article 58 (2) of the Data Protection Regulation.2) of the
 
According to section 41 (Data Protection Act. Paragraph 2 (5) shall be punishable by a fine or imprisonment for up to 6 months to a person who fails to comply with an order issued by the Data Inspectorate pursuant to Article 58 (2) of the Data Protection Regulation. 2nd


   
   
Line 268: Line 256:


[2] Act No 502 of 23 May 2018 on additional provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such information (Data Protection Act).
[2] Act No 502 of 23 May 2018 on additional provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such information (Data Protection Act).
[3] Article 29 Group Opinion No 4/2007 on the concept of personal data (WP136) of 20 June 2007
[4] Bill No 68, FT 2017/18, comments on section 22 of the Bill


</pre>
</pre>

Latest revision as of 16:23, 6 December 2023

Datatilsynet (Denmark) - 2019-32-0639
LogoDK.png
Authority: Datatilsynet (Denmark)
Jurisdiction: Denmark
Relevant Law: Article 5(1)(a) GDPR
Article 12(1) GDPR
Article 14(1)(c) GDPR
Article 14(2) GDPR
Article 14(3) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published: 20.12.2019
Fine: None
Parties: Arbejdsmarkedets Feriefond
Anonymous
National Case Number/Name: 2019-32-0639
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Danish
Original Source: Datatilsynet (in DA)
Initial Contributor: n/a

The Datatilsynet issued severe criticism of Arbejdsmarkedets Feriefond, a Danish self-governing institution, for not providing a data subject with sufficient information in a timely manner, thereby breaching Articles 12(1), 14(1)(c), 14(2) and 14(3) GDPR. In addition, Datatilsynet also issued criticism in relation to Article 5(1)(a) GDPR for the controller’s attempt to collect consent for the processing of the personal data after the data subject contacted the controller, as another legal basis was already relied upon to process the data.

English Summary

Facts

Datatilsynet examined a complaint regarding the processing of personal data by the self-governing institution Arbejdsmarkedets Feriefond. Arbejdsmarkedets Feriefond processed a claim of overpayment of vacation pay to the complainant. The basis of the claim was personal data provided by a governing body under the Ministry of Employment.

Arbejdsmarkedets Fond informed the complainant by letter that they processed information about the complainant’s personal governmental number, name, address, account number, and information about the debt (in this case, owed money for overpayment). Further information was provided, stating that the personal data could be shared with a lawyer, and that the information would be shared with the Danish National Archives. In a later exchange, the complainant was directed to the privacy policy of Arbejdmarkedets Feriefond.

In addition, there was a question regarding the legal basis being used. When contacting the data protection officer by a standard formula on their webpage, it provided information that contacting the data protection officer would result in personal data being processed, and that contacting the data protection officer was seen as constituting consent for this processing.

Dispute

The question for Datatilsynet was whether the information given by the controller was enough to comply with its duty to inform the data subject about the processing taking place.

Holding

Datatilsynet found that the information given did not provide information about the legal basis of the processing operation (Article 14(1)(c) GDPR) and the recipients of the personal data (Article 14(1) and (2) GDPR). As such, Datatilsynet found that the controller did not fulfil its duty to inform under Article 14 GDPR and thus Article 12(1) GDPR.

Furthermore, Datatilsynet found that the information should have been provided in the first letter on the 28 January. Instead, part of the information was provided in letters dated on 14 February and 28 March. As such, Datatilsynet found this to be a breach of Article 14(3) GDPR.

With regards to the consent, Datatilsynet stated that the apparent reliance on consent – even if consent was not in fact relied upon, constituted a breach of Article 5(1)(a) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Danish original for more details.


The Labor Market Holiday Fund's observance of the obligation to provide information and the use of consent
Published 20-12-2019
Decision Private companies

The Data Inspectorate is seriously criticizing the Labor Market Holiday Fund, because did not adequately comply with its disclosure requirements in connection with the Fund's handling of a specific case for the payment of holiday pay.

Journal number 2019-32-0639
CV

The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.

As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.

The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third

In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.

In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.

The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision

The Danish Data Protection Authority hereby returns to the case where XX (hereafter complained) on 17 February 2019 complained to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Decision

Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.

Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.

The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making

It is apparent from the case file that on 28 January 2019, the complainant received a letter from the Labor Market Holiday Fund, qui a été fundé en toute transparency, a été modified, à the Board of Labor Market and Recruitment, to avoir des truffes de qualité, à Complainant unjustly, pour the avoir of the holiday money paid out, a pour avoir un ciel bleu les les bétons jusqu'à The Labor Market Holiday Fund.

The letter from the Labor Market Holiday Fund for complaints also stated:

"We would like to note that the Labor Market Holiday Fund has registered your social security number, name, address, account number and information regarding this debt ratio in the Fund's case management system and financial system, respectively."

On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.

In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that in the letter of 28 January 2019, the Fund's decision to place a place on the Holiday Fund, as a system of management of the Marques de Fabrics and Marques de Commerce , in terms of the system of registration of the person's names, addresses and names of the domain, in the case of the fund and the systems of management of the marque of the factory of the cadre of economic system. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.

The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. Le Fund Holiday Fund and a crèche for aider les persones à se sentir plus à laise et à se sentir plus accountables.

Summary

The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.

As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.

The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third

In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.

In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.

The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision

The Danish Data Protection Authority hereby returns to the case where, on 17 February 2019, XX (hereafter) complains to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Decision

Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.

Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.

The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making

It is apparent from the case file that on January 28, 2019, complaints were received by a letter from the Labor Market Holiday Fund, in which the Fund stated complaints that it had received notification that the Agency for Labor Market and Recruitment had decided that complaints had been unlawfully paid holiday pay, and that the amount owed should be paid into the Labor Market Holiday Fund.

The letter from the Labor Market Holiday Fund for complaints also stated:

“We note that the Labor Market Holiday Fund has registered your social security number, name, address, account number. as well as information regarding the debt ratio in question in the Fund's case management system and financial system, respectively. "

On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.

In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that, in the letter of 28 January 2019, the Fund had informed her that the Fund had received notification from the Danish Labor Market and Recruitment Agency and that the Fund had registered her social security number, name, address and information on the debt ratio in question in the Fund's case management system and financial system, respectively. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.

The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. The Labor Market Holiday Fund referred complaints to read more on the fund's website about how the fund processes personal data.

The Labor Market Holiday Fund also stated that it does not require consent when the Labor Market Holiday Fund registers personal data in order to pursue a claim that a higher authority has decided to pay to the Fund. As a result, consent cannot be revoked either.

In addition, the Labor Market Holiday Fund stated in its letter of complaint of February 14, 2019 that she had applied to the Labor Market Holiday Fund both through the Fund's regular contact form and through the Fund's contact form to DPO, which stated on both forms:

"When you as a citizen apply to the Labor Market Holiday Fund, you consent to the Fund having to register your personal information (name, address, CPR number) in the Fund's case management system and / or financial system, depending on what is necessary for the Fund to process your inquiry."

Subsequently, the complainant entered into an agreement on repayment of holiday money, which the Labor Market Holiday Fund confirmed in a letter of 6 March 2019. In the letter, the Labor Market Holiday Fund again stated that the fund had registered her social security number, name, address, account number and information regarding the debt ratio in the fund's case management system and financial system.

The complainant subsequently settled the claim of the fund, which the fund acknowledged in a letter of March 28, 2019. In this connection, the fund stated that her personal information would be disclosed to the National Archives in accordance with the archive rules.

By letter of 19 March 2019, the Danish Data Protection Agency requested the Labor Market Holiday Fund for an opinion in the case, which the Authority received on 28 March 2019.
2.1. The complainant's remarks

The complainant has generally stated that the Labor Market Holiday Fund did not comply with its duty of disclosure by informing her only of what personal data the Fund processes about her. The complainant adds that the duty of disclosure implies that the data controller - in addition to informing the data subject about the information being processed about the data subject - must also provide the data subject with a number of information about the data processing.

In addition, complainants state that the Labor Market Holiday Fund's request for consent to processing personal data in connection with her request to the Fund's data protection adviser did not comply with the data protection rules, including that the consent was not voluntarily given, as the complainant could not really decide whether she would give consent or not.
2.2. Comments from the Labor Market Holiday Fund
2.2.1.

The Labor Market Holiday Fund has stated that the Fund is a self-governing institution under the state administration and that it is incumbent on the Labor Market Holiday Fund to recover the Fund's (state's) claim for unduly paid holiday allowance as a result of decisions taken by the Danish Labor Market and Recruitment Agency or by the Ankur.

In relation to the specific case, the Labor Market Holiday Fund stated that on January 28, 2019, the Fund received information on complaints from the Board of Labor and Recruitment in the form of a copy of the Board's decision of 18 May 2018 to complaints about unjustified payment of holiday pay, which subsequently was confirmed by the National Board of Appeal on January 25, 2019.

Furthermore, the Labor Market Holiday Fund states that by letter of 28 January 2019, the Fund stated complaints that the Fund had registered information on her social security number, name, address, account number and information on the debt ratio in question in the Fund's case management system and financial system.

In addition, in a letter dated February 14, 2019 to the complainant, the fund stated that the fund would forward the complainant's personal information to the fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. In the letter, the Labor Market Holiday Fund also referred complaints to read more about the Fund's personal data policy on the Fund's website.

The Labor Market Holiday Fund has stated that the purpose of the Fund's treatment of complainant's personal data is clearly stated in the context, as complaints in the Board of Labor Market and Recruitment's decision of 18 May 2018 were informed that the case would be transferred to the Labor Market Holiday Fund for the purpose of recovery of the claim.

The Labor Market Holiday Fund has also stated that in its letter of 28 March 2019 to complaints the Fund informed her that her personal information would be disclosed to the National Archives.

The Labor Market Holiday Fund has stated that on this basis it is the Fund's view that the Fund's handling of information duty has been in accordance with Articles 13 and 14 of the Data Protection Regulation.
2.2.2.

The Labor Market Holiday Fund states that the Fund has processed non-sensitive personal data on complaints under Article 6 (2) of the Data Protection Regulation. Article 11 (1) (c) and (e). Information on the complainant's social security number has been processed on the basis of section 11 (1) of the Data Protection Act [2]. First

The Labor Market Holiday Fund has stated that complaints in the specific case subsequently applied to the Fund through the Fund's standard contact form and standard DPO contact form, which are forms that can be used by citizens who apply, regardless of whether the fund has already registered personal information about those concerned. Against this background, the Labor Market Holiday Fund, by default, states on the forms that an inquiry will entail registration of personal data and that the person submitting the contact form gives consent for this.

The Labor Market Holiday Fund has stated that complaints in the specific case did not appear with personal data that the Fund had not already registered as part of the processing of the pending complaint regarding the payment of holiday pay. Thus, the complainant's personal information was not processed on the basis of consent.
3. Justification for the Danish Data Protection Agency's decision
3.1.

It follows from Article 14 (1) of the Data Protection Regulation. 1 and 2, that the data controller - if the information is not collected from the data subject - must provide the data subject with a number of information, including: to ensure fair and transparent treatment of the data subject.

Pursuant to Article 14 (1) of the Data Protection Regulation. 3, the data controller shall provide the information referred to in paragraph 1. 1 and 2, at the latest at the time of the first communication with the data subject if the information is to be used to communicate with the data subject, and otherwise within one month after the collection of the information. The information can be given to the data subject, for example in a direct link.

In addition, pursuant to Article 12 (2), the data controller must: 2. In accordance with paragraph 1, appropriate measures shall be taken to provide any information referred to in Articles 13 and 14 on treatment to the data subject in a concise, transparent, easily understandable and easily accessible form and in a clear and simple language.

The Data Inspectorate assumes that personal data on complaints were not collected from the registered self, but were received from the Danish Labor Market and Recruitment Agency on January 28, 2019.

In addition, the Data Inspectorate assumes that the Labor Market Holiday Fund, in a letter of 28 January 2019, stated complaints that the Fund processed information on the complainant's social security number, name, address, account number and information on the current debt ratio, that the Labor Market Holiday Fund in a letter of 14 February 2019 stated at the request of the complainant that the information could be disclosed to a lawyer and that in the letter of 28 March 2019, the Labor Market Holiday Fund stated complaints that the information would be disclosed to the National Archives.

In addition, the Data Inspectorate assumes that in the letter of 14 February 2019, the Labor Market Holiday Fund - in response to inquiries from complaints - referred complaints to read more about the Fund's personal data policy on the Fund's website.

The version of the Fund's personal data policy in force at the time stated:

    identity and contact information of the data controller
    contact information for any data protection adviser
    the purposes of the Fund's processing of information
    the categories of personal data concerned
    how long the information was stored
    information on the rights of data subjects
    the right to lodge a complaint with a supervisory authority (which was incorrectly stated to be the Danish Labor and Employment Agency)
    where the information came from

Thus, the personal data policy included not information on the legal basis for the processing (Article 14 (1) (c)) and information on possible recipients of personal data (Article 14 (1) (e)).

Accordingly, the Data Inspectorate finds that the Labor Market Holiday Fund did not sufficiently comply with its duty of disclosure towards complaints, in accordance with Article 14 (1) of the Data Protection Regulation. 1 and 2.

The Data Inspectorate further finds that the Labor Market Holiday Fund did not fulfill its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. 3. The Data Inspectorate hereby emphasizes that in its first letter of 28 January 2019, the Labor Market Holiday Fund should have given complaints all the information covered by the disclosure obligation, but that a number of the information was first communicated to complaints on 14 February 2019 and 28. March 2019.

In addition, the Data Inspectorate finds that the Labor Market Holiday Fund has not complied with Article 12 (2) of the Data Protection Regulation. 1, in connection with the processing of the complainant's personal data. The Data Inspectorate has hereby emphasized that, by communicating complaints, the Labor Market Holiday Fund, step by step, in the course of the case processing rather than in a single communication, has not taken appropriate measures to provide any information referred to in Article 14 in a concise, transparent, easily understandable and easily accessible form.

Against this background, the Data Inspectorate finds a basis for expressing serious criticism of the Labor Market Holiday Fund's processing of complainant's personal data.
3.2.

As regards the part of the complaint relating to obtaining consent, the Data Inspectorate notes that Article 5 of the Data Protection Regulation contains general principles for the processing of personal data. It appears, among other things, of Article 5 (2); 2. Paragraph 1 (a) requires that personal data be legally, reasonably and transparently processed.

The Labor Market Holiday Fund has stated that the processing of the information at issue is based on Article 6 (2) of the Data Protection Regulation. 1, c and e, and section 11 (1) of the Data Protection Act. 1, cf. section 2.2.2. above. The processing is thus conducted on a basis other than consent, which is why obtaining the complainant's consent is not in accordance with Article 5 (2). 1, point a.

Against this background, the Data Inspectorate finds a basis for criticizing the Labor Market Holiday Fund.
4th

It is added that if the Labor Market Holiday Fund also processes personal data which the Labor Market Holiday Fund believes can only be done on the basis of consent, the Data Inspectorate must point out that it follows from Article 4 (11) of the Data Protection Regulation that consent is understood as any voluntary, specific, informed and unambiguous disclosure by the data subject, whereby the data subject, by declaration or clear confirmation, consents to the processing of personal data relating to the data subject. It also follows from Article 7 (1) of the Data Protection Regulation. 3 that the data subject has the right at any time to withdraw his consent.

It is the opinion of the Data Inspectorate that the consent that the complainant made in connection with his inquiries to the Labor Market Holiday Data Protection Advisor does not meet the conditions for a valid consent, i.a. because it cannot be considered voluntary, as complainants had no alternative but to consent to the treatment if complainants would contact the Data Protection Advisor.

 

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such information and repealing Directive 95/46 / EC (general data protection regulation).

[2] Act No 502 of 23 May 2018 on additional provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such information (Data Protection Act).
Retrieved from "https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2019-32-0639&oldid=37158"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki