Datatilsynet (Denmark) - 2020-32-1733

Datatilsynet - 2020-32-1733
Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 5(1)(d) GDPR Article 6(1)(e) GDPR Article 17(3)(b) GDPR Article 21(1) GDPR Article 21(6) GDPR § 1(2) of the Act of Statistics Denmark (Lovbekendtgørelse om Danmarks Statistik)
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:
Published:	16.02.2021
Fine:	None
Parties:	Statistics Denmark
National Case Number/Name:	2020-32-1733
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Danish
Original Source:	Datatilsynet (in DA)
Initial Contributor:	Tetyana Porokhonko

The Danish DPA (Datatilsynet) expressed criticism towards Statistics Denmark for failing to update a list with people who were not willing to participate in voluntary surveys, in accordance with the Article 5(1)(d) of the GDPR.

English Summary

Facts

A complainant contacted Statistics Denmark on 21 January 2020 and informed that he/she does not want to participate in statistical surveys. On 22 January 2020, the Statistics Denmark informed the complainant that certain surveys are compulsory, but he/she can be removed from voluntary surveys.

The complainant subsequently received several surveys, e.g. on 2 February, 10 and 18 September 2020, despite Statistics Denmark confirmed that he/she had been deregistered from the voluntary surveys.

In this connection, Statistics Denmark explained that the complainant received voluntary surveys due to mistakes. Additionally, it stated that Statistics Denmark processes personal data pursuant to Article 6(1)(e) of the GDPR and § 1(2) of the Act of Statistics Denmark and is not obliged to delete it in accordance with the Article 17(3)(b) of the GDPR.

On 18 September 2020, the complainant submitted a complaint to the DPA concerning processing and failing to delete his/her personal information by Statistics Denmark.

Dispute

The DPA assessed whether Statistics Denmark had a legal ground for processing the complainant´s data in connection with conducting statistical surveys and whether the complainant´s request for deletion handled according to the GDPR rules.

Holding

The DPA found that Statistics Denmark processed the complainant´s data in accordance with the Article 6(1)(e) and was not obliged to delete such information pursuant to the Article 17(3)(b) of the GDPR.

However, Statistics Denmark has been criticised for not complying with the Article 5(1)(d) of the GDPR, namely, failure to update the complainant information in the internal list of people who do not wish to participate in Statistics Denmark's voluntary surveys.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.

Complaint about Statistics Denmark's failure to update personal data
Published 16-02-2021
Decision
Public authorities

On the basis of a complaint - after the case has been submitted to the Data Council - the Data Inspectorate has expressed criticism that Statistics Denmark did not update information that a citizen did not want to participate in Statistics Denmark's voluntary surveys. Journal number: 2020-32-1733
Summary
A citizen approached the Danish Data Protection Agency and complained that Statistics Denmark processed information about the person in question, and that the citizen, despite several informations from Statistics Denmark that Statistics Denmark would not contact the citizen, continued to receive inquiries from Statistics Denmark.
Statistics Denmark stated in the case that Statistics Denmark maintains an internal list of citizens who do not wish to participate in Statistics Denmark's voluntary surveys, and that the citizen should have been added to this, but that this had not happened due to an internal error.
The Danish Data Protection Agency found that Statistics Denmark had the authority to process information on citizens, including the citizen in question, cf. the Statistics Denmark Act.
However, the Danish Data Protection Agency found reason to criticize the fact that Statistics Denmark had not - as was otherwise stated to the citizen several times - had listed the citizen on the list of citizens who do not wish to participate in Statistics Denmark's voluntary surveys.
Decision
The Danish Data Protection Agency hereby returns to the case where (X) (hereinafter complains) on 18 September 2020 has complained to the Authority about Statistics Denmark's processing and failure to delete personal data about him.
Decision
The Danish Data Protection Agency finds - after the case has been dealt with at a meeting of the Data Council - that Statistics Denmark's processing of personal data has taken place in accordance with the rules in the Data Protection Regulation [1], cf. Article 6 (1). Article 17 (1) (e) and Article 17 (1) 3, letter b.
However, the Danish Data Protection Agency finds reason to express criticism that Statistics Denmark has not complied with Article 5 (1) of the Data Protection Regulation in connection with the processing of information on complaints. 1, letter d.
Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision.
2. Case presentation
It appears from the case that on 21 January 2020, complainants approached Statistics Denmark and refused to be contacted by Statistics Denmark.
On 22 January 2020, Statistics Denmark responded to the inquiry and stated that Statistics Denmark could well exempt complaints from surveys except for certain mandatory surveys. On the same day, the complainants confirmed that he wished to be deregistered to the extent possible, after which Statistics Denmark confirmed the deregistration.
On 2 February 2020, the complainant contacted Statistics Denmark again, as he had been contacted by telephone and SMS regarding the same survey that prompted the complainant's initial inquiry of 21 January 2020.
Statistics Denmark responded to the inquiry on 6 February 2020. It appeared from this that Statistics Denmark could not understand that complainants continued to receive inquiries when complaints had been deregistered. Complaints and Statistics Denmark then had correspondence, whereby Statistics Denmark found the department, which had contacted complainants. Statistics Denmark stated that the department had been notified and that complainants should now not receive further inquiries.
On 10 September 2020, the complainant contacted Statistics Denmark again, as he had been contacted via e-Boks regarding an investigation.
Statistics Denmark responded to the inquiry on 11 September 2020. It appeared from this that an error must have occurred when the deregistration was registered, and that complaints were now permanently deregistered from Statistics Denmark's voluntary surveys.
Complainants again contacted Statistics Denmark on 18 September 2020 and stated that he had received another inquiry from Statistics Denmark via e-Boks.
On the same day, 18 September 2020, the Danish Data Protection Agency received a complaint about Statistics Denmark's processing of information on complaints.
On 12 October 2020, the Danish Data Protection Agency sent the complaint for consultation and asked Statistics Denmark for an opinion on the matter.
Statistics Denmark presented an opinion on the case on 29 October 2020, after which the opinion was sent to complainants.
On 30 October 2020, the Danish Data Protection Agency received the complainant's comments on the opinion.
2.1. Complainant's remarks
Complainants have generally stated that Statistics Denmark has not complied with his repeated requests not to receive inquiries about surveys from Statistics Denmark.
2.2. Statistics Denmark's comments
Statistics Denmark has generally stated that Statistics Denmark is not obliged to delete information on complaints.
In this connection, Statistics Denmark has argued that Statistics Denmark processes information on data subjects pursuant to Article 6 (1) of the Data Protection Regulation. 1, letter e, and the Act on Statistics Denmark [2] § 1, para. 2.
The personal data is processed for statistical and scientific purposes, and Statistics Denmark contacts citizens to carry out the task that Statistics Denmark handles. For the same reason, Statistics Denmark can and will not comply with the complainant's request for deletion, cf. Article 17 (1) of the Data Protection Regulation. 3, letter b, as citizens ', including complainants', contact information is necessary to perform Statistics Denmark's tasks.
Statistics Denmark has also claimed that Statistics Denmark maintains an internal list of citizens who do not wish to participate in voluntary surveys, as Statistics Denmark has no interest in contacting citizens who have declined inquiries from Statistics Denmark.
Complainant was incorrectly registered on the internal list at first inquiry, as complainant provided an incorrect social security number, which is why he continued to receive inquiries.
In other inquiries, Statistics Denmark did not follow up on the inquiry by mistake, which is why complaints were not registered on the internal list.
In this connection, Statistics Denmark has stated that, on the basis of this, an internal procedure has been initiated to ensure that citizens who do not wish to participate in voluntary surveys will in future be registered on Statistics Denmark's internal list.
Justification for the Danish Data Protection Agency's decision
3.1
It is clear from Article 6 (1) of the Data Protection Regulation 1, that personal data may be processed if one of the conditions in points a - f is met. It follows from point e of the provision that personal data may be processed if the processing is necessary for the performance of a task in the interest of society or which falls within the exercise of public authority, which the data controller has been instructed to do.
The basic principles for the processing of personal data, as set out in Article 5 of the Data Protection Regulation, must be observed in all processing of personal data. This means, among other things, that the personal data must be correct and, if necessary, updated; every reasonable step must be taken to ensure that personal data which are incorrect in relation to the purposes for which they are processed are immediately deleted or rectified, cf. 1, letter d.
Article 17 (1) of the Data Protection Regulation 1, it appears that the data subject has the right to have information about himself deleted in certain cases. Of the provision's paragraph. However, Article 3 (3) (b) states that the right of deletion does not apply if the processing is necessary to comply with a legal obligation requiring processing under EU law or the national law of the Member States and to which the data controller is subject, or for to perform a task in the interest of society or which falls within the exercise of public authority, which has been assigned to the data controller.
It follows from Article 21 (1) of the Data Protection Regulation 1, that the data subject at any time has the right to object to the processing of personal data based on i.a. Article 6, paragraph 1, letter e, for reasons relating to the special situation of the person concerned.
Finally, it is clear from Article 21 (1) of the Regulation that That if personal data are processed for scientific or historical research purposes or statistical purposes in accordance with Article 89 (6). (1), the data subject has the right to object to the processing of personal data concerning the person concerned on grounds relating to the person's special situation, unless the processing is necessary to perform a task in the public interest.
Of the Act on Statistics Denmark, section 1, subsection 1 and para. 2, no. 1, it appears that Statistics Denmark is a professionally independent state authority, which i.a. handles tasks of development, collection, compilation and dissemination of statistical information concerning societal conditions.
3.2
Statistics Denmark processes information on complaints in connection with the conduct of statistical surveys, and the processing of information on complaints has been carried out within the framework of Article 6 (1) of the Data Protection Regulation. 1, letter e.
Statistics Denmark has as an authority i.a. for the task of collecting statistical information, cf. the Act on Statistics Denmark, section 1, subsection 2, no. 1. Collection of statistical information from citizens is done by direct inquiries to the individual citizen, which is why Statistics Denmark is forced to process contact information about the individual citizen.
On this basis, the Danish Data Protection Agency finds that Statistics Denmark is not obliged to delete information on complaints, cf. Article 17 (1) of the Data Protection Ordinance. 3, letter b, as the treatment in question is necessary for the performance of a task that Statistics Denmark is required to do pursuant to the Statistics Denmark Act.
The Danish Data Protection Agency therefore finds no reason to express criticism that Statistics Denmark has not deleted information on complaints.
3.3
The Danish Data Protection Agency assumes that Statistics Denmark has understood the complainant's first and second inquiries as an objection to the processing of information about him, cf. Article 21 (1) of the Data Protection Ordinance. 1 and para. 6, and that Statistics Denmark in this connection assessed that the processing of information on complaints in relation to voluntary investigations should cease.
It is stated that complaints at the first inquiry were not registered correctly, as complainants provided an incorrect social security number, while complaints at the second inquiry were not registered correctly because Statistics Denmark did not follow up on the complainant's request.
It is against this background that the Danish Data Protection Agency is of the opinion that Statistics Denmark's processing of information on complaints in connection with the (lack of) registration of complaints on Statistics Denmark's internal list of citizens who have expressed a wish not to participate in surveys has not been in accordance with Article 5 (2) of the Data Protection Regulation 1, letter d.
The Danish Data Protection Agency has emphasized that Statistics Denmark reported complaints that he would no longer receive inquiries from Statistics Denmark. Complainants, however, subsequently received several inquiries from Statistics Denmark.
The Danish Data Protection Agency therefore finds grounds for expressing criticism of Statistics Denmark's failure to register complaints on the internal list in connection with his second inquiry.
The Danish Data Protection Agency has noted that Statistics Denmark has stated that complaints are now registered on Statistics Denmark's internal list.
Furthermore, the Danish Data Protection Agency has noted that the process in relation to the complainant's other inquiry has led to the initiation of an internal procedure to ensure that citizens who do not wish to participate in investigations in the future are exempted from this.
In conclusion, the Danish Data Protection Agency notes that it is the Authority's opinion that a wish not to participate in Statistics Denmark's surveys does not constitute a special situation under Article 21 (1) of the Regulation. 1, or para. 6, which should mean that the data controller must cease the processing of personal data in question.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation).
[2] Statutory Order no. 610 of 30 May 2018 on Statistics Denmark.