Datatilsynet (Denmark) - 2020-31-3894

Datatilsynet (Denmark) - 2020-31-3894
Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 15 GDPR Article 22(1) Danish Data Protection Act
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	26.11.2021
Fine:	None
Parties:	Cryos International ApS
National Case Number/Name:	2020-31-3894
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Danish
Original Source:	Datatilsynet (in DA)
Initial Contributor:	Tetyana Porokhonko

The Danish DPA also found that a sperm bank violated Article 15 GDPR by refusing to provide a data subject with information about the number of children conceived as the result of their donation. The DPA therefore ordered the company to provide the data subject with the requested information.

English Summary

Facts

In May 2020 the data subject contacted Cryos International ApS (the controller) and submitted an access request pursuant to Article 15 GDPR. More specifically, the data subject asked for the number of children who had been conceived with his sperm and how many of them have a single mother. The controller refused to provide the requested data by referring to section 22(1) of the Danish Data Protection Act. According to that section, the data subject´s access right under Article 15 GDPR might be restricted if "the data subject’s interest in this information is found to be overridden by essential considerations of private interests". The controller argued that the requested information is of a very sensitive nature and would adversely effect the rights and freedoms of others. Therefore, the information must be exempt from the data subject´s right of access.

The data subject then filed a complaint against controller.

Holding

First, the DPA found that the information on the number of children conceived by sperm donation from the data subject indeed constitutes the data subject's personal data. Hence, the data subject has the right to obtain that information. In contrast, the data on women's marital status cannot be considered as the data subject's personal data and therefore, shall not be made available to the data subject.

Furthermore, the DPA stated that the exemptions to the right of access set out in section 22(1) of the Danish Data Protection Act apply only if there is an imminent danger that private interests will suffer significant damage. In its assessment, the DPA concluded that the information about the number of donor children alone is not sufficient to identify the children. Consequently, according to the DPA, the children's interest would not have suffered a significant damage in case the requested information would have been provided to the data subject.

In conclusion, the DPA expressed criticism to the controller for refusing to comply with the access request and ordered the controller to provide the data subject with the requested information, pursuant to Article 58(2)(c) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.

Criticism and injunctions to Cryos for lack of insight

Date: 26-11-2021

Decision

The Danish Data Protection Agency has expressed criticism that Cryos International ApS failed to give a citizen insight into the information about the number of donor children who were conceived by means of sperm donation from the citizen. The audit has further given the company an order for insight.

Journal number: 2020-31-3894.

Decision

After a review of the case, the Danish Data Protection Agency finds that there are grounds for expressing criticism that Cryos International ApS has not sufficiently provided complainants with insight into personal data about himself, cf. Article 15 of the Data Protection Regulation [1].

The Danish Data Protection Agency also finds grounds for issuing an order to Cryos International ApS to provide complainants with insight into the information on the number of donor children who have been conceived by sperm donation from complainants. Complaints must be notified to the public as soon as possible and no later than Tuesday, December 7, 2021.

The order is issued pursuant to Article 58 (1) of the Data Protection Regulation. 2, letter c.

Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision.

2. Case presentation

It appears from the case that complainants by e-mails of 11 and 12 May 2020 contacted Cryos International ApS with questions about, among other things, how many donor children were conceived by sperm donation from complainants and how many of their mothers , who were single.

In a letter dated 15 May 2020, Cryos International ApS wrote, among other things, to complain that it was against Cryos International ApS 'business policy to disclose information about how many children had been created using his donated sperm, just as Cryos International ApS did not record information about these children's parental relationships, including whether they may have a single child mother.

Complainants requested by e-mail of 15 May 2020 access in accordance with Article 15 of the Data Protection Regulation in the personal data that Cryos International ApS processed about him, including in information on the number of donor children who were conceived by sperm donation from complainants.

By letter dated 15 June 2020, Cryos International ApS responded to the complainant's request for insight. It appeared from this that Cryos International ApS could not provide complainants with insight into e.g. information on reported pregnancies recorded using his donations. This was because the disclosure of this information would violate the rights of others, including that crucial considerations of other private interests outweighed the complainant's interest in the information, cf. Article 15 (1) of the Data Protection Regulation. 4, and the Data Protection Act [2] § 22, para. 1.

2.1. Cryos International ApS 'comments

Cryos International ApS has stated that the right of access under Article 15 only relates to access to personal information about the data subject himself.

The information on the number of children who had been conceived using donor reproductive cells is not personal information about complainants. Section 28 of the Children's Act [3] makes it clear that a sperm donor is not the father of any children who have been born using donated reproductive cells. Every donor has waived any rights and obligations regarding donor children that result from artificial insemination using that donor's reproductive cells.

The information regarding the number of donor children, as a result of reproductive cells from a donor used in connection with artificial insemination, is a description of the number of biological siblings. This information thus relates to the siblings who may is about and not the male donor.

For biological "donor siblings", the information about how many biological siblings they have can be very sensitive and difficult emotionally manageable information that they do not want at all. Donor children often have a higher number of biological siblings than is normal in a "traditional" family, which for many will cause a significant psychological ballast - especially for children.

Information about how many of these possible children may have a single mother must also be information that does not relate to the donor but instead possibly. donor children who, after all, have a relationship with their mother. In addition, it is information about the mothers' completely personal circumstances. It is further noted that information about this is not available to Cryos International ApS at all.

Cryos International ApS has stated that to the extent that the Danish Data Protection Agency believes that this is personal information about complaints, no insight should still be given into complaints, e.g. because the information sought is related to non-complaints, and as mentioned, the information is of a very sensitive nature to non-complainants. The complainant's right of access must therefore give way due to significant considerations for other persons, cf. the Data Protection Act, section 22, subsection. 1.

2.2. Complainant's remarks

Complainants have stated that he had been approached by a girl who claimed he was her father. [Sentence removed]. The girl reported complaints that she knew of three children who had the same donor number as complainants and that one of the children had a need to meet with complainants.

Complainant then chose to slow down the relationship with the girl as he could not create a relationship with her without having an overview of how many children he was the biological father of. If the complainant initiated a relationship with the girl, he would also feel that he should offer the same to other donor children who at some point had to contact him.

Complainants have stated that he himself has no intentions of seeking out more donor children, but he wants to know the number of children and how many of them have officially registered a father. The information would be relevant to complainants when assessing how many children could potentially have a need to get in touch with him, as complainants assume that children born to a single mother, all other things being equal, will have a greater need to seek out their biological father. Furthermore, the information would in no way enable complainants to seek out the children.

Complainants have further stated that it is correct that he is not a father in the legal sense, but that he has still been identified on the basis of [words removed] and information which has been passed on by Cryos International ApS to the buyer of his semen. This is identifiable information and the consideration of his rights should outweigh the Children's Act. Especially in this case, where it is not he who has sought out or has tried to seek out any donor children.

Justification for the Danish Data Protection Agency's decision

It follows from Article 15 (1) of the Data Protection Regulation 1, that the data subject has the right to receive the data controller's confirmation of whether personal data concerning the person in question is processed, and if applicable access to the personal data and information in the provision's a-h. Thus, only personal data about the data subject himself is to be disclosed, in accordance with Article 15.

It follows from Article 4 (1) of the Data Protection Regulation 1, no. 1, that "personal data" means any kind of information about an identified or identifiable natural person ("the data subject"); identifiable natural person means a natural person who can be directly or indirectly identified, in particular by an identifier such as a name, identification number, location data, an online identifier or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

With regard to the information on how many of the children may have a single mother, the Danish Data Protection Agency finds that this does not constitute personal information about complaints, and information about this is thus not covered by the complainant's right of access.

The Danish Data Protection Agency has hereby emphasized that the information about the mother's marital status more specifically constitutes personal information about the mother, and that the information cannot be said to relate to complaints.

However, the information on the number of donor children conceived by sperm donation from complaints must be considered to relate to complaints. The Danish Data Protection Agency is of the opinion that this information is personal data on complaints, which is thus covered by the complainant's right of access in accordance with Article 15 of the Data Protection Regulation.

The Danish Data Protection Agency also finds that information on the number of donor children conceived by sperm donation from complainants cannot be exempted from the right of access, cf. section 22 (1) of the Data Protection Act. 1.

It follows from the Data Protection Act, section 22, subsection 1, that i.a. Article 15 of the Data Protection Regulation does not apply if the data subject's interest in the information is found to give way to overriding reasons relating to private interests, including the interests of the data subject himself.

The use of the term "decisive" in the provision means that if there is an imminent danger that private interests will suffer significant damage, there may be an exception to the right of access. [4]

In this assessment, the Danish Data Protection Agency has emphasized that this is only information about the number of donor children who do not enable complainants to seek out the children.

With regard to the considerations stated by Cryos International ApS for the children, should they become aware of the number of “donor siblings”, the Danish Data Protection Agency finds that the information on the number of donor children does not entail such an imminent danger that private interests will be harmed. significant importance. The Danish Data Protection Agency therefore assesses that the information on the number of donor children cannot be exempted pursuant to section 22 (1) of the Data Protection Act. 1.

In the opinion of the Danish Data Protection Agency, Cryos International ApS is thus obliged to provide complainants with insight into the number of donor children who have been conceived by sperm donation from complainants.

On the basis of the above, the Danish Data Protection Agency finds reason to criticize the fact that Cryos International ApS has not to the necessary extent provided complaints with insight, cf. Article 15 of the Data Protection Regulation.

The Danish Data Protection Agency also finds grounds for issuing Cryos International ApS's order to provide complainants with insight into the information on the number of donor children who have been conceived by sperm donation from complainants. Complaints must be notified to the public as soon as possible and no later than Tuesday, December 7, 2021.

The order is issued pursuant to Article 58 (1) of the Data Protection Regulation. 2, letter c.

According to the Data Protection Act, section 41, subsection 2, no. 5, is punishable by a fine or imprisonment for up to 6 months for anyone who fails to comply with an order issued by the Danish Data Protection Agency pursuant to Article 58 (1) of the Data Protection Regulation. 2.



[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation).

[2] Act No. 502 of 23 May 2018 on supplementary provisions to the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Act).

[3] Executive Order no. 772 of 7 August 2019 on the Executive Order of the Children's Act (the Children's Act).

[4] Bill to Act no. 502 of 23 May 2018, Bill no. L 68, the special remarks to § 22, para. 1.