Datatilsynet (Denmark) - 2021-31-4751: Difference between revisions

Latest revision as of 18:19, 16 February 2022

Datatilsynet (Denmark) - 2021-31-4751

Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 6(1)(c) GDPR Article 6(1)(f) GDPR Article 9(2)(b) GDPR Article 9(2)(f) GDPR Article 12 GDPR Article 14 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	03.02.2022
Published:	03.02.2022
Fine:	None
Parties:	TV 2 Norrbom Vinding
National Case Number/Name:	2021-31-4751
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Danish
Original Source:	Datatilsynet (in DA)
Initial Contributor:	Giel Ritzen
The Danish DPA expressed criticism on TV 2 for processing sensitive data without a legal basis regarding sexual misconduct allegations against an employee during in an internal investigation.
English Summary

Facts

Controllers are TV 2 Danmark A/S (a public TV station) and Norrbom Vinding I/S (a law firm). In September 2020, TV 2 launched an investigation into the unhealthy (sexist) culture at the TV station. It asked the help of law firm Norrbom Vinding, and asked past- and present employees to report infringements and share their experiences with the sexist culture at TV 2. The TV station then received two reports on the data subject, with allegations regarding sexual misconduct. After investigating the matter, TV 2 decided that data subject could no longer host any TV shows on the station.
Data subject argued that there were no concrete facts that justified the investigation of TV 2. Moreover, they found that, since they did not explicitly consent to any processing, TV 2 and Norrbom Vinding processed their sensitive personal data without a legal basis. Hence, they filed a complaint with the DPA.
Holding

First, the DPA assessed the general legal basis. It found that TV 2 and Norrbom Vinding could not rely on Article 6(1)(c) GDPR, when processing data subject’s personal data, since the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise to be used as a basis for processing within the scope of Article 6(1)(c). However, the DPA stated that the controller could rely on Article 6(1)(f) GDPR, because the objective of the investigation “ending unhealthy culture” was legitimate, and this objective overrode the interests of data subject.
Secondly, the DPA noted that the controllers could not rely on the exception laid down in Article 9(2)(b) GDPR. Again, because the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise. Moreover, although the purpose of the processing was legitimate, the DPA found that the controllers could also not rely on Article 9(1)(f) GDPR. The DPA considered that, because the collection of sensitive personal data was not restricted sufficiently, and concerned also persons that no longer worked at the station, the processing of sensitive data on those persons was not necessary for a legal claim (such as an employment or contractual sanction). Hence, the DPA concluded that TV 2 and Norrbom Vinding had processed the sensitive personal data without a legal basis.
Finally, the DPA considered that TV 2 and Norrbom Vinding had not informed the data subject about the processing within the investigaion in accordance with Article 12 and Article 14 GDPR, since the information was not provided in a clear and simple language. It was unclear, inter alia, what the precise purpose of the investigation was and, therefore, it was not clear what possible consequences the investigation might have had.
Comment

It is unclear why the Danish DPA "expresses criticism", since this is not a formal sanction within Article 58 GDPR.
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
Serious criticism of TV 2 and Norrbom Vinding

Date: 03-02-2022

Decision Private companies

The Danish Data Protection Agency has made a decision in a matter of principle, where complainants have complained about the processing of information about him in connection with a legal investigation.

Journal number: 2021-31-4751

Summary

In February 2021, [complainants] complained to the Danish Data Protection Agency that TV 2 and Norrbom Vinding had processed information about him in connection with a legal investigation. The investigation was carried out by Norrbom Vinding on behalf of TV 2 with the aim of uncovering and investigating cases of possible infringing acts.

The Danish Data Protection Agency has reviewed the case carefully, and as it is considered to be a matter of principle, the decision has been made by the Danish Data Protection Agency.

The key points in the Danish Data Protection Agency's assessment of the case are the following:

TV 2 pursued a legitimate interest in launching the investigation, and TV 2’s legitimate interest took precedence over the interests of the data subjects, including complainants. In other words, there was basically a legal basis for collecting personal data. However, the survey was organized in such a way that information could be reported on e.g. sexual relations, ie. sensitive information. There is a ban on processing sensitive information if a valid exception can not be identified. TV 2 and Norrbom Vinding had not restricted the collection of information in such a way that they had the necessary assurance that they could process the collected sensitive information. Although the Danish Data Protection Agency generally finds the organization of the investigation questionable, there is - due to the complainant's then connection to TV 2 - insufficient basis for criticizing TV 2's and Norrbom Vinding's processing of information about the complainant's sexual relations. TV 2 and Norrbom Vinding have not lived up to the duty to provide information, which consists of making people aware on their own initiative that they process their information - including why they do it and how they want to process the information.

On the basis of these factors, the Danish Data Protection Agency expresses serious criticism of TV 2 and Norrbom Vinding.

The case is part of a debate that goes far beyond data protection law. In the assessment of the case, the Danish Data Protection Agency has exclusively dealt with the legal aspects of the collection and further processing of personal data, including the processing of information on complaints.

The Danish Data Protection Agency has also not commented on whether TV 2 had a legal basis for stopping the cooperation with complaints, as this is outside the Authority's competence.

Decision

The Danish Data Protection Agency hereby returns to the case, where complainants on 16 February 2021 complained to the Authority that TV2 / Danmark A / S (hereinafter TV 2) and Norrbom Vinding I / S had processed information about him in connection with a legal investigation.

The Data Inspectorate must - after the case has been considered by the Data Council - state the following:

Decision

Following a review of the case, the Danish Data Protection Agency is of the opinion that TV 2 pursued a legitimate interest in connection with the initiated investigation.

The Danish Data Protection Agency does not find grounds to override TV 2's and Norrbom Vinding's assessment that it was necessary to collect information about a wide range of people to investigate (the development of) the culture on TV 2, and that TV 2's legitimate interest in this took precedence over those registered, including complainants, interests.

It is against this background that the Danish Data Protection Agency's assessment that TV 2 and Norrbom Vinding could collect information on the basis of Article 6 (1) of the Data Protection Regulation. 1, letter f.

However, the Danish Data Protection Agency's assessment is that TV 2 and Norrbom Vinding did not have the necessary security to have a legal basis in Article 9 of the Data Protection Regulation to process the collected personal data when collecting personal data - including the collection of information about sexual relationships. .

On this basis, the Danish Data Protection Agency finds that TV 2's and Norrbom Vinding's approach to the collection of personal data was not in accordance with Article 25 of the Data Protection Regulation, cf. also Article 5 of the Regulation.

It is the Data Inspectorate's assessment that the processing of information on complaints, including information on complainants' sexual relationships, could not - as claimed by TV 2 and Norrbom Vinding - be carried out within the framework of Article 6 (1) of the Data Protection Regulation. 1, letter c, the Data Protection Act § 7, para. Article 9 (2) of the Data Protection Regulation 2, letter b, or section 12 of the Data Protection Act.

Taking into account that complainants were still connected to TV 2, the Danish Data Protection Agency does not find grounds to override TV 2's and Norrbom Vinding's assessment of the need to process information about complainants' sexual relationships in order to establish a legal claim, cf. Article 9 of the Data Protection Regulation. PCS. 2, letter f.

Regardless of the fact that the Danish Data Protection Agency generally finds the organization of the investigation - and the consequent collection of personal data - objectionable, the Danish Data Protection Agency does not find grounds to criticize TV 2's and Norrbom Vinding's processing of information about complainants' sexual relations.

Finally, the Danish Data Protection Agency is of the opinion that TV 2 and Norrbom Vinding have not notified complaints in accordance with Articles 12 and 14 of the Data Protection Regulation.

Collectively, TV 2’s and Norrbom Vinding’s collection of personal information and failure to comply with the duty to provide information provide the Danish Data Protection Agency with a basis for expressing serious criticism.

The Danish Data Protection Agency notes that the Authority has not commented on whether TV 2 had a legal basis for stopping the cooperation with complaints, as its decision does not fall within the scope of the Authority.

Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision.

2. Case presentation

It appears from the case that TV 2 in September 2020 decided to launch a two-part study of the culture in TV 2, which on the one hand should uncover the culture more generally in TV 2, and which on the other hand should also uncover and investigate cases about possible abusive acts.

In this connection, TV 2 requested Norrbom Vinding to assist with the implementation of the study in question, and - via Norrbom Vinding - a reporting scheme was established where former and current employees could report both abusive acts and more general matters related to the culture and cooperation in TV 2.

As a result, on 2 September 2020, TV 2's CEO stated the following in an internal communication to employees of TV 2:

"To the extent that an inquiry must be considered to relate to an infringing act, Norrbom Vinding will assist TV2 with the further investigation of and advice on the handling of this."

On 24 September 2020, the director of TV 2 further announced to the public that the investigation would also include "old cases" and that no time limit had been set for how far back in time the investigation could go. [1] TV 2 and Norrbom Vinding have stated that the assessment of this:

"… Among other things. [was] a consequence of the fact that in connection with the massive criticism from the employees and in the media during September 2020, information had come to light which created a suspicion that there had also been an unhealthy culture in the organization in the past, which had led to violations by employees of TV2 - violations that had not previously been reported on and handled […]

It was therefore assessed that it was necessary to provide an opportunity for reporting and investigation of any "old cases" in order to have a real showdown with the (possible) abusive culture - including with a view to ensuring a healthy working environment in the future. At the same time, however, it was only initiated an investigation of reports on "old cases", to the extent that the person who was reported was still employed by TV 2 or in some other way still part of / linked to TV 2's activities - for example through a partner. ”[2]

As part of the study, TV2 and Norrbom Vinding prepared a process description. The process description was posted on TV 2's intranet and was made available to all employees of TV 2.

The process description initially stated the following:

“What is the further process when you have sent a report or inquiry to Norrbom Vinding or TV 2?

We have tried to briefly describe what happens when you have sent a report or inquiry to TV 2 via Norrbom Vinding. It is important to say that a "one-size-fits-all" does not apply. Depending on the nature and development of the individual case, other steps may be needed. ”

In addition, it appeared that all reports that TV 2 and Norrbom Vinding had to receive in connection with the initiated reporting scheme would initially be screened for whether the reported incidents could constitute insulting acts - such as harassment or sexual harassment - or whether the reports concerned an unhealthy culture on TV 2, which TV 2 wanted to do away with.

In connection with the reporting scheme, TV 2 and Norrbom Vinding received two reports on complaints, both of which contained information on complaints. One report contained information about the complainant's sexual relations.

On this basis, Norrbom Vinding contacted complainants on 18 November 2020 via text message, in which complainants were asked to provide their e-mail.

The complainant sent his e-mail, after which he received an e-mail with a letter and the process description, which Norrbom Vinding and TV 2 had prepared in connection with the initiation of the investigation. The following was stated in the attached letter:

“As you may have heard, a major investigation into the culture of TV 2 Danmark A / S (hereinafter TV 2) is currently underway, and TV 2 has in this connection, in collaboration with Norrbom Vinding, established a procedure for reporting and investigating cases. about possible infringing acts.

I am writing to you because in connection with the ongoing investigation, inquiries have been received about two episodes that reportedly took place at a time when you were employed at TV 2. According to the information, you should have shown in connection with these episodes a behavior that has been perceived as offensive by two former employees of TV 2.

I am - as stated - aware that you are no longer employed by TV 2. However, TV 2 has found it relevant to initiate an investigation of the two episodes, as you work as a host on productions produced by an external supplier for TV 2 .

The organization of the investigation process is described in more detail in the process description attached to this letter, and the main point is that Norrbom Vinding interviews the employees and former employees of TV 2 who consider themselves exposed to violations, and possibly also other people who may be involved.

As part of the ongoing investigation of the two episodes, I would like to invite you to an interview, where you will be informed about the detailed content of the reports received, and you will in this connection have the opportunity to comment on the information received. You are therefore invited to a meeting

Friday, November 20, 2020, at 10.00

The meeting will be held at my office, Norrbom Vinding, Dampfærgevej 26, 2100 Copenhagen Ø. I and […] will participate in the meeting.

At the meeting, we will inform you in more detail about the content of the inquiries received, and you will have the opportunity to make your comments on these.

You are encouraged to bring an attendant to the meeting, such as a lawyer or a friend.

When the course of the investigation is finally completed, I will make an assessment of whether there are grounds for concluding that infringing acts have been committed in violation of the law. On this basis, TV 2 will then assess whether there is any basis for a further course.

[…] ”

On 19 November 2020, the complainant's lawyer contacted Norrbom Vinding and requested information about the two reported episodes, so that the complainant and the complainant's lawyer had the opportunity to prepare for the forthcoming meeting.

Norrbom Vinding responded to the inquiry on 20 November 2020. The following was stated:

With reference to your letter of 19 November 2020, I must hereby clarify that the investigation initiated by my client, as a starting point, aims to give former and current employees of TV 2 Danmark A / S (hereinafter TV 2) the opportunity to to report behavior (perpetrated by employees in or partners to TV 2), which according to the law must be considered an offensive act (in the work environment law primarily defined as harassment, sexual harassment or bullying.)

The purpose of the investigation, as appears from the prepared process description, is thus to clarify whether it can be based on evidence that a conduct has been committed which, according to the law at the time in question, must be regarded as infringing.

If this is the case, an assessment will next have to be made of whether there are grounds for drawing employment law / contractual consequences from what has happened. Typical sanctions in an employment law / contractual relationship will, as is well known, be reprimand / warning, termination or termination of the employment / cooperation relationship.

The investigation, on the other hand, is not intended to determine whether a violation of the Penal Code has been committed, as this will be a task for the police and the courts. To the extent that in connection with an investigation, information may emerge that indicates that this is the case, TV 2 will naturally consider whether there are grounds for making a police report.

However, in relation to the two reports we have received in relation to your client, I can state that they are both so far behind in time that there will have been criminal statute of limitations. Therefore, for this reason alone, it will not be relevant to consider a police report.

As appears from the prepared process description for the investigation process, my client has decided that the best basis for an assessment of a given report is obtained by conducting meetings with / interviewing the persons who have made the report, respectively. and the employee / partner to whom the report is addressed. Thus, for a thorough and proper investigation process, it will not be sufficient to review a written statement from the person to whom the report is addressed.

Of course, I fully understand that in order to be able to prepare for the meeting, your client will need details about the content of the two reports, and I therefore attach a brief overview indicating the temporal location of that episode / the episodes that have been reported, as well as a brief description of the content of the two reports.

In order to ensure as high a degree of confidentiality as possible in the process, I would first like to disclose the names of the two people who made the report in connection with our meeting, where your client will of course also be provided with the detailed information about the content. of the two reports.

I must emphasize that the purpose of the meeting is solely to give your client the opportunity to comment on the two reports, and that thus no decision will be made in connection with the meeting as to whether there are grounds for drawing any consequences in the case. Minutes of the meeting will be prepared, which their client will have the opportunity to review and comment on, as well as their client will also have the opportunity to provide additional information, which he may not have thought of until after the meeting. .

I must emphasize that your client - as he is not employed by TV 2 - is obviously not obliged to attend the meeting.

However, should your client decide that he does not wish to attend the meeting, I must at the same time emphasize that TV 2 will in that case be forced to assess the case and make a decision on the basis available.

In this connection, I must clarify - for the sake of good order - that my client does not intend to inform the production company in which your client is employed about the specific reason for a decision notified to the production company that they do not want your client to continues to host productions for TV2… ”

The complainant's lawyer and Norrbom Vinding then had further correspondence between 21 and 26 November 2020, which i.a. concerned discussions on the organization of the process and the provision of (more detailed) information on the two reports relating to complaints.

On 27 November 2020, Norrbom Vinding, representatives from TV 2, the complainant's lawyer and complainant held a meeting. At the meeting, Norrbom Vinding initially reviewed the two reports, which originated from 2001 and 2003, respectively, for complainants, after which complainants and the complainants' lawyer were given the opportunity to comment on the reports.

On 14 December 2020, Norrbom Vinding invited complainants and complainants' lawyer to participate in an (online) meeting where Norrbom Vinding would disclose the results of the lawyer's investigation, including the assessment of the two reports that related to complaints.

On 17 December 2020, the complainant's lawyer received - upon request - a prior statement from Norrbom Vinding. Norrbom Vinding stated that the result of the legal investigation was that the complainant's behavior during the reported episodes from 2001 and 2003 constituted abusive acts, and that TV 2 had therefore assessed that the complainant was no longer worthy of hosting TV 2's channels.

At the subsequent meeting, which was held on 18 December 2020, the results of the investigation and TV 2’s decision that complaints could not continue to host TV 2’s programs were reviewed in more detail.

Subsequently, on 16 February 2021, the Danish Data Protection Agency received a complaint from complaints about TV 2’s and Norrbom Vinding’s processing of information about him, including information about his sexual relationship.

On 18 March 2021, the Danish Data Protection Agency sent the complaint for consultation and asked TV 2 and Norrbom Vinding for an opinion on the matter.

Norrbom Vinding appeared on 22 and 29 April 2021, respectively, with statements on the case, after which complainants submitted their comments on 4 May 2021.

In response to the complainant's comments, the Danish Data Protection Agency requested TV 2 and Norrbom Vinding on 26 May 2021 for a supplementary opinion on the matter, which the Authority received on 7 July 2021.

On 9 July 2021, complainants commented on the supplementary opinion.

3. General considerations of the parties

3.1. TV2's and Norrbom Vinding's general remarks

TV 2 and Norrbom Vinding have generally stated that TV 2 had a factual purpose with and authority to initiate and carry out the investigation with a view to uncovering possible sexism and violations, and that the information about complaints that have been processed in connection with this has taken place. in accordance with the Data Protection Regulation and Act.

It is the opinion of TV 2 and Norrbom Vinding that there were compelling reasons that necessitated TV 2 launching and conducting a study on the culture of TV 2.

In connection with this, TV 2 and Norrbom Vinding have referred to (the former) § 9 a in the Danish Working Environment Authority's executive order on the performance of work and the Danish Working Environment Authority's executive order of 26 September 2020 on mental working environment, which obliges employers - including TV 2 - to ensure physical and mental work environment.

TV 2 and Norrbom Vinding have stated that in light of this obligation and as a result of matters covered by the media in the autumn of 2020 about an unhealthy culture in TV 2, TV 2 believed that it was necessary to conduct a study of the culture in TV 2, and TV 2 therefore requested Norrbom Vinding to assist with the conduct of such an investigation.

It was TV 2's and Norrbom Vinding's assessment that it was necessary to carry out the investigation with the inclusion of personal data, as TV 2 wanted to achieve a real showdown with the unhealthy culture that immediately prevailed in TV 2, and it had therefore not been sufficient to carry out the survey anonymously - as, for example, Kvinfo had done in relation to a survey conducted on behalf of the Radical Left.

TV 2 and Norrbom Vinding therefore set up a reporting scheme, and a process description was prepared for this purpose for how received reports were to be handled. It appeared i.a. of the process description that an assessment should be made of each individual report. If it was judged that a report did not contain potentially offensive acts, the report was anonymised and passed on to TV 2, so that the report (in anonymised form) could be included in the work with the culture in TV 2. Reports that potentially contained work-offensive acts were further processed. and handled by Norrbom Vinding and TV 2's HR department.

As a result, TV 2 and Norrbom Vinding received two reports relating to complaints. The reports concerned two episodes from the autumn of 2001 and the spring of 2003, respectively, in which complainants allegedly displayed abusive behavior towards the two women who made the reports.

Both episodes were therefore screened, as was apparent from the trial description, and the assessment was that both episodes possibly constituted abusive acts.

TV 2 and Norrbom Vinding decided to launch a closer investigation of the two reported episodes, as complaints at the time of the two episodes were employed as hosts on TV 2 Nyhederne in Odense, and then complaints at the time of the reporting scheme and the subsequent investigation worked as hosts on one of TV 2's programs, which is produced by an external supplier. Complainants therefore also collaborated at the time of the investigation with both employees employed by Nordisk Film and employees employed by TV 2; and as complaints in general had a close connection to TV 2, its employees and facilities, TV 2 was justified and (in terms of working environment law) obliged to investigate the reports on complaints in more detail.

3.2. Complainant's general remarks

Complainants have generally stated that TV 2’s and Norrbom Vinding’s processing of information about him, including information about his sexual relationship, has not taken place in accordance with the data protection rules, and that he has not received sufficient information about the processing.

4. TV2’s and Norrbom Vinding’s processing of personal data

TV 2 and Norrbom Vinding have stated that Norrbom Vinding has assisted TV 2 in initiating and conducting the investigation, and that Norrbom Vinding's processing of information about complaints therefore stems from the assignment from TV 2.

Norrbom Vinding has stated that Norrbom Vinding must of course independently have a treatment basis for the treatments that Norrbom Vinding carries out, but that this will stem from TV 2’s interests, including providing the client TV 2 with legal assistance. Norrbom Vinding's treatment basis must therefore be seen in connection with TV 2’s.

TV 2 and Norrbom Vinding have processed information about complainants, including information about complainants' sexual relationships. In the case of TV 2, this information has been processed in accordance with Article 6 (1) of the Data Protection Regulation. Article 9 (1) (c) and (f) 2, letters b and f, the Data Protection Act § 7, para. Article 9 (2) of the Data Protection Regulation 2, letter b, and the Data Protection Act § 12.

Norrbom Vinding's basis for processing has specifically been Article 6 (1) of the Data Protection Regulation. Article 9 (1) (f) and Article 9 (1) 2, letter f, as TV 2 has "transferred" personal information about e.g. complaints to Norrbom Vinding with a view to conducting the investigation and obtaining legal advice. The complainant's information has at no time been processed on the basis of the complainant's consent.

As regards Norrbom Vinding's treatment basis in Article 6, para. 1, letter f, Norrbom Vinding has stated that the legitimate interest has been to provide TV 2 with assistance in conducting the investigation, and that Norrbom Vinding in this case thus "adopts" TV 2's legitimate interest.

Norrbom Vinding has referred to i.a. The Danish Bar Association's guide [3] and Danske Advokater's guide [4], from which it appears that lawyers will be able to process information on behalf of their clients on the basis of e.g. Article 6 (1) of the Regulation Article 9 (1) (f) and Article 9 (1) 2, letter f.

It is Norrbom Vinding's opinion that Norrbom Vinding, as a lawyer for TV 2, has had a factual purpose with and authority to assist TV 2 in initiating and implementing a reporting scheme and an investigation process in order to uncover possible sexism and abusive acts.

The processing of personal data, including information on complaints, has been carried out in accordance with the general principles for the processing of personal data in Article 5 of the Data Protection Regulation.

Complainants have stated that he does not agree that the media in the autumn of 2020 covered stories about concrete descriptions of criticisable conditions at TV 2 in the past and present. The complainant believes that the media coverage only went on the host Sofie Linde's statement on TV 2 Zulu about conditions on Danmarks Radio - and thus not TV 2. Therefore, in the complainant's opinion, there were no specific circumstances that justified the investigation involving "old cases".

TV 2 and Norrbom Vinding therefore did not have any "suspects" at the time of launching the investigation. There was only a presumption that cases would arise, and a kind of "free-rent scheme" was thus established for reviewers without knowing what this scheme would entail.

The survey could have been conducted in the same way as Kvinfo did for the Radical Left, where all reports were anonymized.

In relation to the specific processing of information about him, complainants have stated that he has at no time given consent to the processing of information about him.

Complainants have further stated that none of the treatment authorizations cited by TV 2 and Norrbom Vinding can form the basis for processing information about him and his sexual relationship. Complainants note in this connection that none of the other processing powers in the Data Protection Ordinance - and the Act in general - can justify the processing of information about him that TV 2 and Norrbom Vinding have carried out in connection with the investigation.

4.1. Article 6 (1) of the Data Protection Regulation 1, letter c, the Data Protection Act § 7, para. Article 9 (2) of the Data Protection Regulation 2, letter b, and the Data Protection Act § 12

4.1.1. Article 6 (1) of the Data Protection Regulation 1, letter c

4.1.1.1. Comments of the parties

TV 2 and Norrbom Vinding have stated that TV 2 has been authorized to process personal data on complaints, cf. Article 6 (1) of the Data Protection Regulation. 1, letter c, as TV 2 is subject to legal obligations, which i.a. instructs TV 2 to ensure that no abusive acts take place under the auspices of TV 2.

The legal obligations follow from the rules of the working environment law, the Equal Treatment Act, the Discrimination Act and the Gender Equality Act, and TV 2 was covered by these obligations when the episodes took place, just as TV 2 continues to be covered by these obligations.

As a result, TV 2 was obliged and entitled to investigate matters of significance to TV 2’s duty to ensure that employees, partners, etc. not be subjected to infringing acts in connection with the pursuit of TV 2's activities.

It was therefore also a necessity that TV 2 and Norrbom Vinding processed information about complaints as part of the investigation.

In TV 2's view, the investigation could not be carried out without the women in question naming alleged perpetrators. Had the investigation been carried out without processing information on complaints, TV 2 would not have been able to assess whether an exhibited conduct was incompatible with a continued affiliation with TV 2.

In support of this, Norrbom Vinding and TV 2 have referred to the Data Protection Regulation's preamble recital no. 45 and report no. 1565/2017 on the data protection regulation, page 130 f, from which it follows that the use of Article 6, para. 1, letter c, does not presuppose a national, implementing legal legislation on the actual specific processing of personal data in connection with the determination of a legal obligation.

TV 2 and Norrbom Vinding have also noted that the Danish Working Environment Authority stated in November 2020 that the inspection would be on an unannounced inspection visit within 12 months.

The Danish Working Environment Authority came up for inspection on 24 February 2021, where the mental work environment was the primary theme for the inspection. In this connection, the Danish Working Environment Authority noted that the Authority was aware of TV 2’s ongoing work with a view to ensuring a sound mental working environment, including by conducting the study in question.

Complainants have stated that the labor and employment law obligations, including the Danish Working Environment Authority's executive order on the performance of work § 9 a, which TV 2 and Norrbom Vinding have referred to as a basis for treatment, clearly relate to the current working environment.

In connection with this, complainants have noted that there are no reports that the Danish Working Environment Authority's unannounced visit in January / February 2021 also related to the historical working environment, which is why it is insignificant information that should not be valued.

Furthermore, the complainants have stated that the personal data concerned conditions in the complainant's private home and in a context that had nothing to do with TV 2. Neither employment law nor work environment law rules therefore applied, as the situations did not have a work purpose. In addition, complainants have noted that he did not assume any leadership role towards the two women involved.

In support of this, the complainants have further stated that the reports relate to matters from resp. 2001 and 2003, and the age of the episodes alone therefore makes official or other legal reactions impossible. The result of the investigation is therefore impossible to verify in either criminal or employment law. Criminal law because the circumstances for which the complainant - wrongly - is accused are 17 and 19.5 years back. Employment law because complainants were not employed by TV 2 at the time of the investigation. The processing in question of information about complainants, including information about complainants' sexual relationships, therefore had to presuppose very special reasons before these could be included in the investigation and brought forward now.

It is the complainant's view that there were no such specific reasons as to why neither TV 2 nor Norrbom Vinding was entitled to or could reasonably include information about him in the investigation.

Thus, in the complainant's view, TV 2 did not have a legitimate interest in obtaining and processing the information. Nor did the public or TV 2 viewers have any legitimate interest in it.

Furthermore, the complainants have noted that he has never been confronted with the reported conditions and that, moreover, no complaints have been lodged regarding him while he was employed on TV 2. Complaints therefore did not constitute a current, concrete or latent danger to TV 2 employees when the investigation was launched and conducted.

In this connection, according to complaints, it is remarkable that TV 2 and Norrbom Vinding have not received a single report about him from current TV 2 employees. The reports about him have only been submitted by two former journalist trainees who have long since left TV 2 - in 2004 and 2005 respectively.

Furthermore, complainants have stated that he was not employed on TV 2 - and therefore is not part of the employee group on TV 2 - when the legal investigation was conducted. Complainants therefore also do not agree that he had a close collaboration with employees from TV 2, as there were actually two separate editorial offices. He also did not have access to TV 2 without a guest passport, which required an agreement with an employee, just as there was no employee overlap between the two workplaces - except in relation to two hosts who were on loan to Nordisk Film.

In addition, complaints have only once a year participated in an event for hosts from the production companies, where a small number of managers from TV 2 also participated, and in his 5 years at Nordisk Film alone he has visited TV 2's headquarters in Copenhagen twice, where he each time carried a visible guest passport.

Finally, Nordisk Film was visited 2-3 times a year by a manager from TV 2, who gave post-criticism. Complainants therefore did not have close contact with TV 2 or TV 2’s employees during his employment at Nordisk Film.

Complainants have stated that TV 2 and Norrbom Vinding have nevertheless tried to connect complaints personally and professionally with TV 2, and they have tried to describe him as a current, concrete or latent danger to the employees of TV 2 and to a safe and harassment-free working environment in general, which in the light of the above is not correct.

4.1.1.2. The Danish Data Protection Agency's assessment regarding the application of Article 6 (1) 1, letter c

It is clear from Article 6 (1) of the Data Protection Regulation 1, letter c, that the processing of personal data may take place if the processing is necessary to comply with a legal obligation incumbent on the data controller.

Recital 45 in the preamble to the Data Protection Regulation states that:

"If processing is carried out in accordance with a legal obligation incumbent on the data controller, or if processing is necessary to perform a task in the public interest, or which falls within the exercise of official authority, the processing should have a legal basis in EU or national law. This Regulation does not require a specific law for each treatment. A law may suffice as a basis for several data processing activities, which are based on a legal obligation incumbent on the data controller, or whose processing is necessary to perform a task in the interest of society, or which fall within the exercise of public authority. "

Report no. 1565/2017 on the Data Protection Regulation, page 117, states the following about the provision:

“The Register Committee has stated in report no. 1345 that the term legal obligation, according to a purely literal interpretation, covers any kind of legal obligation. The Committee further states that, notwithstanding this, it can hardly be assumed that the term is to be understood as covering all types of legal obligations.

It follows from the comments on the Personal Data Act that the term legal obligation includes obligations arising from the legislation or from administrative regulations laid down in pursuance thereof. The term also includes obligations arising from international rules, including EU law. Just as obligations arising from a court decision or from a decision taken by an administrative authority are also covered. "

Furthermore, the report, page 130, states the following:

In this connection, however, there may be reason to consider whether the social partners in collective agreements can create a 'legal obligation' within the meaning of Article 6 (1) of the Regulation. As mentioned above, the Danish Data Protection Agency has stated that provisions in collective agreements cannot be considered covered by the rule in the Personal Data Act, section 6, subsection. 1, no. 3, cf. the Authority's j.nr .: 2011-313-0474.

However, it is clear from recital 41 in the preamble to the Data Protection Regulation that when the regulation refers to a legal basis or a legislative measure, it does not necessarily require a law adopted by a parliament, subject to requirements under the constitutional order of the Member State concerned. . However, such a legal basis or such a legislative measure should, it is clear from the preamble, be clear (t) and precise (t), and its application should be predictable for persons falling within its / its scope, in accordance with EU case law. Court of Justice and the European Court of Human Rights.

Collective agreements and the trade union dispute resolution system constitute a very central, legally binding framework for the organization of the Danish labor market. Collective agreements are also recognized at European level for their special status. Thus, in Article 28, the EU Charter of Fundamental Rights recognizes the bargaining power of the social partners and the right to collective action. At the same time, it is clear that EU directives can be implemented through collective agreements for employee groups covered by the agreement.

Against this background, it does not seem possible to rule out in advance that collective agreements may impose a "legal obligation" within the meaning of Article 6 (1) of the Regulation. 1, letter c, cf. in this connection also Peter Blume and Jens Kristiansen: Personal data law in employment relationships, 1st edition, 2011, p. 189.

Finally, it must be assumed that Article 6 (1) 1, letter c, is directly applicable as a basis for treatment, as long as the legal obligation follows from e.g. National dish. The use of Article 6 (1) 1, letter c, as a basis for processing thus does not presuppose a national, implementing legal legislation on the actual specific processing of personal data in connection with the determination of a legal obligation. See section 3.4. on Article 6 (1) of the Regulation 2-3. ”

It is thus clear from Report No 1565/2017 on the Data Protection Regulation that a legal obligation under Article 6 (1) of the Data Protection Regulation 1, letter c, b.a. should be clear and precise, as well as predictable for persons falling within its scope.

TV 2 and Norrbom Vinding have stated that the processing of information on complaints based on Article 6 (1) of the Data Protection Regulation 1, letter c, occurs as a result of the legal obligation imposed on TV 2 pursuant to working environment law rules, the Equal Treatment Act, the Discrimination Act and the Gender Equality Act to ensure a safe and healthy working environment - including safe employees from abusive acts such as sexual harassment.

It is the opinion of the Danish Data Protection Agency that TV 2's and Norrbom Vinding's processing of information about complaints could not take place within the framework of the Data Protection Regulation, Article 6 (1). 1, letter c.

In this regard, the Danish Data Protection Agency has emphasized that the legal obligations in the labor law and discrimination law rules to which TV 2 and Norrbom Vinding refer do not, in the Authority's view, appear sufficiently clear and precise to be used as a basis for processing in Article 6, PCS. 1, letter c.

The Danish Data Protection Agency is aware that the Danish Working Environment Authority's executive order on the performance of work [5] § 9 a has been repealed and replaced by the Danish Working Environment Authority's executive order on mental working environment [6], which entered into force on 1 November 2020. this executive order contains sufficiently clear and precise rules on the employer's legal obligations which may form the basis for the processing of personal data in the present case.

In summary, it is thus the Data Inspectorate's assessment that the collection and processing of information on complaints could not take place on the basis of Article 6 (1) of the Data Protection Regulation. 1, letter c.

4.1.2. The Data Protection Act, section 7, subsection Article 9 (2) of the Data Protection Regulation 2, letter b

4.1.2.1. Comments of the parties

TV 2 and Norrbom Vinding have in relation to the Data Protection Act § 7, paragraph. Article 9 (2) of the Regulation. Article 6 (2) (b), repeating predominantly what is stated in relation to Article 6 (2) of the Data Protection Regulation 1, letter c.

It is further added and elaborated that TV 2 is imposed labor law obligations to ensure a healthy and safe working environment free from sexual harassment and other types of abusive acts. The obligations also apply in relation to partners' employees who work with the production of TV 2's programs and who at times work with employees from TV 2.

It was therefore necessary to also examine information covered by Article 9 of the Regulation on complaints in relation to the assessment of whether the conduct of the complainants constituted infringing acts, to which TV 2 is obliged under the rules of work and employment to respond.

In this connection, TV 2 refers to the “Data Protection Ordinance and the Data Protection Act with comments” [7], of which section 7 (1) of the Data Protection Act 2, it appears that the term “labor law obligations or specific rights” must be understood in a broad sense. Included in the term are all kinds of obligations and rights that rest on an employment law basis, and this applies regardless of whether the basis is legislation or agreement.

TV 2 and Norrbom Vinding state that it is irrelevant for the application of the employment law discrimination rules or work environment law rules that the episodes took place in the complainant's private apartment. In support of this, reference is made to two decisions [8], whereby an employee's actions towards other employees at a private party justifiably led to labor law sanctions (respectively expulsion and dismissal).

Furthermore, TV 2 and Norrbom Vinding have stated that in the two specific cases, the invitation to the events where the episodes took place took place in the workplace between colleagues, where experienced and profiled employees invited two young, female trainees to a "four-night event" with colleagues after occupation.

Complainant, although he had not been employed by TV 2 for several years, continued to have a close affiliation with TV 2, acting as host of TV 2 and in doing so working together and meeting with staff from TV 2.

As a result, it was necessary for TV 2 and Norrbom Vinding to investigate the reported episodes in order to assess whether there could potentially be a risk associated with complainants still having an affiliation with TV 2 and TV 2’s employees.

Overall, it is therefore TV 2's and Norrbom Vinding's opinion that there was a legal basis for processing information about the complainant's sexual relations, cf. the Data Protection Act, section 7, subsection. Article 9 (2) of the Data Protection Regulation 2, letter b.

Complainants have noted that the decisions to which TV 2 and Norrbom Vinding refer, in relation to the fact that conduct at private events can lead to employment law sanctions, in no way fit the present situation. This is because the temporal perspective and the firmness of the evidence differ significantly from the present case.

Complainants, on the other hand, consider that the decisions support his arguments that the starting point must be that circumstances expelled during a social relationship cannot lead to employment law sanctions if they do not subsequently adversely affect the performance of the work.

4.1.2.2. The Danish Data Protection Agency's assessment regarding the application of the Data Protection Act, section 7, subsection Article 9 (2) of the Data Protection Regulation 2, letter b

It is clear from Article 9 (1) of the Data Protection Regulation 1, that the processing of information on racial or ethnic origin, political, religious or philosophical beliefs or trade union affiliation as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health information or information on a natural person's sexual or sexual relations orientation is prohibited.

Article 9 (1) of the Regulation 2, it appears that para. 1 shall not apply if one of the conditions in points a-j applies.

Pursuant to Article 9 (1) of the Data Protection Regulation 2, letter b, the data controller may process information as mentioned in para. 1, the processing of which is necessary to comply with the labor, health and social security obligations and specific rights of the data controller or data subject, in so far as it is governed by Union law or the national law of the Member States or a collective agreement under national law of the Member States; , which provides the necessary guarantees for the data subject's fundamental rights and interests.

Furthermore, it appears from the Data Protection Act, section 7, subsection. That the processing of data covered by Article 9 (2) of the Data Protection Regulation 1 may take place if processing is necessary to comply with the data controller's or data subject's employment law obligations and specific rights, in accordance with Article 9 (1) of the Data Protection Regulation. 2, letter b.

TV 2 and Norrbom Vinding have stated that the processing of information about the complainant's sexual relations, which has been carried out on the basis of Article 9 (1) of the Data Protection Regulation. Has been made on the basis of the legal obligations which have also been asserted in relation to Article 6 (2). 1, letter c.

It is the Data Inspectorate's opinion that TV 2's and Norrbom Vinding's processing of information about the complainant's sexual relations could not have taken place within the framework of the Data Protection Act, section 7, subsection. Article 9 (2) of the Data Protection Regulation 2, letter b.

In assessing this, the Danish Data Protection Agency has emphasized that the legal obligations arising from section 7 (1) of the Data Protection Act, respectively. 2, and rules of working environment law, to which TV 2 and Norrbom Vinding refer, in the opinion of the Authority are not sufficiently clear and precise to be able in the present case to form the basis for processing information about the complainant's sexual relations.

The Danish Data Protection Agency notes that, due to the protection considerations in relation to the information listed in Article 9 (1) of the Data Protection Regulation, 1, stricter requirements must be set for the assessment of necessity and for the clarity and precision of the legal obligation.

4.1.3. Section 12 of the Data Protection Act

4.1.3.1. Comments of the parties

TV 2 and Norrbom Vinding have further stated that section 12 of the Data Protection Act authorizes the processing of information about the complainant's sexual relations.

In this connection, TV 2 and Norrbom Vinding have referred to Article 88 (1) of the Data Protection Regulation. 1, which constitutes the legal framework for section 12 of the Data Protection Act. Reference is also made to the special remarks to section 12 [9], from which the following appears:

"With section 12 of the Bill, the intention is to bring complete assurance that personal data can be legally processed in the public and private labor market before, during and after the employment relationship to the same extent as before."

It is further referred to that the processing of personal data pursuant to section 12, subsection 2, may be made on the basis of a balancing of interests rule when the legitimate interest is in connection with employment relationships.

TV 2 and Norrbom Vinding have stated that it is not a requirement that the employment relationship is current, just as it is not a requirement that the processing relates to the data subject's own employment relationship.

TV 2 was therefore entitled to process information on complaints which relate to both Article 6 and Article 9, cf. section 12 of the Data Protection Act. safe and sound mental work environment.

In support of this view, TV 2 and Norrbom Vinding have referred to a decision from the Eastern High Court [10], where the High Court ruled that the employer's obligations under the working environment rules not only relate to protection against violations from other employees, but also violations from others, e.g. . employees from other companies or citizens.

The decision further emphasizes that an employer will be at risk of incurring legal and financial liability under the Equal Treatment Act if the employer fails to act on the knowledge that a former employee, who has subsequently been employed by a partner of the employer, during his employment committed abusive acts towards colleagues, and it later had to turn out that the former employee (again) commits abusive acts towards employees employed by the employer.

It is on this basis that TV 2's and Norrbom Vinding's view that TV 2 had a legitimate interest in processing information about complaints, and that complainants' rights and interests did not precede this, which is why TV 2 had authority to process information about complaints under the Data Protection Act. § 12, para. 1 and 2.

Complainants have denied that processing of information about him could have taken place on the basis of the Data Protection Act, section 12, subsection. 1 and 2.

4.1.3.2. The Danish Data Protection Agency's assessment regarding the application of section 12 of the Data Protection Act

It follows from the Data Protection Act, section 12, subsection 1, that the processing of personal data in connection with employment relationships covered by Article 6, para. 1, and Article 9, para. 1 of the Data Protection Regulation may take place if the processing is necessary to comply with the data controller's or data subject's employment law obligations or rights as laid down in other legislation or collective agreements.

It appears from the provision's paragraph. 2, that the processing of information as mentioned in para. 1 may also take place if the processing is necessary for the data controller or a third party to pursue a legitimate interest arising from other legislation or collective agreements, unless the data subject's interests or fundamental rights and freedoms take precedence over this.

The following appears from the general remarks on Bill L 68 [11], section 2.3.8.3. in relation to the Data Protection Act § 12:

“Collective agreements and agreements as well as the trade union dispute resolution system constitute a very central, legally binding framework for the organization of the Danish labor market. Collective agreements are also recognized at European level for their special status in the EU Charter of Fundamental Rights. The Charter thus recognizes the bargaining power of the social partners and the right to collective action in Article 28. At the same time, it is clear that EU directives can be implemented through collective agreements for employee groups covered by the agreement.

Against this background, collective agreements may constitute a "legal obligation" within the meaning of the term data protection law in Article 6 (1) of the Regulation. 1, letter c. Reference is made to the report, pages 118, 130 and 971.

However, there is some uncertainty associated with the question of whether a “legal obligation” in a data protection law context can be stated in a collective agreement. In addition, employers in the public sector, as opposed to in the private sector, can no longer, after 25 May 2018, from which the regulation is to be applied, make use of the "balancing of interests rule" in Article 6 (1) of the regulation. 1, letter f, which in future only applies to private individuals. The corresponding processing authority in the Personal Data Act, section 6, subsection 1, no. 7, has so far been used extensively as a treatment authority by both public and private employers.

In the light of the above and with a view to “solid protection” to ensure a solid legal basis for the processing of personal data in the entire Danish labor market also in the future, it is proposed with section 12 of the bill an additional legal provision, according to which personal data can also be processed on the basis of collective agreements, both where the agreement prescribes a duty to process - e.g. a duty to notify the shop steward or the trade union in the event of dismissals - and where the agreement allows or presupposes the processing of personal data, e.g. if the agreement gives the employer the opportunity to monitor employees' use of the Internet or to require them to take a urine sample, or if the agreement presupposes the transfer of personal information to the union representative or the trade union as part of wage negotiations or trade union dispute resolution, etc.

The proposed provision ensures that the processing of personal data can take place regardless of whether the data subject is a member of a trade union, as long as the data subject's employment relationship is covered by the agreement in question.

The proposed provision is based on Article 88 of the Regulation, which allows Member States to adopt specific provisions on the processing of workers' personal data in the context of employment. Article 88 is a domestic supplement which ensures that there is at least no doubt that national processing rules can be laid down in laws and collective agreements in the field of employment with regard to the processing of all types of personal data - in compliance with the requirements for such national legislation in e.g. Article 9, paragraph Article 88 (2) (b) and Article 88 (2) 2. Reference is made to pages 970-980 of the report on Article 88 of the Regulation.

Of course, the proposed section 12 does not change the current state of the law that collective agreements must be within the framework of other legislation. The collective agreements that form the basis for processing pursuant to section 12 of the Bill must otherwise live up to the requirements for this pursuant to Article 88 (1). 2.

It is noted that under the auspices of the Labor Court and the professional arbitration, one can take a position on relevant issues concerning the Data Protection Ordinance and this bill, cf. sections 10, subsection 2, and 24, para. 1 of the Act on Labor Law and Professional Arbitration (Statutory Order no. 1003 of 24 August 2017), according to which a decision can be made on a case, even if the decision on legislation is important for the decision of the case. "

Furthermore, the following appear from the special remarks to Bill L 68 to section 12 of the Act:

“The wording of para. Paragraph 1 is in line with Article 9 (1) of the Regulation. The provision thus fully establishes that both information covered by Article 6 (2) (b) 1, and of Article 9, para. 1, may be dealt with in accordance with the same provision, namely section 12 (1) of the Bill. 1, when there is an employment law obligation or right.

With the proposal for para. 2, it is proposed that the processing of information as mentioned in para. 1 may also take place if the processing is necessary for the data controller or a third party to pursue a legitimate interest arising from other legislation or collective agreements, unless the data subject's interests or fundamental rights and freedoms take precedence over this.

Today, the processing of personal data in employment relationships often takes place legally on the basis of the balance of interests rule in the Personal Data Act, section 6, subsection. 1, no. 7, even though the treatment is not necessitated by an employment law obligation, but which otherwise has its background in e.g. a collective agreement. Such processing may continue on the basis of this proposed balancing of interests rule in para. 2, which corresponds to the rule in Article 6 (2) of the Regulation. The proposed provision also ensures that such a balancing rule can also be applied in connection with employment in the public sector, even though it is covered by Article 6 (1) (f) of the Regulation. Paragraph 1 (f), second subparagraph, states that the balancing of interests rule does not apply to processing carried out by public authorities as part of the performance of their tasks. "

It is the Data Inspectorate's opinion that TV 2's and Norrbom Vinding's processing of information about complaints, including information about complainants' sexual relationships, could not take place within the framework of section 12 of the Data Protection Act.

It appears from the general remarks to Bill L 68 and from the special remarks to section 12 of the Data Protection Act that the provision is predominantly intended as a supplementary provision in relation to Article 6 (1) of the Data Protection Regulation. Article 9 (1) (c) and Article 9 (1) 2, letter b.

Furthermore, it appears that section 12 mainly refers to the processing of personal data that follows from collective agreements and agreements, and that the provision has the character of a "full protection", as there is uncertainty as to whether obligations arising from collective agreements and agreements , constitutes a legal obligation under Article 6 (1) of the Data Protection Regulation. Article 9 (1) (c) and Article 9 (1) 2, letter b.

It is on this basis that the Danish Data Protection Agency's assessment is that the provision is not intended to have an independent or broader meaning in relation to Article 6 (1) of the Data Protection Regulation. Article 9 (1) (c) and Article 9 (1) 2, letter b, and that it is a prerequisite for the application that labor law obligations, which are stipulated in other legislation or collective agreement, must be clear and precise.

In this connection, the Danish Data Protection Agency refers to the justifications under section 4.1.1.2. and 4.1.2.2. above in relation to Article 6 (1) Article 9 (1) (c) and Article 9 (1) 2, letter b, regarding the question of whether the legal obligations under labor law and discrimination law rules can be considered to be sufficiently clear or precise to be able to form the basis for processing information on complaints.

On the basis of this, the Danish Data Protection Agency finds that TV 2 and Norrbom Vinding's processing of information about complainants, including information about complainants' sexual relationships, could not take place on the basis of the Data Protection Act, section 12, subsection. 1.

With regard to the Data Protection Act, section 12, subsection It is clear from the comments on the provision that this corresponds to the balancing of interests rule in Article 6 (2) of the Regulation. 1, letter f. This implies that such a balancing rule can also be applied in connection with employment relationships in the public sector.

With reference to this and to what has been stated above about the provision's character of a "full protection", it is the Data Inspectorate's assessment that section 12 (1) of the Data Protection Act 2, may not constitute the legal basis for the processing of information about complainants, including information about complainants' sexual relationships.

4.1.4. Article 6 (1) of the Data Protection Regulation Article 9 (1) (f) and Article 9 (1) 2, letter f

4.1.4.1. Comments of the parties

TV 2 and Norrbom Vinding have in relation to Article 6, para. 1, letter f, argued that TV 2 - as a result of TV 2's occupational health and safety obligations under the Equal Treatment Act, the Discrimination Act and the Gender Equality Act - has a legitimate interest in conducting an investigation of any infringing acts under the auspices of TV 2´, and that personal data may be processed in this connection.

It is TV 2's and Norrbom Vinding's opinion that the legitimate interest applies both in relation to any current situations and in relation to previous matters / episodes, where the person who has been reported is still employed by TV 2 or via a partner. is affiliated with or appears on TV 2.

In support of TV 2’s legitimate interest, TV 2 and Norrbom Vinding have stated that TV 2 launched the investigation on the basis of serious criticism in the media from both current and former employees; that the employees of TV 2 at a meeting on 21 September 2020 demanded an investigation; that the inclusion of "old cases" was due to suspicion of a previous "unhealthy" culture with possible abusive acts; that it was necessary to include "old cases" in order to have a real confrontation with the "unhealthy" culture; and that TV 2 was aware of limiting the investigation, which is why reports on former employees who were no longer employed by TV 2 or otherwise linked to TV 2 should not form part of the investigation.

Furthermore, TV 2’s legitimate interest was supported by a broader public interest or societal interest in bringing abusive acts to life, which according to Article 29 Group Opinion 6/2014, page 37 f., Must be given weight.

Norrbom Vinding and TV 2 have also referred to the Ministry of Justice's joint guide for whistleblower schemes in the state's area, according to which it is the Ministry of Justice's view that reporting schemes / whistleblower schemes, among other things, must be able to handle and process information related to sexual harassment.

In this connection, it is TV 2's and Norrbom Vinding's opinion that the guidelines (and the now adopted law on the protection of whistleblowers) do not provide “carte blanche” to investigate possible infringing acts and thereby process personal data. However, it shows that both the Ministry of Justice and the Folketing have a perception that investigations into infringing acts constitute a central and legitimate purpose - even when the investigations concern matters that are far back in time.

TV 2 and Norrbom Vinding are of the opinion that the complainant's interests and fundamental rights do not take precedence over TV 2’s legitimate interest in processing information about him in relation to the investigation. This is further due to the fact that consideration for the two women who have reported the episodes should also be given weight in the balance between them.

Complainants hosted Go 'Aften Live at the time of the investigation, and there was therefore a consideration to be given to TV 2 and to TV 2's employees, just as TV 2 was entitled to assess whether complaints should continue as host - a decision as TV 2 assessed was necessary.

TV 2 notes in this connection that it was the complainants themselves who published TV 2’s decision and that it was the complainants who chose to share the details of the case. It was therefore also the complainants themselves - and not TV 2 or Norrbom Vinding - who were to blame for the damage the complainant's career has taken from the fact that the public became aware of the reason why complainants no longer hosted TV 2's programs.

In addition, TV 2 and Norrbom Vinding believe that the course of the investigation was transparent, as complainants were initially encouraged to hire a lawyer - which he did - just as the course of the investigation was described in the process description, which complainants were given in connection with the initial exchange of letters. .

Overall, it is the view of TV 2 and Norrbom Vinding that the interests and rights of the complainant did not take precedence over TV 2's legitimate and legitimate interest in investigating two serious reports of alleged infringing acts in order to ensure that no infringing acts take place, and TV 2 therefore finds that there was a legal basis for processing ordinary personal data on complaints, in accordance with Article 6 (1) of the Data Protection Regulation. 1, letter f.

Complainants have in relation to TV 2's and Norrbom Vinding's considerations about the whistleblower guide noted that i.a. information on sexual harassment after a specific assessment may involve serious matters that may be the subject of a whistleblower scheme. However, the guidance also states that it is the general data protection rules that apply when information about sexual harassment is to be handled in a whistleblower scheme.

Complainants have further stated the same views as appear from pkt. 4.1.1.1.

In relation to Article 9 (1) of the Data Protection Regulation 2, letter f, TV 2 and Norrbom Vinding have stated that TV 2 could process information about the complainant's sexual relations, cf. Article 9 (1) of the Data Protection Regulation. 2, letter f, as TV 2 in connection with the investigation had to assess whether a legal claim could be established, asserted or defended.

In this connection, TV 2 and Norrbom Vinding have referred to recital 52 of the Data Protection Regulation, which states that: “A derogation should also make it possible to process such personal data, if necessary, in order for legal claims to be established, whether it is in connection with a lawsuit or an administrative or extrajudicial proceeding. "

TV 2 and Norrbom Vinding have stated that according to the contract basis with Nordisk Film - which the complainants were employed by - TV 2 had to approve the study hosts, and that TV 2 had the right to demand changes in the programs that Nordisk Film produced for TV 2 This applied - in TV 2's view - to any replacement of hosts on TV 2's programs.

In this connection, the conclusion of Norrbom Vinding's investigation was that TV 2 did not want complaints to continue as host of Go 'Aften Live, and that TV 2 thus wanted to activate its right to ask Nordisk Film to nominate another host. available for the program.

Furthermore, it appeared from the contract with Nordisk Film that if changes caused by TV 2 entailed additional costs for Nordisk Film, Nordisk Film could demand extra payment for the additional cost that TV 2 had caused.

Nordisk Film thus had a potential legal claim that TV 2 covered any (additional) costs, e.g. notice of termination and compensation for an unreasonable termination of complaints, as a result of TV 2’s requirement that complainants should no longer host TV 2’s programs.

TV 2 and Norrbom Vinding have further stated that they were aware that due to the course and outcome of the investigation a dispute could arise between complainants and TV 2, and that in this connection it could not be ruled out that complainants would try to raise a claim for damages against TV 2.

It is noted that the complainant in connection with his complaint to the Danish Data Protection Agency has made a reservation to raise a claim for compensation against TV 2 and Norrbom Vinding.

Finally, TV 2 and Norrbom Vinding state that the purpose of processing information about the complainant's sexual relations was to obtain legal advice from Norrbom Vinding in order to assess whether the reported episodes constituted a violation under applicable law and whether there was a legal basis for employment law / contractual reactions / sanctions.

TV 2 and Norrbom Vinding have also referred to the fact that Article 9 (1) of the Data Protection Regulation 2 (f), according to the ICO [12] also applies to potential but not yet updated legal claims, as the following appears from the ICO's guidelines on the processing of specific categories of information:

You must show that the purpose of the processing is to establish exercise or defend legal claims. ‘Legal claims’ in this context are not limited to current legal proceedings. It includes processing necessary for:

actual or prospective court proceedings; obtaining legal advice; or establishing, exercising or defending legal rights in any other way. ”

Complaints have in relation to Article 9 (1) of the Data Protection Regulation 2, letter f, noted that at the time of Norrbom Vinding's establishment of a reporting scheme - and thereby collecting information on e.g. complainant's sexual relationship - no case existed. There was just a desire on the part of TV 2 to clarify whether there were problems with the "culture" on TV 2.

At the start of the investigation, TV 2 and Norrbom Vinding thus had no "suspects" and no reviewers to deal with, advise on or defend against. TV 2 and Norrbom Vinding only had a presumption that through the notification scheme, cases might arise that could be processed. But TV 2 and Norrbom Vinding knew nothing about them in advance, and therefore a kind of "free-rent scheme" was actually made for reviewers without knowing what the reporting scheme would entail.

In relation to this, the complainants have further noted that the pleas in relation to the defense of legal claims from Nordisk Film and the complainants themselves will have completely unacceptable consequences, as data controllers who commit a breach will then be able to process information covered by a breach. , and thus go beyond the general rules of the Regulation.

Furthermore, complaints regarding Norrbom Vinding's allegations concerning the law firm's independent authority in Article 9 (1) of the Regulation have been lodged. 2, letter f, stated that if you follow these assumptions, lawyers will have a completely unique opportunity to conduct similar investigations without having to observe the data protection rules. Such an assumption would also give lawyers a competitive advantage which is not supported and which does not appear to be in line with the Danish Competition and Consumer Authority's report of 14 January 2021, according to which there is a desire to equate lawyers with other advisers. in the competition.

4.1.4.2. The Danish Data Protection Agency's assessment of the application of Article 6 (1) of the Data Protection Regulation Article 9 (1) (f) and Article 9 (1) 2, letter f.

4.1.4.2.1.

The Danish Data Protection Agency first notes that, in the opinion of the Danish Data Protection Agency - in the present case and in similar legal investigation cases - it is Article 6 (1) of the Data Protection Regulation. Article 9 (1) (f) and Article 9 (1) 2, letter f, which depending on the circumstances may constitute the basis for data protection law processing, if a data controller wishes to initiate and carry out an investigation of whether (sexually) offensive acts have been committed or have been committed in the workplace, etc.

Article 6 (1) of the Data Protection Regulation Article 1 (1) (f) states that the processing of personal data may be carried out if the processing is necessary for the data controller or a third party to pursue a legitimate interest, unless the data subject's interests or fundamental rights and freedoms requiring the protection of personal data prior to this.

The provision thus sets out three conditions, all of which must be met in order for the provision to apply:

The processing must pursue the legitimate interest of the data controller or a third party. The treatment must be necessary in relation to the purpose. The interests of the data subject or fundamental rights and freedoms that require the protection of personal data must be weighed against the legitimate interest of the data controller and must not take precedence over that interest.

In relation to the application of the provision, in the opinion of the Danish Data Protection Agency, it is important whether the investigation is initiated on the basis of a presumption of infringement, or whether it is a more “open” investigation that is initiated without such a presumption.

The balance of interests in Article 6 (1) 1, letter f, will, in the opinion of the Danish Data Protection Agency, most often fall out to the data controller's side when there is information prior to the collection of personal data that creates a presumption that infringing acts have been committed.

If an investigation is initiated without the existence of such presumptions, on the basis of a specific assessment based on the available circumstances, there may be a legal basis for processing personal data covered by Article 6 of the Data Protection Regulation. demonstrate that the three-step test provided for in Article 6 (1) 1, letter f, contains, is met.

If there is no basis for processing in Article 6 (1) of the Data Protection Regulation, 1, letter f, the data controller will only be able to carry out an investigation anonymously.

It is clear from Article 9 (1) of the Data Protection Regulation That information covered by Article 9 (2) (f) 1 - e.g. sexual information - can be processed when processing is necessary for legal claims to be established, asserted or defended. The legal claim may, for example, arise from any employment law claims or sanctions that registered persons may encounter in an employment relationship.

It is noted that information on sexually abusive behavior does not necessarily constitute information covered by Article 9 and that in a large number of cases the processing of information on infringement may be carried out solely on the basis of Article 6.

This is in relation to Article 9 (1) of the Data Protection Regulation. 2, f, The Data Inspectorate's view that as a result of the special protection that information covered by Article 9, para. 1, enjoys, stricter requirements must be set for the necessity of including such personal data, including in relation to which group of persons information is processed.

If the data controller considers that he has the necessary authority to collect personal data in accordance with Article 6 (1). 1, letter f, but does not have the necessary basis for processing information covered by Article 9, the Data Inspectorate is of the opinion that the data controller must organize the collection so that no personal data covered by Article 9 is collected, cf. also the principle in the Data Protection Regulation 5 pieces. 1, letter f.

The Danish Data Protection Agency notes that in connection with such an investigation, information may arise which necessitates further investigation and where subsequent collection of information covered by Article 9 could be carried out on the basis of Article 9 (1) of the Regulation. 2, letter f, cf. above.

4.1.4.2.2

In the present case, TV 2, in collaboration with Norrbom Vinding, established a reporting scheme, whereby current and former employees of TV 2 were given the opportunity to report both abusive acts and more general matters related to the culture and cooperation in TV 2, so that the reports could be included in the implementation. of a study of culture in TV 2 - including in the study of cases of possible sexism and abusive acts.

It also appears that no limit was set on how far the investigation could go back in time.

TV 2 and Norrbom Vinding prepared a process description, which stated how reported incidents would be handled. From this it appeared, as stated earlier, that all reports received were screened and divided into two different types.

One type was reports that were about offensive acts that could be in violation of the law, while the other type were reports that were clearly not in violation of the law, but which could relate to the unhealthy culture on TV 2, such as TV 2 wanted to do away with.

Reports divided into the first type were examined in more detail, while reports in the second type were anonymised and passed on to TV 2’s management.

TV 2 and Norrbom Vinding have stated in the case that an investigation was only initiated into reports on "old cases", to the extent that the person who was reported was still employed by TV 2 or was otherwise still part of / linked to TV 2's activities - for example through a partner.

4.1.4.2.3.

The Danish Data Protection Agency initially notes that it is the Data Inspectorate's view that TV 2 pursued a legitimate interest when TV 2 tried to do away with an “unhealthy culture” and when TV 2 wanted to protect TV 2’s employees from abusive actions.

Furthermore, the Danish Data Protection Agency does not find grounds to override TV 2's and Norrbom Vinding's assessment that it was necessary to collect information about a wide range of people in order to investigate (the development of) the culture on TV 2, and that TV 2's legitimate interest in this preceded the data subjects' , including complainants' interests.

It is against this background that the Danish Data Protection Agency's assessment that TV 2 and Norrbom Vinding could collect information on the basis of Article 6 (1). 1, letter f.

However, the Danish Data Protection Agency's assessment is that TV 2 and Norrbom Vinding did not have the necessary security to have a legal basis in Article 9 of the Data Protection Regulation to process the collected personal data when collecting personal data - including the collection of information about sexual relationships. .

The Danish Data Protection Agency must therefore, on the basis of the information in the case, assume that TV 2 and Norrbom Vinding have not tried to limit the collection, so that the collection of information covered by Article 9 only concerned persons whom TV 2 and Norrbom Vinding had a basis for processing information because the persons in question (still) had such a connection to TV 2 that a legal claim (in the form of an employment or contract law sanction) could become relevant, cf. Article 9 (1) of the Data Protection Regulation. 2, letter f.

In this context, TV 2 and Norrbom Vinding have invited TV 2’s current and former employees to provide information covered by Article 9 of the Data Protection Regulation on a larger group of persons than TV 2 and Norrbom Vinding would necessarily have the necessary basis to process such information.

In this connection, the Danish Data Protection Agency notes that it appears that information could be reported, including information covered by Article 9, on persons who were no longer employed or affiliated with TV 2.

On this basis, the Danish Data Protection Agency finds that TV 2's and Norrbom Vinding's approach to the collection of personal data was not in accordance with Article 25 of the Data Protection Regulation, cf. also Article 5 of the Regulation.

Considering that complainants were still connected to TV 2, the Danish Data Protection Agency finds no basis for overriding TV 2's and Norrbom Vinding's assessment of the need to process information about complainants' sexual relationships in order to establish a legal claim, cf. Article 9 (1) of the Data Protection Regulation. . 2, letter f.

Regardless of the fact that the Danish Data Protection Agency generally finds the organization of the investigation - and the consequent collection of personal data - objectionable, the Danish Data Protection Agency does not find grounds to criticize TV 2's and Norrbom Vinding's processing of information about complainants' sexual relations.

5. TV 2’s and Norrbom Vinding’s fulfillment of the disclosure obligation

5.1. Comments of the parties

TV 2 and Norrbom Vinding have stated that it is the opinion of both TV 2 and Norrbom Vinding that the duty of disclosure under Article 14 of the Data Protection Regulation has been complied with in relation to complaints, and that complainants (and the complainants' lawyer) have received sufficient information that processing was complaint information; what information was processed; and how the information was processed.

In this connection, TV 2 and Norrbom Vinding have stated that an e-mail box was set up in relation to the investigation, to which reports could be sent. The mailbox was monitored by Norrbom Vinding, and Norrbom Vinding was therefore in contact with the complainant and the complainant's lawyer. It is TV 2's and Norrbom Vinding's opinion that, given the way in which the investigation was organized, it was natural that Norrbom Vinding fulfilled the duty to provide information for both TV 2 and Norrbom Vinding. It would seem unnatural and unnecessarily formalistic if both Norrbom Vinding and TV 2 were to independently fulfill the duty to provide information.

Complainants were first contacted by Norrbom Vinding on 18 November 2020 via text message, whereby complainants were asked to provide their email address.

The complainant provided his e-mail address and received the same day (18 November 2020) an e-mail with a letter from Norrbom Vinding and a copy of the process description that TV 2 and Norrbom Vinding had prepared for use in the investigation. The process description showed how personal data was processed as a result of the investigation. The autosignature of the e-mail also stated the following:

“Norrbom Vinding processes personal data in connection with our advice and other legal assistance. Further information on data protection and our processing of personal data is available here. ”

The above auto-signature provided a link that led to Norrbom Vinding's data protection policy, which appears on Norrbom Vinding's website. As a result of the present case, the data protection policy has been submitted to the Danish Data Protection Agency.

According to Norrbom Vinding, the data protection policy contains the information that Article 14 of the Regulation requires the data subject - including complainants - to have when information about the person in question is processed. Norrbom Vinding notes in this connection that the link otherwise appeared in all emails that Norrbom Vinding sent to the complainant and the complainant's lawyer, respectively.

TV 2 and Norrbom Vinding have also stated that it is normal for the duty to provide information to be fulfilled by, for example, an e-mail containing a link to where the information pursuant to Article 14 can be found on a website. The following appears from Danske Advokater's "Guide to handling personal data in lawyers' case processing", page 14, about this:

"The duty to provide information can be fulfilled by the lawyer inserting in his car signature a link to a text on the law firm's website that describes the general conditions that include all processing (contact information, deletion policy, rights, etc.)."

TV 2 and Norrbom Vinding have stated that the data protection policy must also be seen in connection with the information that the complainant and the complainant's lawyer received in connection with the correspondence up to the initial meeting on 27 November 2020.

Norrbom Vinding and TV 2 have stated that the complainant's lawyer on 20 November 2020 per. e-mail received an elaboration of the purpose of the study, of which it i.a. appeared:

With reference to your letter of 19 November 2020, I must hereby clarify that the investigation initiated by my client, as a starting point, aims to give former and current employees of TV 2 Danmark A / S (hereinafter TV 2) the opportunity to to report behavior (committed by employees in or partners to TV 2), which according to the law must be considered an offensive act (in the work environment law primarily defined as harassment, sexual harassment or bullying).

The purpose of the investigation, as appears from the prepared process description, is thus to clarify whether it can be used for evidentiary reasons that a conduct has been committed which, according to the law at the time in question, must be regarded as infringing. "

The complainant and the complainant's lawyer were also given an overall description of the content of the two reported episodes prior to the meeting on 27 November 2020.

At the meeting on 27 November 2020, the purpose, process and content of the study were further discussed and explained orally. In this connection, TV 2 and Norrbom Vinding have presented (parts of) the minutes of the meeting in question.

In this connection, TV 2 and Norrbom Vinding have referred to recitals 39 and 60 of the Data Protection Regulation and the Article 29 Working Party 'Guidelines for transparency under Regulation 2016/679', which states that transparency is a well-established part of the EU. law and that it is about building trust in the processes that affect citizens, by enabling them to understand and, if necessary, challenge these processes.

Reference is also made to the Danish Data Protection Agency's "Guidance on the rights of data subjects", page 5, from which the following appears:

The purpose of the data subjects' rights is, among other things, 1) to create transparency about who processes information about the data subjects, 2) to give the data subjects the opportunity to gain insight into what information is processed about them and 3) to give the data subjects the opportunity to demand that incorrect information be deleted, corrected, etc. "

The primary purpose of the duty to provide information must thus, in the opinion of TV 2 and Norrbom Vinding, be that the data subject must be able to understand that personal data about the person in question is being processed; why personal data about the person is processed; and how personal data about the person is processed.

It is the view of TV 2 and Norrbom Vinding that the complainant (and the complainant's lawyer) received information about the processing of information about complaints, which enabled him to fully understand what was investigated, including how information about him was processed.

Finally, it is the opinion of TV 2 and Norrbom Vinding that TV 2 could in all cases fail to fulfill the duty to provide information, cf. Article 14 (1) of the Data Protection Regulation. 5, letter a, as complainants - via Norrbom Vinding - were aware of the information that complainants should have pursuant to Article 14, para. 1-4.

In conclusion, TV 2 and Norrbom Vinding note that in employment law cases - both in the private and public areas - it is customary practice that the employee is only informed of the overall themes prior to the interview, but only during the meeting. details of the circumstances that form the basis of the summons.

Complainants have stated in relation to the duty to provide information that at no time - neither at his summons nor during the later meeting on 27 November 2020 - were complaints made known about the treatment rights and the legal basis that TV 2 and Norrbom Vinding have stated as a background for conducting the study.

Complaints have in this regard elaborated that he has never received information or information that it was obligations under working environment law, the Equal Treatment Act or the Discrimination Act, to which TV 2 and Norrbom Vinding refer, that were the processing basis for the processing of information about him. Nor was the complainant's lawyer at any time made aware of the legal basis of the investigation.

Complainants have further stated that at no time did he receive complete information about the course of the investigation, and that he was therefore not aware of what he participated in / participated in when he agreed to participate in the meeting with TV 2 and Norrbom Vinding on November 27, 2020.

Finally, the complainant has stated that he and his lawyer only received information concerning him, including in particular information about the reported episodes, because the complainant's lawyer insisted on this.

5.2. The Danish Data Protection Agency's assessment of TV 2's and Norrbom Vinding's fulfillment of the duty to provide information

It is clear from Article 14 (2) of the Data Protection Regulation 1, that if personal data has not been collected from the data subject, the data controller shall provide the data subject with the following information:

the identity and contact details of the controller and his / her representative, if any, the contact details of any data protection adviser, the purposes of the processing for which the personal data are to be used and the legal basis for the processing the data controller intends to transfer personal data to a recipient in a third country or international organization and whether the Commission has decided on the adequacy of the level of protection, or in the case of transfers under Article 46 or 47 or Article 49 (2); 1, second subparagraph, point (h), reference to the necessary or appropriate guarantees and how a copy can be obtained or where they have been made available.

According to Article 14 (1) of the Regulation 2, the data controller shall, in addition to the information set out in para. 1, provide the following information necessary to ensure fair and transparent processing in respect of the data subject:

the period during which the personal data will be stored or, if this is not possible, the criteria used to determine that period the legitimate interests pursued by the controller or a third party if the processing is based on Article 6 (1); (F) the right to request the data controller access to and rectification or deletion of personal data or restriction of processing concerning the data subject and to object to processing, as well as the right to data portability when processing is based on Article 6 (1). Article 9 (1) (a) or Article 9 (1) 2 (a), the right to withdraw consent at any time, without prejudice to the lawfulness of consent-based processing, before its withdrawal, the right to lodge a complaint with a supervisory authority from which source the personal data originate, and if so; whether they come from publicly available sources, the existence of automatic decisions, including profiling, as referred to in Article 22 (1); 1 and 4, and in these cases at least meaningful information about the logic therein as well as the significance and the expected consequences of such processing for the data subject.

Article 14 (1) of the Regulation 3, it further follows that the data controller must provide the information pursuant to para. 1 and 2:

within a reasonable time after the collection of the personal data, but no later than within one month, taking into account the specific conditions under which the personal data are processed if the personal data are to be used to communicate with the data subject, at the latest at the time of first communication with the data subject; , or if the personal data is intended to be passed on to another recipient, at the latest when the personal data is first passed on.

Pursuant to Article 12 (1) of the Data Protection Regulation 1, the data controller shall take appropriate measures to provide any information as referred to in, inter alia, Article 14 of the Regulation on processing to the data subject in a concise, transparent, easy-to-understand and easily accessible form and in a clear and simple language. The information must also be provided in writing or by other means, including, if appropriate, electronically. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is verified by other means.

It is the Data Inspectorate's opinion that TV 2 and Norrbom Vinding in the specific case could arrange the cooperation so that Norrbom Vinding could fulfill the duty to provide information pursuant to Article 14 of the Regulation on behalf of TV 2 and Norrbom Vinding itself.

In the opinion of the Danish Data Protection Agency, however, it places additional demands on the transparency and comprehensibility of the duty to provide information in particular to arrange a collaboration in this way.

It is the Data Inspectorate's assessment that TV 2 and Norrbom Vinding have not complied with the duty to provide information to complainants in accordance with Article 12 (1) of the Data Protection Regulation. 1 and Article 14.

In relation to Article 14 of the Regulation, the Danish Data Protection Agency has emphasized that complainants did not receive sufficient information to comply with TV 2's and Norrbom Vinding's obligations pursuant to Article 14 (1). 1-4, can be considered fulfilled.

In this connection, the Danish Data Protection Agency has emphasized that the process description, which the complainants received via e-mail on 18 November 2020, did not address complaints, but rather the persons who reported information to Norrbom Vinding and TV 2. This can be seen, among other things. .a. know that the process description begins with the sentence: "What is the further process when you have sent a report or inquiry to Norrbom Vinding and TV 2?"

The process description thus only contained information on how received reports and information on the reporters in question were to be handled, just as the process for how Norrbom Vinding and TV 2 would investigate reported conditions was outlined.

Although the process description contained general information about the investigation process, it did not contain information which concerned or addressed complaints specifically, or which could otherwise clarify the purpose of the investigation in more detail to complainants, including why information about him was collected as part of the investigation. .

Thus, the description of the proceedings did not contain any information that could constitute a notification under Article 14 of the Data Protection Regulation in relation to complaints - or in relation to others who were the subject of the investigation.

The Danish Data Protection Agency has also emphasized that Norrbom Vinding's data protection policy, which was referred to via a link in Norrbom Vinding's e-mail signature, could not, in the opinion of the Data Inspectorate, be considered independently or in connection with the process description. complaints.

In assessing this, emphasis is placed on the fact that the data protection policy is formulated in general and overall, and that the policy only in short, general terms affects the processing basis (s) that form the basis for Norrbom Vinding's processing of personal data in general - and thus neither TV 2's or Norrbom Vinding's processing of information about complainants, including information about complainants' sexual relationships.

As a result, complainants received i.a. insufficient information on the legal basis of the processing referred to in Article 14 (2); 1, letter c, as Norrbom Vinding in the initial inquiries to complaints only referred to what according to the "legislation" can be considered infringing acts.

In the opinion of the Danish Data Protection Agency, it is irrelevant in this connection that the complainant's lawyer received a (partially) detailed email on 20 November 2020 in relation to the legal basis, which stated that “… must be considered an infringing act (in the working environment law) primarily defined as harassment, sexual harassment and bullying) ”. In this connection, the Danish Data Protection Agency notes that the information was provided at the request of the complainant's lawyer - and thus not actively by either Norrbom Vinding or TV 2 - just as the legal basis was only clarified to a lesser extent.

In the Data Inspectorate's view, the scope of the processing, the intrusive nature and the age of the personal data place stricter requirements on the clarity and transparency of the data.

In the opinion of the Danish Data Protection Agency, this means, among other things, that complainants should have received detailed information pursuant to Article 14 (1). 2, letter b, so that complainants were given the opportunity to find out which legitimate interests TV 2 and Norrbom Vinding based the processing of information about him on, just as complainants should have received information about the balance of interests that TV 2 and According to Article 6 (1) of the Data Protection Regulation, Norrbom Vinding had 1, letter f.

The Danish Data Protection Agency notes that a consequence of the missing and / or deficient information about the legal basis and the associated balancing of interests, e.g. was that complainants were barred from exercising their right to object under Article 21 (1) of the Data Protection Regulation. 1.

Finally, the Danish Data Protection Agency has emphasized that the subsequent e-mail correspondence with the complainant's lawyer only contained a (minor) elaboration of the legal basis. The e-mail correspondence, which mainly concerned practical considerations in relation to the meeting on 27 November 2020, did not provide complainants with further information on how information about him was processed and what legitimate interests, etc. that formed the basis of the study.

In summary, the Danish Data Protection Agency's assessment is that the process description, Norrbom Vinding's data protection policy and the subsequent e-mails to the complainant's lawyer, neither collectively nor individually meet the requirements for the duty to provide information pursuant to Article 14 of the Data Protection Regulation.

In relation to Article 12 (1) of the Data Protection Regulation, the Danish Data Protection Agency has 1, emphasized that the information was not given in a clear and simple language, as it i.a. was unclear what the exact purpose of the study was and that it was therefore not clear what possible consequences the study might have.

Overall, the Danish Data Protection Agency's assessment is that Norrbom Vinding's approach cannot be considered to be in accordance with the requirement in Article 12 (1) of the Data Protection Regulation. 1, that all information pursuant to Article 14 shall be provided in a concise, transparent, easy-to-understand and easily accessible form and in a clear and simple language.

In conclusion, it is noted that since neither the complainant nor the complainant's lawyer received information as required by Article 14 of the Regulation, TV 2 could not fail to fulfill its duty to provide information pursuant to Article 14 (1). 5, letter a.

6. The Danish Data Protection Agency's overall assessment

In summary, the Danish Data Protection Agency is of the opinion that TV 2 pursued a legitimate interest in connection with the initiated investigation.

The Danish Data Protection Agency does not find grounds to override TV 2's and Norrbom Vinding's assessment that it was necessary to collect information about a wide range of people to investigate (the development of) the culture on TV 2, and that TV 2's legitimate interest in this took precedence over those registered, including complainants, interests.

It is against this background that the Danish Data Protection Agency's assessment that TV 2 and Norrbom Vinding could collect information on the basis of Article 6 (1) of the Data Protection Regulation. 1, letter f.

However, the Danish Data Protection Agency's assessment is that TV 2 and Norrbom Vinding did not have the necessary security to have a legal basis in Article 9 of the Data Protection Regulation to process the collected personal data when collecting personal data - including the collection of information about sexual relationships. .

On this basis, the Danish Data Protection Agency finds that TV 2's and Norrbom Vinding's approach to the collection of personal data was not in accordance with Article 25 of the Data Protection Regulation, cf. also Article 5 of the Regulation.

It is the Data Inspectorate's assessment that the processing of information on complaints, including information on complainants' sexual relationships, could not - as claimed by TV 2 and Norrbom Vinding - be carried out within the framework of Article 6 (1) of the Data Protection Regulation. 1, letter c, the Data Protection Act § 7, para. Article 9 (2) of the Data Protection Regulation 2, letter b, or section 12 of the Data Protection Act.

Taking into account that complainants were still connected to TV 2, the Danish Data Protection Agency does not find grounds to override TV 2's and Norrbom Vinding's assessment of the need to process information about complainants' sexual relationships in order to establish a legal claim, cf. Article 9 of the Data Protection Regulation. PCS. 2, letter f.

Regardless of the fact that the Danish Data Protection Agency generally finds the organization of the investigation - and the consequent collection of personal data - objectionable, the Danish Data Protection Agency does not find grounds to criticize TV 2's and Norrbom Vinding's processing of information about complainants' sexual relations.

Finally, the Danish Data Protection Agency is of the opinion that TV 2 and Norrbom Vinding have not notified complaints in accordance with Articles 12 and 14 of the Data Protection Regulation.

Collectively, TV 2’s and Norrbom Vinding’s collection of personal information and failure to comply with the duty to provide information provide the Danish Data Protection Agency with a basis for expressing serious criticism.



[1] The article Sexism investigation on TV 2 will also be able to include old cases, which were published on journalisten.dk on 24 September 2020.

[2] TV2’s and Norrbom Vinding’s statement of 22 April 2021 to the Danish Data Protection Agency, page 5 f.

[3] The Danish Bar Association's guide “The lawyer's processing of personal data”, revised February 2019, page 16.

[4] Danske Advokater's "Guide to handling personal data in lawyers' case processing", page 5.

[5] The Danish Working Environment Authority's executive order no. 1234 of 29 October 2018 on the performance of work with subsequent amendments.

[6] The Danish Working Environment Authority's executive order no. 1406 of 26 September 2020 on mental working environment.

[7] Korfits Nielsen and Lotterup, 2020, page 1019

[8] U.2016.3097V and the judgment of the Western High Court of 12 May 2009 in case 2528-08.

[9] LFF No. 68 of 25 October 2017.

[10] U.2019.3302Ø

[11] Bill No. L 68, Bill on Supplementary Provisions to the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Act).

[12] The UK Data Protection Authority.
@@ Line 66: / Line 66: @@
 Controllers are TV 2 Danmark A/S (a public TV station) and Norrbom Vinding I/S (a law firm). In September 2020, TV 2 launched an investigation into the unhealthy (sexist) culture at the TV station. It asked the help of law firm Norrbom Vinding, and asked past- and present employees to report infringements and share their experiences with the sexist culture at TV 2. The TV station then received two reports on the data subject, with allegations regarding sexual misconduct. After investigating the matter, TV 2 decided that data subject could no longer host any TV shows on the station.
-Data subject then held that there were no concrete facts that justified the investigation of TV 2. Moreover, they found that, since they did not explicitly consent to any processing, TV 2 and Norrbom Vinding processed their sensitive personal data without a legal basis. They then filed a complaint with the DPA.
+Data subject argued that there were no concrete facts that justified the investigation of TV 2. Moreover, they found that, since they did not explicitly consent to any processing, TV 2 and Norrbom Vinding processed their sensitive personal data without a legal basis. Hence, they filed a complaint with the DPA.
 === Holding ===
-First, the DPA assessed the general legal basis. It found that TV 2 and Norrbom Vinding could not rely on [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]], when processing data subject’s personal data, since “''the legal obligations laid down in the health and safety and discrimination law to which TV 2 and Norrbom Vinding refer do not appear sufficiently clear and precise to be used as a basis for processing within the scope of [[Article 6 GDPR#1c|Article 6(1)(c)]]''”. However, the DPA stated that the controller could rely on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], because the objective of the investigation “ending unhealthy culture” was legitimate. Moreover, the DPA found that this objective overrode the interests of data subject.
+First, the DPA assessed the general legal basis. It found that TV 2 and Norrbom Vinding could ''not'' rely on [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]], when processing data subject’s personal data, since the legal obligations laid down in the health and safety and discrimination law are ''not sufficiently clear and precise'' to be used as a basis for processing within the scope of [[Article 6 GDPR#1c|Article 6(1)(c)]]. However, the DPA stated that the controller ''could'' rely on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], because the objective of the investigation “ending unhealthy culture” was legitimate, and this objective overrode the interests of data subject.
-Secondly, the DPA noted that the controllers could not rely on the exception laid down in [[Article 9 GDPR#2b|Article 9(2)(b) GDPR]], because “''the rules on health and safety at work to which TV 2 and Norrbom Vinding refer are not sufficiently clear and precise to be able to provide a basis for dealing with information about the sexual relations of complainants in the present case''.” Moreover, although the purpose of the processing was legitimate, the DPA found that the controllers could also not rely on [[Article 9 GDPR#1f|Article 9(1)(f) GDPR]]. The DPA found that, because the collection of sensitive personal data was not restricted sufficiently, and concerned also persons that no longer worked at the station, the processing of sensitive data on those persons was not necessary for a legal claim (such as an employment or contractual sanction). Hence, the DPA concluded that TV 2 and Norrbom Vinding had processed the sensitive personal data without a legal basis.
+Secondly, the DPA noted that the controllers could not rely on the exception laid down in [[Article 9 GDPR#2b|Article 9(2)(b) GDPR]]. Again, because the legal obligations laid down in the health and safety and discrimination law are ''not sufficiently clear and precise.'' Moreover, although the purpose of the processing was legitimate, the DPA found that the controllers could also not rely on [[Article 9 GDPR#1f|Article 9(1)(f) GDPR]]. The DPA considered that, because the collection of sensitive personal data was not restricted sufficiently, and concerned also persons that no longer worked at the station, the processing of sensitive data on those persons was not necessary for a legal claim (such as an employment or contractual sanction). Hence, the DPA concluded that TV 2 and Norrbom Vinding had processed the sensitive personal data without a legal basis.
 Finally, the DPA considered that TV 2 and Norrbom Vinding had not informed the data subject about the processing within the investigaion in accordance with [[Article 12 GDPR|Article 12]] and [[Article 14 GDPR]], since the information was not provided in a clear and simple language. It was unclear, inter alia, what the precise purpose of the investigation was and, therefore, it was not clear what possible consequences the investigation might have had.