Datatilsynet (Denmark) - 2021-32-2096
From GDPRhub
| Datatilsynet (Denmark) - 2021-32-2096 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 6 GDPR Article 6(1)(e) GDPR Article 9 GDPR Article 9(2)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 19.01.2022 |
| Fine: | None |
| Parties: | Danish Civil Service (Civilstyrelsen) |
| National Case Number/Name: | 2021-32-2096 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Danish |
| Original Source: | Datatilsynet (in DA) |
| Initial Contributor: | Giel Ritzen |
The Danish DPA (Datatilsynet) expressed serious criticism to the Danish Civil Service for processing sensitive personal data, although this was not necessary, in violation of Article 6 and Article 9 GDPR.
English Summary
Facts
Controller is the Danish Civil Service, a public institution responsible for the payment of compensation to injured parties that are eligible to receive compensation pursuant to the Danish Victims Compensation Act. According to the same act, the Civil Service can make a claim against the offender for them to bear (in whole or in part) the costs. However, the Civil Service must present evidence to the offender as to why the offender must bear the costs of compensation.
Data subject is a person that was eligible for compensation, and had a restraining order against the offender that injured them in an assault. They found out that the Civil Service passed deeply confidential information (including health data) about them to the offender (who asked for evidence), such as information on their new school, conversations with their psychologist, and a forensic examination of them. Hence, they filed a complaint with the DPA.
Holding
The DPA upheld the complaint.
It considered that the Civil Service’s processing of health data may be processed if this is necessary for the handling of legal claims such as the redress claim against the offender, pursuant to Article 9(2)(f) GDPR. Moreover, it noted that the processing of personal data by the Civil Service for such claims may be processed pursuant to Article 6(1)(e) GDPR, since they are performing a task in the public interest. However, the processing must be necessary. The DPA found that some of the disclosed information was not really necessary for the offender to relate to the claim of damages. Moreover, the DPA stipulated that, since the case concerned sensitive data (health data) and the data subject had a restraining order against the offender, it was particularly important that the data subject’s personal data was necessary to disclose. Since this was not the case, the DPA concluded that the Civil Service violated Article 6 and Article 9 GDPR.
The DPA expressed serious criticism to the Civil Service for the violations, but did not impose a fine. It noted that the Civil Service had implemented organisational measures to prevent such a violation in the future.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
Serious criticism of the Danish Civil Agency for passing on personal information Date: 19-01-2022 Decision Public authorities The Danish Data Protection Agency has expressed serious criticism that the National Board of Health and Welfare in a specific case passed on unnecessary information about an injured party to the tortfeasor. Journal number: 2021-32-2096 Summary The Danish Data Protection Agency has made a decision in an appeal case, where the Danish Civil Agency in connection with the processing of a recourse case passed on information about the injured party to the tortfeasor in the case. The National Board of Health and Welfare stated to the Danish Data Protection Agency that the National Board of Health and Welfare must be able to prove to the tortfeasor that there is a claim for damages against him and that there is a causal link between the criminal act committed by the tortfeasor and the compensation paid to the injured party, including the amount of compensation. It was therefore necessary to pass on information about the injured party to the tortfeasor. At the same time, however, the National Board of Health and Welfare stated that certain information had not been necessary to pass on in order for the tortfeasor to be able to relate to the claim and therefore should have been exempted. The Danish Data Protection Agency agreed with this assessment and noted that in a case such as this, it is particularly important to be aware that only information about the injured party is passed on to the tortfeasor, which is necessary for the processing of the recourse case. On that basis - after the case had been considered by the Data Council - the Danish Data Protection Agency found reason to express serious criticism that the National Board of Health and Welfare had passed on information about injured parties to the tortfeasor, which was not necessary to pass on. With regard to the other information about the injured party who had been passed on to the tortfeasor, the Danish Data Protection Agency did not find sufficient grounds to override the National Board of Health and Welfare's assessment that the information was necessary to pass on in order for the tortfeasor to comply with the recourse claim. Decision After the case has been considered by the Data Council, the Danish Data Protection Agency finds that there are grounds for expressing serious criticism that the Danish Civil Agency passed on certain information to the tortfeasor who was not required to disclose, and that the disclosure did not take place within the framework of the Data Protection Ordinance [ 1]. On the other hand, the Danish Data Protection Agency does not find sufficient grounds to override the National Board of Health and Welfare's assessment that the other information could be passed on to the tortfeasor within the framework of the Data Protection Ordinance. Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision. 2. Case presentation Processing of compensation cases As a result of the Victims' Compensation Act [2], the state provides compensation and indemnity for personal injury and in certain cases for property damage caused by violation of civil law or the law on detention, restraining order and expulsion. The decision on compensation, etc. taken by the Compensation Board. If the Compensation Board makes a decision to grant compensation, the case is forwarded to the National Board of Health and Welfare, which then, on behalf of the state, is responsible for the payment of the amount of compensation to the injured party. The state also intervenes in the injured party's claim against the tortfeasor (the recourse claim), cf. section 17 of the Victims' Compensation Act, and the state can therefore direct a claim against the tortfeasor with a view to the latter fully or partially finally bearing the expenses paid by the Treasury. The National Board of Health and Welfare decides on all issues concerning recourse with the tortfeasor, cf. circular letter of 21 December 2021 [3]. In a circular letter of 24 February 1998 on the processing of recourse cases when paying compensation from the state to victims of crime, the Ministry of Justice addressed some administrative law issues in connection with recourse cases and described in more detail how recourse cases against a tortfeasor should be handled. The circular letter is addressed to the police, who were responsible for the processing of recourse cases before the Danish Civil Agency took over the area, but according to the Danish Civil Agency, the letter still forms the basis for the processing of recourse cases. The following appears i.a. of the circular letter: ”[…] It is the view of the Ministry of Justice that the Chief of Police (the Director of Police) - in cases where the injured party's claim for compensation from the tortfeasor has not been decided by judgment - is neither obliged nor entitled to have the compensation assessment made by the Compensation Board untested. as a basis in the recourse case. This applies regardless of whether the tortfeasor has objected to the board's tort law assessment or not. The Chief of Police (the Director of Police) is thus obliged to make an individual assessment of whether recourse claims should be made against the perpetrator. In the decision of the Chief of Police (the Director of Police) on whether the case is to be prosecuted in relation to the tortfeasor, the general rules of Danish law on the tortfeasor's liability apply, cf. section 6 a of the Act. In the opinion of the Ministry of Justice, cases of recourse against the tortfeasor are not decision cases within the meaning of the Public Administration Act, which is why the provision on hearing parties in section 19 of the Public Administration Act does not apply. In the Ministry of Justice's guide to the Public Administration Act (1986), p. 105, states, however, that a hearing of the parties should also be held in cases where there is no legal obligation to do so. This applies "where the party is deemed to have some interest in having the opportunity to see and possibly comment on the basis for the decision, unless the consideration of public or other private interests speaks against it". The tortfeasor is not considered a party to the Compensation Board's case and, according to the information provided, as an overriding general rule, does not in practice on any other basis have an opportunity to comment to the board. On that basis, it must be assumed that the tortfeasor is not normally aware that a case has been pending before the Compensation Board. The Chief of Police (the Director of Police) should therefore generally give the offender an opportunity to make a statement before the Chief of Police (the Director of Police) decides whether to bring recourse against the offender. If the Chief of Police (the Director of Police) in this connection finds it necessary to disclose confidential information about injured parties, such disclosure cannot, in the opinion of the Ministry of Justice, be considered unjustified under section 152 of the Criminal Code. Cases of recourse against the tortfeasor should thus be dealt with in accordance with the following guidelines: ”1. If the injured party's claim for compensation and compensation from the tortfeasor is determined by judgment, and the Compensation Board has decided to provide compensation with the amount determined by the judgment, the claim is sought to be recovered - if necessary with the help of the bailiff's court, cf. . 1, no. 1. If the decision on compensation for the injured party is made by the Compensation Board, the tortfeasor is generally requested for an opinion before the chief of police (the police director) decides after a specific assessment whether a recourse claim should be made against the tortfeasor. For the purpose of the Chief of Police's decision on the question of recourse, the Compensation Board sends a copy of the case files which the police already hold. The decision on full or partial waiver of a recourse claim on the basis of information about the perpetrator's financial circumstances is made as before by the Chief of Police (the Director of Police). As usual, remission should only take place if it has been established by exhaustive legal proceedings that recovery is completely or partially excluded, or if it has been established through financial questioning of the tortfeasor by the police or in another reassuring way that the recourse claim must be considered complete or partly irrecoverable. " The facts of the case It appears from the case that on 29 January 2021 [the injured party] was awarded compensation by the Compensation Board. The National Board of Health and Welfare then dealt with the issue of recourse with the tortfeasor. In this connection, the Danish Civil Agency sent a letter to the tortfeasor on 10 February 2021, informing him of the case. The tortfeasor requested on 12 February 2021 to receive documentation for the recourse case. On 18 February 2021, the Danish Civil Agency complied with the request for disclosure of information. In addition to 135 pages of judgment and court books, the Board handed over 68 pages from the recourse case. In the 68 pages, a number of information was excluded, but information continued to appear about e.g. the victim's new school, her conversations with a psychologist and the forensic examination of her. On 22 February 2021, the tortfeasor applied for access to the entire recourse case. On 3 March 2021, the Danish Civil Agency rejected this request. By letter dated 22 March 2021, the National Board of Health and Welfare announced to the tortfeasor that the agency had decided to collect the amount of compensation paid to the injured party from the tortfeasor. 2.1. Complainant's remarks Complainants have generally stated that deeply confidential information about her and her family has been passed on to the tortfeasor. In the complainant's view, the consideration of the State's recourse case cannot override the consideration of the injured party. In connection with the recourse case, the tortfeasor has received information about the injured party and his family, which the tortfeasor should never have had access to, including with reference to the nature of the case and what the tortfeasor has exposed the injured party to. Furthermore, the tortfeasor has been in police custody against the whole family for five years, and the injured party carries an assault alarm. Complainants have stated that information about the injured party's absence records and general information about school changes, that she receives trauma therapy and has had crisis interviews, and that there were no competing causes of injury, would have been enough to document the National Board of Health and Welfare's claims. It was thus not necessary to pass on all the other information. Complainants have further stated that conversations with a psychologist and conversations in connection with pediatric examinations are deeply confidential conversations that the tortfeasor is not entitled to know about. In addition, information on e.g. name and address of psychologists, the name of the injured party's new school, the street name where the family lives, forensic examination and information about the family, including the parents' workplace, have not been handed over to the tortfeasor. Furthermore, according to the complaints, the injured party's case is unusually serious, and for this reason the National Board of Health and Welfare should have deviated from giving the tortfeasor an opportunity to make a statement, as decisive considerations for the injured party must take precedence over the tortfeasor's interests. Complainants have finally stated that the tortfeasor's lawyer was refused access to the remaining documents in the case, referring to the fact that the information was not relevant to the case and that the tortfeasor's interest in becoming aware of the information was deemed to give way to crucial considerations. to private interests. However, the remaining documents had an equally private content as the information that the Danish Civil Agency had already provided, which is why it is striking that the Danish Civil Agency suddenly refused. 2.2. The Danish Civil Agency's comments The Danish Civil Agency has stated that in recourse cases, the agency must make an independent legal assessment of whether the tort law conditions for making claims against the tortfeasor have been met, and this must be documented against the tortfeasor. The National Board of Health and Welfare must thus, among other things, be able to prove to the tortfeasor why the Agency makes the claim against him (the basis of liability) and that there is a causal link between the tortfeasor's actions (the criminal act) and the compensation paid to the injured party, including the amount of compensation and compensation paid . The National Board of Health and Welfare handles cases of recourse in a two-stage process. In the first contact with the tortfeasor, the Danish Civil Agency presents the state's requirements and the documentation in a summary format, ie. without disclosing the specific information. Only if the tortfeasor then requests to receive underlying documentation, this is handed out according to the circumstances. In this connection, only the confidential information about the injured party that the National Board of Health and Welfare deems necessary is necessary to be able to lift the burden of proof in a civil lawsuit. The National Board of Health and Welfare has also referred to the fact that it follows from the Ministry of Justice's circular letter of 24 February 1998 that disclosure of confidential information cannot be considered unjustified under section 152 of the Criminal Code if the recourse authority deems the disclosure necessary. Disclosure of confidential information is thus justified if it is considered necessary to be able to document the claim and thereby lift the burden of proof against the tortfeasor. The Danish Civil Agency exempts confidential and sensitive personal data to the extent that the information is not necessary to lift the burden of proof. Thus, in the present case, the National Board of Health and Welfare has exempted several pieces of information which were assessed by the board as confidential, sensitive and / or unnecessary for the board's possibilities to lift the burden of proof in the recourse case against the tortfeasor. The National Board of Health and Welfare has also stated that the board - in cases where the tortfeasor does not pay the recourse claim made or enters into a voluntary settlement - decides whether the tortfeasor must be sued for a judgment for the recourse claim. In the civil action, it will be necessary for the Danish Civil Agency to present the evidence on which the state's recourse claim is based, including sensitive information about the injured party, as this information is of decisive importance for the nature and size of the claim. By letter dated 21 December 2020, the National Board of Health and Welfare is authorized by the Ministry of Justice to make a decision on all issues concerning recourse with a tortfeasor. It is against this background that the National Board of Health and Welfare's assessment that the Agency can legally process personal data, cf. Article 6, subsection 1, letter e, as the processing is necessary for the performance of a public authority task. It is also the Civil Agency's assessment that the agency can process special categories of information, including health information, when the processing is necessary for a legal claim to be determined, asserted or defended, cf. Article 9 (1) of the Data Protection Ordinance. 2, letter f. It is the Civil Agency's assessment that, in general, there has been lawful processing of personal data in the present case. The National Board of Health and Welfare has stated that the injured party was awarded [x] by the Compensation Board's decision of 29 January 2021, and it therefore requires a lot of material and information before such a claim is sufficiently documented on the basis of a long sick leave. The National Board of Health and Welfare handed over to the tortfeasor, among other things. a final note from Børnehuset [x], a psychological statement, a pediatric examination, information that the family received family treatment, and information about the injured party's ability to function at school. In the documents provided, a number of pieces of information were excluded, which were not necessary for the tortfeasor to be able to relate to the recourse claim. It is the Danish Civil Agency's assessment that the agency's disclosure of the documentation was necessary to lift the burden of proof for the tortfeasor's liability. The documents thus contained relevant information about the injured party's period of illness as well as information that the injured party was subject to treatment and was part of a family treatment course solely as a result of the incidents. Information about the injured party's ability to function at school as a result of the incidents as well as the forensic examination were also included as part of the injured party's overall picture of the illness. The disclosure of information about the injured party's life and state of health before the incident was also necessary to lift the burden of proof for the tortfeasor's liability as well as the causal link between the incidents and the injured party's sick leave. The information revealed that the injured party was functioning normally before the incident. The National Board of Health and Welfare thus assessed that, on the basis of the information, it could be concluded that the injured party's period of illness and treatment was only a result of the perpetrator's actions. Furthermore, the National Board of Health and Welfare's assessment is that information about the injured party's absence overview, and that she received crisis help, would not in itself be sufficient evidence that the injured party's sick leave was solely a result of the injured party's actions. An absence overview documents that the injured party has been on sick leave, but not that the injured party has only been on sick leave as a result of the incident in question. It is therefore the Danish Civil Agency's assessment that the agency would not be able to lift the burden of proof for the tortfeasor's liability, including the causal link between the injured party's sick leave and the tortfeasor's actions and the amount of compensation if only this information had been disclosed. The injured party's psychologists' name and address information and the name of the injured party's new school were not exempted in the documents handed out to the tortfeasor. Based on the context of the case, including in particular if the National Board of Health and Welfare had been in possession of information about the injured party's police presence against the tortfeasor in connection with the case, the agency finds that the information should have been excluded as it was not necessary for the tortfeasor to comply with the recourse claim. . The National Board of Health and Welfare notes that it was not aware that the tortfeasor had a police arrest against the injured party before the agency received an inquiry from Jyllands-Posten in May 2021, and after the documentation for the recourse claim had been sent to the tortfeasor in mid-February 2021. It is also the Civil Agency's assessment that information about the injured party's mother and sister's first name, information about the parents' positions and information that the mother was on sick leave were not necessary for the tortfeasor to relate to the recourse claim. The Danish Civil Agency therefore considers that the information should have been exempted from the documents that were handed over to the tortfeasor. The material handed out to the tortfeasor also states the street name where the injured party's family lives. At the same time, however, it appears from [x] that the crime scene was in the vicinity of the injured party's residence with the mention of the specific address. It is against this background that the National Board of Health and Welfare's assessment that the information about the injured party's residence could have been deleted in the handed out material, as they were not necessary for the tortfeasor's position on the recourse claim, but the agency did not find this . The National Board of Health and Welfare has also stated that, as a result of the present case, it has subsequently changed its internal guidelines for processing a tortfeasor's request for disclosure of documentation of the state's recourse claim against him. In future, the Agency will thus have increased its focus on providing only the information to the tortfeasor that is necessary for the tortfeasor to be able to relate to the claim raised. The Board will also focus on the fact that certain types of information that are not in themselves confidential or sensitive are always excluded. This applies i.a. addresses, e-mail addresses and telephone numbers of e.g. professionals and subsidiaries. In addition, the Danish Civil Agency has updated the notification on the processing of personal data in victim compensation cases to ensure that there is no doubt about the rules for handing out documentation to the tortfeasor, and to ensure that injured parties applying for compensation are aware that the state may be forced to provide the tortfeasor with personal data in order to be able to document the state's claims against the tortfeasor, e.g. documentation that you have been ill in the form of medical records and statements, notes from psychologist interviews, etc. Justification for the Danish Data Protection Agency's decision 3.1. Pursuant to Article 9 (1) of the Data Protection Regulation 1, there is a ban on the processing of special categories of personal data, including health data. If one of the circumstances in Article 9 (1) 2, letters a-j, apply, however, the prohibition does not apply. As a result of Article 9 (1) of the Data Protection Regulation Information covered by Article 9 (2) (f) may be covered by Article 9 (2). 1, is processed if the processing is necessary for legal claims to be determined, asserted or defended. In that regard, recital 52 in the preamble to the Regulation states that the derogation should make it possible to process such personal data, if necessary, in order for legal claims to be established, asserted or defended, whether in connection with a lawsuit or a administrative or extrajudicial proceedings. The processing of personal data is in accordance with Article 6 (1) of the Data Protection Regulation. 1, only lawful if and to the extent that at least one of the conditions in letters a-f applies. It follows from Article 6 (1) of the Data Protection Regulation 1, letter e, that personal data may be processed if the processing is necessary for the purpose of performing a task in the interest of society, or which falls within the exercise of public authority, which has been imposed on the data controller. The Danish Data Protection Agency assumes that the National Board of Health and Welfare needed to pass on information about the injured party to the tortfeasor in order to assess whether a recourse claim should be raised against the tortfeasor. However, in connection with the processing of the complaint by the Danish Data Protection Agency, the National Board of Health and Welfare has assessed that several of the information that was passed on was not really necessary for the tortfeasor to relate to the claim, including certain information about the injured party's family and information about the injured party's new school. . The Danish Data Protection Agency agrees that this information was not necessary to pass on in order for the tortfeasor to relate to the recourse claim. In this connection, the Danish Data Protection Agency notes that in the present case - where both the information is sensitive and the perpetrator had a police presence against the injured party and her family - it is particularly important to be aware that only information about the injured party is passed on. to the tortfeasor, which are necessary for the processing of the recourse case. Against this background, the Danish Data Protection Agency finds reason to express serious criticism that the National Board of Health and Welfare disclosed information to the tortfeasor that was not necessary to disclose, and that the disclosure did not take place within the framework of the Data Protection Ordinance [4]. And Article 6 (2). 1. In this connection, the Danish Data Protection Agency has noted that the National Board of Health and Welfare has stated that, on the basis of the present case, it has changed its internal guidelines for processing a tortfeasor's request for documentation of the state's recourse against him, and that the agency will in future have increased focus on , that only the information to the tortfeasor that is necessary for the tortfeasor to relate to the claim raised is provided. The Danish Data Protection Agency has also noted that the Danish Civil Agency has stated that the agency has clarified its notification of the processing of personal data in victim compensation cases, e.g. to ensure that the injured party applying for compensation is aware that there is a likelihood that the state will be forced to provide the tortfeasor with personal information about the injured party. 3.2. With regard to the other information that the National Board of Health and Welfare disclosed to the tortfeasor, the Danish Data Protection Agency does not find sufficient grounds to override the Agency's assessment that the information was necessary to disclose in order for the tortfeasor to relate to the recourse claim. In this connection, the Danish Data Protection Agency has emphasized that the Danish Civil Agency has stated that the agency must be able to prove to the tortfeasor that there is a claim for damages against him and that there is a causal link between the criminal act and the compensation paid, including the amount of compensation with which the disclosure of the information was necessary for the Civil Agency to assess whether a legal claim could be determined, asserted or defended, cf. Article 9 (1) of the Data Protection Ordinance. 2, letter f. The Danish Data Protection Agency has also emphasized that the Danish Civil Agency by circular letter of 21 December 2020 is required on behalf of the state to make a decision on recourse against the tortfeasor, including so that the injured party does not have to contact the tortfeasor to pursue the claim against him. was necessary for the performance of this task in accordance with Article 6 (2) of the Data Protection Regulation. 1, letter e. [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation). [2] Statutory Order no. 1209 of 18 November 2014, as last amended by Act no. 486 of 30 April 2019 (the Victims' Compensation Act) [3] Circular letter no. 10059 of 21 December 2021 on circular letter to the National Board of Health and Welfare and the police on amended business catch regarding payment and recourse of compensation from the state to victims of crime. [4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation).
