Datatilsynet (Denmark) - 2019-32-0639: Difference between revisions

From GDPRhub
No edit summary
Line 70: Line 70:
The decision below is a machine translation of the original. Please refer to the Danish original for more details.<pre>
The decision below is a machine translation of the original. Please refer to the Danish original for more details.<pre>


Arbejdsmarkedets Feriefonds iagttagelse af oplysningspligt og brug af samtykke
The Labor Market Holiday Fund's observance of the obligation to provide information and the use of consent
Publiceret 20-12-2019
Published 20-12-2019
Afgørelse Private virksomheder
Decision Private companies


Datatilsynet udtaler alvorlig kritik af Arbejdsmarkedets Feriefond, fordi fonden bl.a. ikke i tilstrækkeligt omfang iagttog sin oplysningspligt i forbindelse med fondens behandling af en konkret sag om udbetaling af feriepenge.
The Data Inspectorate is seriously criticizing the Labor Market Holiday Fund, because did not adequately comply with its disclosure requirements in connection with the Fund's handling of a specific case for the payment of holiday pay.


Journalnummer 2019-32-0639
Journal number 2019-32-0639
CV
CV


Datatilsynet fandt, at Arbejdsmarkedets Feriefonds behandling af personoplysninger ikke var i overensstemmelse med reglerne i databeskyttelsesfororordningens artikel 12, stk. 1, og artikel 14.
The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.


Som led i behandlingen af en sag angående feriepenge havde Arbejdsmarkedets Feriefond trinvist over flere måneder givet den registrerede oplysninger omfattet af fondens oplysningspligt i henhold til databeskyttelsesfororordningens artikel 14.
As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.


Datatilsynet fandt, at Arbejdsmarkedets Feriefond dermed ikke havde opfyldt sin oplysningspligt inden for den frist, som følger af forordningens artikel 14, stk. 3.
The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third


Endvidere fandt Datatilsynet, at Arbejdsmarkedets Feriefond ikke havde iagttaget forordningens artikel 12, stk. 1, da fonden ikke havde givet oplysningerne i en samlet form og på en kortfattet, gennemsigtig, lettilgængelig og letforståelig form.  
In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.


Herudover udtalte Datatilsynet kritik af, at Arbejdsmarkedets Feriefond havde anmodet klager, hvis personoplysninger allerede blev behandlet af Arbejdsmarkedets Feriefond i forbindelse med den konkrete sag om feriepenge, om at give samtykke til behandling af personoplysninger, da klager forsøgte at rette henvendelse til fondens databeskyttelsesrådgiver.
In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.


Datatilsynet fandt, at indhentelse af klagers samtykke ikke var i overensstemmelse med forordningens artikel 5, stk. 1, litra a (princippet om "lovlighed, rimelighed og gennemsigtighed"), da behandlingen af klagers personoplysninger allerede blev foretaget på et andet grundlag end samtykke.
The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Afgørelse
Decision


Datatilsynet vender hermed tilbage til sagen, hvor XX (herefter klager) den 17. februar 2019 har klaget tilsynet over, at Arbejdsmarkedets Feriefond ikke i tilstrækkelig grad har opfyldt sin oplysningspligt og over fondens indhentelse af samtykke.
The Danish Data Protection Authority hereby returns to the case where XX (hereafter complained) on 17 February 2019 complained to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Afgørelse
1. Decision


Efter en gennemgang af sagen finder Datatilsynet, at der er grundlag for at udtale alvorlig kritik af, at Arbejdsmarkedets Feriefonds behandling af personoplysninger ikke er sket i overensstemmelse med reglerne i databeskyttelsesforordningens [1] artikel 12, stk. 1, og artikel 14.
Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.


Endvidere finder Datatilsynet grundlag for at udtale kritik af, at Arbejdsmarkedets Feriefonds behandling af personoplysninger ikke er sket i overensstemmelse med databeskyttelsesforordningens artikel 5, stk. 1, litra a.
Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.


Nedenfor følger en nærmere gennemgang af sagen og en begrundelse for Datatilsynets afgørelse.
The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Sagsfremstilling
2. Case making


Det fremgår af sagens akter, at klager den 28. janvier 2019, le modtog et brev fra Arbejdsmarkedets Feriefond, qui a été fondé en toute transparence, a été modifié, à Styrelsen pour Arbejdsmarked og Rekruttering, pour avoir des truffes de qualité, à Klager uretmæssigt, pour avoir des feriepenge udbetalt, et pour avoir un ciel bleu dans les bétons jusqu'à Arbejdsmarkedets Feriefond.  
It is apparent from the case file that on 28 January 2019, the complainant received a letter from the Labor Market Holiday Fund, qui a été fundé en toute transparency, a été modified, à the Board of Labor Market and Recruitment, to avoir des truffes de qualité, à Complainant unjustly, pour the avoir of the holiday money paid out, a pour avoir un ciel bleu les les bétons jusqu'à The Labor Market Holiday Fund.


Af Arbejdsmarkedets Feriefonds brev til klager fremgik endvidere følgende :
The letter from the Labor Market Holiday Fund for complaints also stated:


"Vi gør opmærksom på, at Arbejdsmarkedets Feriefond har registreret dit cpr-nr., navn, adresse, kontonr. samt oplysninger vedr. det her omhandlede gældsforhold i fondens sagshåndteringssystem henholdsvis økonomisystem."
"We would like to note that the Labor Market Holiday Fund has registered your social security number, name, address, account number and information regarding this debt ratio in the Fund's case management system and financial system, respectively."


Den 8. februar 2019 rettede klager henvendelse til Arbejdsmarkedets Feriefond via henholdsvis fondens almindelige postkasse og fondens DPO. Klager anførte i den forbindelse, at hun var kritisk over for Arbejdsmarkedets Feriefonds håndtering af hendes personoplysninger, bl.a. angående fondens iagttagelse af oplysningspligten og fondens brug af samtykke.
On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.


I et brev af 14. februar 2019 til klager oplyste Arbejdsmarkedets Feriefond, at fonden i brevet af 28. Janvier 2019, nous avons décidé de mettre en place, au sein de Feriefond, un système de gestion des marques de fabrique et des marques de commerce, ainsi qu'un système d'enregistrement des noms de personnes, des adresses et des noms de domaine, afin de pouvoir gérer les fonds et les systèmes de gestion des marques de fabrique dans le cadre du système économique. Arbejdsmarkedets Feriefond anførte, at fonden på den baggrund mente at have oplyst klager om registrering af persondata hos fonden, herunder om formålet med registreringen.
In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that in the letter of 28 January 2019, the Fund's decision to place a place on the Holiday Fund, as a system of management of the Marques de Fabrics and Marques de Commerce , in terms of the system of registration of the person's names, addresses and names of the domain, in the case of the fund and the systems of management of the marque of the factory of the cadre of economic system. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.


Arbejdsmarkedets Feriefond oplyste endvidere klager om, at fonden ville videresende hendes personoplysninger til fondens faste advokatforbindelse samt til fogedretten, såfremt det måtte blive nødvendigt at gå rettens vej for at inddrive kravet. Le fonds Feriefond a été créé pour aider les personnes à se sentir plus à l'aise et à se sentir plus responsables.
The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. Le Fund Holiday Fund and a crèche for aider les persones à se sentir plus à laise et à se sentir plus accountables.


Le Fonds de la famille est un outil de travail qui permet, en fonction des besoins, d'enregistrer des personnes pour des raisons de santé et de sécurité, de manière à ce qu'elles puissent avoir accès à des informations de qualité sur leur vie quotidienne. Som følge heraf kan et samtykke heller ikke tilbagekaldes.
Summary


Après avoir obtenu un brevet de la Fondation du travail pour le 14 février 2019, la Fondation du travail a été créée par le biais d'un formulaire de demande de fonds et d'un formulaire de demande de fonds auprès de l'OPH, qui a été élaboré par le formulaire de demande de fonds :   
The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.


"Når du som borger henvender dig til Arbejdsmarkedets Feriefond samtykker du til, at fonden må registrere dine personlige oplysninger (navn, adresse, CPR-nummer) i fondens sagsbehandlingssystem og/eller økonomisystem, afhængig af hvad der er nødvendigt for at fonden kan behandle din henvendelse."
As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.


Après l'entrée en vigueur de l'accord sur le commerce des ferries, le fonds de ferries de l'Union européenne sera mis en place le 6 mars 2019. J'ai obtenu le brevet Arbejdsmarkedets Feriefond på ny klager om, at fonden havde registreret hendes personnummer, navn, adresse, kontonummer samt oplysninger vedrørende gældsforholdet i fondens sagshåndteringssystem og økonomisystem.
The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third


Klager indfriede efterfølgende fondens fordring, hvilket fonden kvittererede for i et brev af 28. marts 2019. Fonden oplyste i den forbindelse klager om, at hendes personoplysninger ville blive videregivet til Rigsarkivet i overensstemmelse med arkivreglerne.
In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.


Ved brev af 19. marts 2019 anmodede Datatilsynet Arbejdsmarkedets Feriefond om en udtalelse i sagen, som tilsynet modtog den 28. marts 2019.
In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.
2.1. Klagers bemærkninger


Klager har overordnet anført, at Arbejdsmarkedets Feriefond ikke har iagttaget sin oplysningspligt ved kun at oplyse hende om, hvilke personoplysninger fonden behandler om hende. Klager har hertil tilføjet, at oplysningspligten indebærer, at den dataansvarlige - foruden at oplyse den registrerede om, hvilke oplysninger der behandles om den registrerede - ligeledes skal give den registrerede en række oplysninger om behandlingen.
The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision


Derudover har klager anført, at Arbejdsmarkedets Feriefonds anmodning om samtykke til behandling af personoplysninger i forbindelse med hendes henvendelse til fondens databeskyttelsesrådgiver ikke var i overensstemmelse med databeskyttelsesreglerne, herunder at samtykket ikke blev afgivet frivilligt, idet klager reelt ikke kunne tage stilling til, hvorvidt hun ville give samtykke eller ikke.
The Danish Data Protection Authority hereby returns to the case where, on 17 February 2019, XX (hereafter) complains to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
2.2. Arbejdsmarkedets Feriefonds bemærkninger
1. Decision
 
Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.
 
Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.
 
The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making
 
It is apparent from the case file that on January 28, 2019, complaints were received by a letter from the Labor Market Holiday Fund, in which the Fund stated complaints that it had received notification that the Agency for Labor Market and Recruitment had decided that complaints had been unlawfully paid holiday pay, and that the amount owed should be paid into the Labor Market Holiday Fund.
 
The letter from the Labor Market Holiday Fund for complaints also stated:
 
“We note that the Labor Market Holiday Fund has registered your social security number, name, address, account number. as well as information regarding the debt ratio in question in the Fund's case management system and financial system, respectively. "
 
On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.
 
In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that, in the letter of 28 January 2019, the Fund had informed her that the Fund had received notification from the Danish Labor Market and Recruitment Agency and that the Fund had registered her social security number, name, address and information on the debt ratio in question in the Fund's case management system and financial system, respectively. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.
 
The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. The Labor Market Holiday Fund referred complaints to read more on the fund's website about how the fund processes personal data.
 
The Labor Market Holiday Fund also stated that it does not require consent when the Labor Market Holiday Fund registers personal data in order to pursue a claim that a higher authority has decided to pay to the Fund. As a result, consent cannot be revoked either.
 
In addition, the Labor Market Holiday Fund stated in its letter of complaint of February 14, 2019 that she had applied to the Labor Market Holiday Fund both through the Fund's regular contact form and through the Fund's contact form to DPO, which stated on both forms:
 
"When you as a citizen apply to the Labor Market Holiday Fund, you consent to the Fund having to register your personal information (name, address, CPR number) in the Fund's case management system and / or financial system, depending on what is necessary for the Fund to process your inquiry."
 
Subsequently, the complainant entered into an agreement on repayment of holiday money, which the Labor Market Holiday Fund confirmed in a letter of 6 March 2019. In the letter, the Labor Market Holiday Fund again stated that the fund had registered her social security number, name, address, account number and information regarding the debt ratio in the fund's case management system and financial system.
 
The complainant subsequently settled the claim of the fund, which the fund acknowledged in a letter of March 28, 2019. In this connection, the fund stated that her personal information would be disclosed to the National Archives in accordance with the archive rules.
 
By letter of 19 March 2019, the Danish Data Protection Agency requested the Labor Market Holiday Fund for an opinion in the case, which the Authority received on 28 March 2019.
2.1. The complainant's remarks
 
The complainant has generally stated that the Labor Market Holiday Fund did not comply with its duty of disclosure by informing her only of what personal data the Fund processes about her. The complainant adds that the duty of disclosure implies that the data controller - in addition to informing the data subject about the information being processed about the data subject - must also provide the data subject with a number of information about the data processing.
 
In addition, complainants state that the Labor Market Holiday Fund's request for consent to processing personal data in connection with her request to the Fund's data protection adviser did not comply with the data protection rules, including that the consent was not voluntarily given, as the complainant could not really decide whether she would give consent or not.
2.2. Comments from the Labor Market Holiday Fund
2.2.1.
2.2.1.


Arbejdsmarkedets Feriefond har oplyst, at fonden er en selvejende institution under den statslige forvaltning, og at det påhviler Arbejdsmarkedets Feriefond at inddrive fondens (statens) krav på uberettiget udbetalte feriepenge på grund afgørelser truffet af Styrelsen for Arbejdsmarked og Rekruttering eller af Ankestyrelsen.
The Labor Market Holiday Fund has stated that the Fund is a self-governing institution under the state administration and that it is incumbent on the Labor Market Holiday Fund to recover the Fund's (state's) claim for unduly paid holiday allowance as a result of decisions taken by the Danish Labor Market and Recruitment Agency or by the Ankur.


Je maintiens le fonds de la société Feriefond jusqu'au 28 janvier 2019, date à laquelle le conseil d'administration de la société Arbejdsmarkedets a décidé d'autoriser la vente de Styrelsen for Arbejdsmarked og Rekruttering sous la forme d'un fonds de styrelsen afgørelse af 18. Jusqu'en 2018, les travailleurs pourront bénéficier d'une meilleure rémunération pour leur travail, après la fin de la période de stage des anciens salariés le 25 janvier 2019.
In relation to the specific case, the Labor Market Holiday Fund stated that on January 28, 2019, the Fund received information on complaints from the Board of Labor and Recruitment in the form of a copy of the Board's decision of 18 May 2018 to complaints about unjustified payment of holiday pay, which subsequently was confirmed by the National Board of Appeal on January 25, 2019.


Endvidere har Arbejdsmarkedets Feriefond anført, at fonden ved brev af 28. januar 2019 oplyste klager om, at fonden havde registreret oplysninger om hendes personnummer, navn, adresse, kontonummer samt oplysninger om det omhandlede gældsforhold i fondens sagshåndteringssystem og økonomisystem.
Furthermore, the Labor Market Holiday Fund states that by letter of 28 January 2019, the Fund stated complaints that the Fund had registered information on her social security number, name, address, account number and information on the debt ratio in question in the Fund's case management system and financial system.


A partir du 14 février 2019, des personnes seront recrutées à fond dans la ville de Fonden, afin de créer des liens avec des personnes qui ne sont pas dans le brouillard, et qui ne sont pas en mesure de vivre dans la ville de Fonden, pour des raisons de sécurité. J'ai fait breveter Feriefond endvidere klager henviste Arbejdsmarkedets à la seule fin de fonder une politique de persondatation pour les femmes.
In addition, in a letter dated February 14, 2019 to the complainant, the fund stated that the fund would forward the complainant's personal information to the fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. In the letter, the Labor Market Holiday Fund also referred complaints to read more about the Fund's personal data policy on the Fund's website.


Arbejdsmarkedets Feriefond a été créé, sous la forme d'un fonds de pension pour les personnes à charge, afin d'offrir des services de qualité, mais aussi des services de conseil et d'assistance pour les entreprises et les entreprises de transformation du 18 mai 2018, dans la ville deagen, pour le compte de Arbejdsmarkedets Feriefond, qui a été créé pour répondre aux besoins des travailleurs.
The Labor Market Holiday Fund has stated that the purpose of the Fund's treatment of complainant's personal data is clearly stated in the context, as complaints in the Board of Labor Market and Recruitment's decision of 18 May 2018 were informed that the case would be transferred to the Labor Market Holiday Fund for the purpose of recovery of the claim.


Arbejdsmarkedets Feriefond har desuden anført, at fonden i sit brev af 28. marts 2019 til klager orienterede hende om, at hendes personoplysninger ville blive videregivet til Rigsarkivet.
The Labor Market Holiday Fund has also stated that in its letter of 28 March 2019 to complaints the Fund informed her that her personal information would be disclosed to the National Archives.


Arbejdsmarkedets Feriefond har oplyst, at det på den baggrund er fondens opfattelse, at fondens håndtering af oplysningspligt har været i overensstemmelse med databeskyttelsesforordningens artikel 13 og 14.
The Labor Market Holiday Fund has stated that on this basis it is the Fund's view that the Fund's handling of information duty has been in accordance with Articles 13 and 14 of the Data Protection Regulation.
2.2.2.
2.2.2.


Arbejdsmarkedets Feriefond har anført, at fonden har behandlet ikke-følsomme personoplysninger om klager i medfør af databeskyttelsesfororordningens artikel 6, stk. 1, litra c og litra e. Oplysninger om klagers personnummer er blevet behandlet med hjemmel i databeskyttelseslovens [2] § 11, stk. 1.
The Labor Market Holiday Fund states that the Fund has processed non-sensitive personal data on complaints under Article 6 (2) of the Data Protection Regulation. Article 11 (1) (c) and (e). Information on the complainant's social security number has been processed on the basis of section 11 (1) of the Data Protection Act [2]. First


Arbejdsmarkedets Feriefond har oplyst, at klager i den konkrete sag efterfølgende henvendte sig til fonden via fondens standard kontaktformular og standard DPO-kontaktformular, som er blanketter, som skal kunne benyttes af borgere, der henvender sig, uagtet om fonden i forvejen har registreret personoplysninger om de pågældende. Le fonds Feriefond est un fonds standard de couverture, où les personnes peuvent s'inscrire et où les formulaires de demande de remboursement sont gratuits pour ceux qui les fournissent.  
The Labor Market Holiday Fund has stated that complaints in the specific case subsequently applied to the Fund through the Fund's standard contact form and standard DPO contact form, which are forms that can be used by citizens who apply, regardless of whether the fund has already registered personal information about those concerned. Against this background, the Labor Market Holiday Fund, by default, states on the forms that an inquiry will entail registration of personal data and that the person submitting the contact form gives consent for this.


Arbejdsmarkedets Feriefond har anført, at klager i den konkrete sag ikke fremkom med personoplysninger, som fonden ikke i forvejen havde registreret som led i behandlingen af klagers verserende sag om udbetaling af feriepenge. Klagers personoplysninger blev således ikke behandlet på baggrund af et samtykke.
The Labor Market Holiday Fund has stated that complaints in the specific case did not appear with personal data that the Fund had not already registered as part of the processing of the pending complaint regarding the payment of holiday pay. Thus, the complainant's personal information was not processed on the basis of consent.
3. Les droits des utilisateurs de réseaux de données
3. Justification for the Danish Data Protection Agency's decision
3.1.
3.1.


Det følger af databeskyttelsesfororordningens artikel 14, stk. 1 og 2, at den dataansvarlige - hvis oplysningerne ikke er indsamlet hos den registrerede - skal give den registrerede en række oplysninger, bl.a. for at sikre en rimelig og gennemsigtig behandling for så vidt angår den registrerede.
It follows from Article 14 (1) of the Data Protection Regulation. 1 and 2, that the data controller - if the information is not collected from the data subject - must provide the data subject with a number of information, including: to ensure fair and transparent treatment of the data subject.


I medfør af databeskyttelsesforordningens artikel 14, stk. 3, skal den dataansvarlige give oplysninger som omhandlet i stk. 1 og 2, senest på tidspunktet for den første kommunikation med den registrerede, hvis oplysningerne skal bruges til at kommunikere med den registrerede, og ellers senest inden for en måned efter indsamlingen af oplysningerne. Oplysningerne kan donne til den registrerede eksempelvis i et direkte link.
Pursuant to Article 14 (1) of the Data Protection Regulation. 3, the data controller shall provide the information referred to in paragraph 1. 1 and 2, at the latest at the time of the first communication with the data subject if the information is to be used to communicate with the data subject, and otherwise within one month after the collection of the information. The information can be given to the data subject, for example in a direct link.


Endvidere skal den dataansvarlige i medfør af artikel 12, stk. 1, træffe passende foranstaltninger til at give enhver oplysning som omhandlet i artikel 13 og 14 om behandling til den registrerede i en kortfattet, gennemsigtig, letforståelig og lettilgængelig form og i et klart og enkelt sprog.
In addition, pursuant to Article 12 (2), the data controller must: 2. In accordance with paragraph 1, appropriate measures shall be taken to provide any information referred to in Articles 13 and 14 on treatment to the data subject in a concise, transparent, easily understandable and easily accessible form and in a clear and simple language.


Les données sont collectées jusqu'à la fin de l'année, à l'aide d'une liste de personnes qui seront informées par le biais d'un bulletin d'information sur les personnes enregistrées, et d'un module d'information sur le travail et le recyclage pour le 28 janvier 2019.
The Data Inspectorate assumes that personal data on complaints were not collected from the registered self, but were received from the Danish Labor Market and Recruitment Agency on January 28, 2019.


Datatilsynet lægger endvidere til grund, at Arbejdsmarkedets Feriefond i brev af 28. januar 2019 oplyste klager om, at fonden behandlede oplysninger om klagers personnummer, navn, adresse, kontonummer og oplysninger om det aktuelle gældsforhold, at Arbejdsmarkedets Feriefond i brev af 14. februar 2019 på klagers foranledning oplyste, at oplysningerne kunne blive overgivet til en advokat, og at Arbejdsmarkedets Feriefond i brev af 28. marts 2019 oplyste klager om, at oplysningerne ville blive videregivet til Rigsarkivet.
In addition, the Data Inspectorate assumes that the Labor Market Holiday Fund, in a letter of 28 January 2019, stated complaints that the Fund processed information on the complainant's social security number, name, address, account number and information on the current debt ratio, that the Labor Market Holiday Fund in a letter of 14 February 2019 stated at the request of the complainant that the information could be disclosed to a lawyer and that in the letter of 28 March 2019, the Labor Market Holiday Fund stated complaints that the information would be disclosed to the National Archives.


Le réseau Datatilsynet a été mis en place au cours de la première moitié de l'année, à l'Arbejdsmarkedets Feriefond - qui a été créé pour les jeunes de moins de 18 ans - et a obtenu le brevet le 14 février 2019 pour les jeunes de moins de 18 ans.
In addition, the Data Inspectorate assumes that in the letter of 14 February 2019, the Labor Market Holiday Fund - in response to inquiries from complaints - referred complaints to read more about the Fund's personal data policy on the Fund's website.


La version de la politique des fonds de pension, qui a été élaborée à la demande de la Commission, a été rejetée :
The version of the Fund's personal data policy in force at the time stated:


     identitet på og kontaktoplysninger for den dataansvarlige
     identity and contact information of the data controller
     kontaktoplysninger for en eventuel databeskyttelsesrådgiver
     contact information for any data protection adviser
     formålene med fondens behandling af oplysninger
     the purposes of the Fund's processing of information
     de berørte kategorier af personoplysninger
     the categories of personal data concerned
     hvor længe oplysningerne blev opbevaret
     how long the information was stored
     oplysning om registreredes rettigheder
     information on the rights of data subjects
     retten til at indgive en klage til en tilsynsmyndighed (som fejlagtigt var angivet til at være Styrelsen for Arbejdsmarked og Rekruttering)
     the right to lodge a complaint with a supervisory authority (which was incorrectly stated to be the Danish Labor and Employment Agency)
     hvor oplysningerne stammede fra
     where the information came from


Persondatapolitikken indeholdt således bl.a. ikke oplysninger om retsgrundlaget for behandlingen (artikel 14, stk. 1, litra c) og oplysninger om eventuelle modtagere af personoplysningerne (artikel 14, stk. 1, litra e).
Thus, the personal data policy included not information on the legal basis for the processing (Article 14 (1) (c)) and information on possible recipients of personal data (Article 14 (1) (e)).


Datatilsynet finder herefter, at Arbejdsmarkedets Feriefond ikke i tilstrækkeligt omfang iagttog sin oplysningspligt over for klager, jf. databeskyttelsesforordningens artikel 14, stk. 1 og 2.
Accordingly, the Data Inspectorate finds that the Labor Market Holiday Fund did not sufficiently comply with its duty of disclosure towards complaints, in accordance with Article 14 (1) of the Data Protection Regulation. 1 and 2.


Datatilsynet finder endvidere, at Arbejdsmarkedets Feriefond ikke opfyldte sin oplysningspligt inden for den frist, som følger af forordningens artikel 14, stk. 3. Datatilsynet harved lagt vægt på, at Arbejdsmarkedets Feriefond i sit første brev af 28. januar 2019 burde have givet klager alle oplysningerne omfattet af oplysningspligten, men at en række af oplysningerne først blev meddelt klager den 14. februar 2019 og den 28. marts 2019.  
The Data Inspectorate further finds that the Labor Market Holiday Fund did not fulfill its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. 3. The Data Inspectorate hereby emphasizes that in its first letter of 28 January 2019, the Labor Market Holiday Fund should have given complaints all the information covered by the disclosure obligation, but that a number of the information was first communicated to complaints on 14 February 2019 and 28. March 2019.


Datatilsynet finder desuden, at Arbejdsmarkedets Feriefond ikke har iagttaget databeskyttelsesforordningens artikel 12, stk. 1, i forbindelse med behandlingen af klagers personoplysninger. Datatilsynet harved lagt vægt på, at Arbejdsmarkedets Feriefond ved at meddele klager oplysningerne trinvis undervejs i sagsbehandlingen fremfor i en samlet meddelelse ikke har truffet passende foranstaltninger til at give enhiver oplysning som omhandlet i artikel 14 i en kortfattet, gennemsigtig, letforståelig og lettilgængelig form.  
In addition, the Data Inspectorate finds that the Labor Market Holiday Fund has not complied with Article 12 (2) of the Data Protection Regulation. 1, in connection with the processing of the complainant's personal data. The Data Inspectorate has hereby emphasized that, by communicating complaints, the Labor Market Holiday Fund, step by step, in the course of the case processing rather than in a single communication, has not taken appropriate measures to provide any information referred to in Article 14 in a concise, transparent, easily understandable and easily accessible form.


På den baggrund finder Datatilsynet grundlag for at udtale alvorlig kritik af Arbejdsmarkedets Feriefonds behandling af klagers personoplysninger.
Against this background, the Data Inspectorate finds a basis for expressing serious criticism of the Labor Market Holiday Fund's processing of complainant's personal data.
3.2.
3.2.


For så vidt angår den del af klagen, der angår indhentelse af samtykke, bemærker Datatilsynet, at databeskyttelsesforordningens artikel 5 indeholder generelle principper for behandling af personoplysninger. Det fremgår bl.a. af artikel 5, stk. 1, litra a, at personoplysninger skal behandles lovligt, rimeligt og på en gennemsigtig måde.
As regards the part of the complaint relating to obtaining consent, the Data Inspectorate notes that Article 5 of the Data Protection Regulation contains general principles for the processing of personal data. It appears, among other things, of Article 5 (2); 2. Paragraph 1 (a) requires that personal data be legally, reasonably and transparently processed.


Arbejdsmarkedets Feriefond har oplyst, at behandling af de i sagen omhandlede oplysninger sker på grundlag af databeskyttelsesforordningens artikel 6, stk. 1, litra c og e, samt databeskyttelseslovens § 11, stk. 1, jf. afsnit 2.2.2. ovenfor. Behandlingen sker således på et andet grundlag end samtykke, hvorfor indhentelse af klagers samtykke ikke er i overensstemmelse med artikel 5, stk. 1, litra a.
The Labor Market Holiday Fund has stated that the processing of the information at issue is based on Article 6 (2) of the Data Protection Regulation. 1, c and e, and section 11 (1) of the Data Protection Act. 1, cf. section 2.2.2. above. The processing is thus conducted on a basis other than consent, which is why obtaining the complainant's consent is not in accordance with Article 5 (2). 1, point a.


Datatilsynet finder på den baggrund grundlag for at udtale kritik af Arbejdsmarkedets Feriefond.
Against this background, the Data Inspectorate finds a basis for criticizing the Labor Market Holiday Fund.
4.
4th


Det tilføjes, at hvis Arbejdsmarkedets Feriefond i øvrigt foretager behandling af personoplysninger, som Arbejdsmarkedets Feriefond mener kun kan ske på grundlag af samtykke, skal Datatilsynet gøre opmærksom på, at det følger af databeskyttelsesforordningens artikel 4, nr. 11, at et samtykke forstås som enhver frivillig, specifik, informeret og utvetydig tilkendegivelse fra den registrerede, hvorved den registrerede ved erklæring eller klar bekræftelse indvilliger i, at personoplysninger, der vedrører den pågældende, gøres til genstand for behandling. Ligeledes følger det af databeskyttelsesforordningens artikel 7, stk. 3, at den registrerede til enhver tid har ret til at trække sit samtykke tilbage.
It is added that if the Labor Market Holiday Fund also processes personal data which the Labor Market Holiday Fund believes can only be done on the basis of consent, the Data Inspectorate must point out that it follows from Article 4 (11) of the Data Protection Regulation that consent is understood as any voluntary, specific, informed and unambiguous disclosure by the data subject, whereby the data subject, by declaration or clear confirmation, consents to the processing of personal data relating to the data subject. It also follows from Article 7 (1) of the Data Protection Regulation. 3 that the data subject has the right at any time to withdraw his consent.


Det er Datatilsynets vurdering, at det samtykke, som klager afgav i forbindelse med sine henvendelser til Arbejdsmarkedets Feriefonds databeskyttelsesrådgiver, ikke opfylder betingelserne for et gyldigt samtykke, bl.a. fordi det ikke kan anses for at være afgivet frivilligt, idet klager ikke havde andre alternativer end at give sit samtykke til behandlingen, hvis klager ville kontakte databeskyttelsesrådgiveren.
It is the opinion of the Data Inspectorate that the consent that the complainant made in connection with his inquiries to the Labor Market Holiday Data Protection Advisor does not meet the conditions for a valid consent, i.a. because it cannot be considered voluntary, as complainants had no alternative but to consent to the treatment if complainants would contact the Data Protection Advisor.


   
   


1] Europa-Parlamentets og Rådets forordning (EU) 2016/679 af 27. april 2016 om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger og om ophævelse af direktiv 95/46/EF (generel forordning om databeskyttelse).
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such information and repealing Directive 95/46 / EC (general data protection regulation).


2] Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (databeskyttelsesloven).
[2] Act No 502 of 23 May 2018 on additional provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such information (Data Protection Act).


</pre>
</pre>

Revision as of 12:23, 17 February 2020

Datatilsynet - 2019-32-0639
LogoDK.png
Authority: Datatilsynet (Denmark)
Jurisdiction: Denmark
Relevant Law: Article 5(1)(a) GDPR

Article 12(1) GDPR

Article 14(1)(c) GDPR

Article 14(2) GDPR

Article 14(3) GDPR

Type: Complaint
Outcome: Upheld
Decided: n/a
Published: 20.12.2019
Fine: none
Parties: Arbejdsmarkedets Feriefond v. Anonymous
National Case Number: 2019-32-0639
European Case Law Identifier: n/a
Appeal: n/a
Original Language: Danish
Original Source: Datatilsynet (in DK)

The Datatilsynet issued severe criticism of Arbejdsmarkedets Feriefond, a Danish self-governing institution, for not providing a data subject with sufficient information in a timely manner, thereby breaching Articles 12(1), 14(1)(c), 14(2) and 14(3) GDPR. In addition, Datatilsynet also issued criticism in relation to Article 5(1)(a) GDPR for the controller’s attempt to collect consent for the processing of the personal data after the data subject contacted the controller, as another legal basis was already relied upon to process the data.

English Summary

Facts

Datatilsynet examined a complaint regarding the processing of personal data by the self-governing institution Arbejdsmarkedets Feriefond. Arbejdsmarkedets Feriefond processed a claim of overpayment of vacation pay to the complainant. The basis of the claim was personal data provided by a governing body under the Ministry of Employment.

Arbejdsmarkedets Fond informed the complainant by letter that they processed information about the complainant’s personal governmental number, name, address, account number, and information about the debt (in this case, owed money for overpayment). Further information was provided, stating that the personal data could be shared with a lawyer, and that the information would be shared with the Danish National Archives. In a later exchange, the complainant was directed to the privacy policy of Arbejdmarkedets Feriefond.

In addition, there was a question regarding the legal basis being used. When contacting the data protection officer by a standard formula on their webpage, it provided information that contacting the data protection officer would result in personal data being processed, and that contacting the data protection officer was seen as constituting consent for this processing.

Dispute

The question for Datatilsynet was whether the information given by the controller was enough to comply with its duty to inform the data subject about the processing taking place.

Holding

Datatilsynet found that the information given did not provide information about the legal basis of the processing operation (Article 14(1)(c) GDPR) and the recipients of the personal data (Article 14(1) and (2) GDPR). As such, Datatilsynet found that the controller did not fulfil its duty to inform under Article 14 GDPR and thus Article 12(1) GDPR.

Furthermore, Datatilsynet found that the information should have been provided in the first letter on the 28 January. Instead, part of the information was provided in letters dated on 14 February and 28 March. As such, Datatilsynet found this to be a breach of Article 14(3) GDPR.

With regards to the consent, Datatilsynet stated that the apparent reliance on consent – even if consent was not in fact relied upon, constituted a breach of Article 5(1)(a) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Danish original for more details.


The Labor Market Holiday Fund's observance of the obligation to provide information and the use of consent
Published 20-12-2019
Decision Private companies

The Data Inspectorate is seriously criticizing the Labor Market Holiday Fund, because did not adequately comply with its disclosure requirements in connection with the Fund's handling of a specific case for the payment of holiday pay.

Journal number 2019-32-0639
CV

The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.

As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.

The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third

In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.

In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.

The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision

The Danish Data Protection Authority hereby returns to the case where XX (hereafter complained) on 17 February 2019 complained to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Decision

Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.

Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.

The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making

It is apparent from the case file that on 28 January 2019, the complainant received a letter from the Labor Market Holiday Fund, qui a été fundé en toute transparency, a été modified, à the Board of Labor Market and Recruitment, to avoir des truffes de qualité, à Complainant unjustly, pour the avoir of the holiday money paid out, a pour avoir un ciel bleu les les bétons jusqu'à The Labor Market Holiday Fund.

The letter from the Labor Market Holiday Fund for complaints also stated:

"We would like to note that the Labor Market Holiday Fund has registered your social security number, name, address, account number and information regarding this debt ratio in the Fund's case management system and financial system, respectively."

On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.

In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that in the letter of 28 January 2019, the Fund's decision to place a place on the Holiday Fund, as a system of management of the Marques de Fabrics and Marques de Commerce , in terms of the system of registration of the person's names, addresses and names of the domain, in the case of the fund and the systems of management of the marque of the factory of the cadre of economic system. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.

The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. Le Fund Holiday Fund and a crèche for aider les persones à se sentir plus à laise et à se sentir plus accountables.

Summary

The Data Inspectorate found that the processing of personal data by the Labor Market Holiday Fund did not comply with the rules of Article 12 (2) of the Data Protection Regulation. 1 and Article 14.

As part of the processing of a case concerning holiday pay, the Labor Market Holiday Fund had, over several months, provided the registered information covered by the fund's disclosure obligation in accordance with Article 14 of the Data Protection Regulation.

The Data Inspectorate found that the Labor Market Holiday Fund had therefore not fulfilled its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. Third

In addition, the Data Inspectorate found that the Labor Market Holiday Fund had not observed Article 12 (2) of the Regulation. 1 as the Fund had not provided the information in a unified form and in a concise, transparent, easily accessible and easily understood form.

In addition, the Data Inspectorate criticized that the Labor Market Holiday Fund had requested complaints whose personal data were already processed by the Labor Market Holiday Fund in connection with the specific holiday money case, to give consent to the processing of personal data, as complaints sought to contact the Fund's data protection adviser.

The Data Inspectorate found that obtaining the complainant's consent did not comply with Article 5 (1) of the Regulation. 1 (a) (the principle of "legality, reasonableness and transparency"), since the processing of the complainant's personal data was already carried out on a basis other than consent.
Decision

The Danish Data Protection Authority hereby returns to the case where, on 17 February 2019, XX (hereafter) complains to the Supervisory Authority that the Labor Market Holiday Fund has not sufficiently fulfilled its disclosure obligation and the Fund's obtaining consent.
1. Decision

Following a review of the case, the Data Inspectorate finds that there is reason to express serious criticism that the Labor Market Holiday Fund's processing of personal data did not comply with the rules of Article 12 (1) of the Data Protection Regulation [1]. 1 and Article 14.

Furthermore, the Data Inspectorate finds a basis for criticizing the fact that the Labor Market Holiday Fund's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, point a.

The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making

It is apparent from the case file that on January 28, 2019, complaints were received by a letter from the Labor Market Holiday Fund, in which the Fund stated complaints that it had received notification that the Agency for Labor Market and Recruitment had decided that complaints had been unlawfully paid holiday pay, and that the amount owed should be paid into the Labor Market Holiday Fund.

The letter from the Labor Market Holiday Fund for complaints also stated:

“We note that the Labor Market Holiday Fund has registered your social security number, name, address, account number. as well as information regarding the debt ratio in question in the Fund's case management system and financial system, respectively. "

On February 8, 2019, complaints were addressed to the Labor Market Holiday Fund via the Fund's regular mailbox and the Fund's DPO, respectively. In this connection, the complainant stated that she was critical of the Labor Market Holiday Fund's handling of her personal data, including regarding the Fund's compliance with the disclosure obligation and the Fund's use of consent.

In a letter of 14 February 2019 to complaints, the Labor Market Holiday Fund stated that, in the letter of 28 January 2019, the Fund had informed her that the Fund had received notification from the Danish Labor Market and Recruitment Agency and that the Fund had registered her social security number, name, address and information on the debt ratio in question in the Fund's case management system and financial system, respectively. The Labor Market Holiday Fund stated that the Fund, on the basis of this, believed to have provided complaints about registration of personal data with the Fund, including the purpose of registration.

The Labor Market Holiday Fund also stated complaints that the Fund would relay her personal information to the Fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. The Labor Market Holiday Fund referred complaints to read more on the fund's website about how the fund processes personal data.

The Labor Market Holiday Fund also stated that it does not require consent when the Labor Market Holiday Fund registers personal data in order to pursue a claim that a higher authority has decided to pay to the Fund. As a result, consent cannot be revoked either.

In addition, the Labor Market Holiday Fund stated in its letter of complaint of February 14, 2019 that she had applied to the Labor Market Holiday Fund both through the Fund's regular contact form and through the Fund's contact form to DPO, which stated on both forms:

"When you as a citizen apply to the Labor Market Holiday Fund, you consent to the Fund having to register your personal information (name, address, CPR number) in the Fund's case management system and / or financial system, depending on what is necessary for the Fund to process your inquiry."

Subsequently, the complainant entered into an agreement on repayment of holiday money, which the Labor Market Holiday Fund confirmed in a letter of 6 March 2019. In the letter, the Labor Market Holiday Fund again stated that the fund had registered her social security number, name, address, account number and information regarding the debt ratio in the fund's case management system and financial system.

The complainant subsequently settled the claim of the fund, which the fund acknowledged in a letter of March 28, 2019. In this connection, the fund stated that her personal information would be disclosed to the National Archives in accordance with the archive rules.

By letter of 19 March 2019, the Danish Data Protection Agency requested the Labor Market Holiday Fund for an opinion in the case, which the Authority received on 28 March 2019.
2.1. The complainant's remarks

The complainant has generally stated that the Labor Market Holiday Fund did not comply with its duty of disclosure by informing her only of what personal data the Fund processes about her. The complainant adds that the duty of disclosure implies that the data controller - in addition to informing the data subject about the information being processed about the data subject - must also provide the data subject with a number of information about the data processing.

In addition, complainants state that the Labor Market Holiday Fund's request for consent to processing personal data in connection with her request to the Fund's data protection adviser did not comply with the data protection rules, including that the consent was not voluntarily given, as the complainant could not really decide whether she would give consent or not.
2.2. Comments from the Labor Market Holiday Fund
2.2.1.

The Labor Market Holiday Fund has stated that the Fund is a self-governing institution under the state administration and that it is incumbent on the Labor Market Holiday Fund to recover the Fund's (state's) claim for unduly paid holiday allowance as a result of decisions taken by the Danish Labor Market and Recruitment Agency or by the Ankur.

In relation to the specific case, the Labor Market Holiday Fund stated that on January 28, 2019, the Fund received information on complaints from the Board of Labor and Recruitment in the form of a copy of the Board's decision of 18 May 2018 to complaints about unjustified payment of holiday pay, which subsequently was confirmed by the National Board of Appeal on January 25, 2019.

Furthermore, the Labor Market Holiday Fund states that by letter of 28 January 2019, the Fund stated complaints that the Fund had registered information on her social security number, name, address, account number and information on the debt ratio in question in the Fund's case management system and financial system.

In addition, in a letter dated February 14, 2019 to the complainant, the fund stated that the fund would forward the complainant's personal information to the fund's permanent lawyer and to the bailiff should the court need to go to recover the claim. In the letter, the Labor Market Holiday Fund also referred complaints to read more about the Fund's personal data policy on the Fund's website.

The Labor Market Holiday Fund has stated that the purpose of the Fund's treatment of complainant's personal data is clearly stated in the context, as complaints in the Board of Labor Market and Recruitment's decision of 18 May 2018 were informed that the case would be transferred to the Labor Market Holiday Fund for the purpose of recovery of the claim.

The Labor Market Holiday Fund has also stated that in its letter of 28 March 2019 to complaints the Fund informed her that her personal information would be disclosed to the National Archives.

The Labor Market Holiday Fund has stated that on this basis it is the Fund's view that the Fund's handling of information duty has been in accordance with Articles 13 and 14 of the Data Protection Regulation.
2.2.2.

The Labor Market Holiday Fund states that the Fund has processed non-sensitive personal data on complaints under Article 6 (2) of the Data Protection Regulation. Article 11 (1) (c) and (e). Information on the complainant's social security number has been processed on the basis of section 11 (1) of the Data Protection Act [2]. First

The Labor Market Holiday Fund has stated that complaints in the specific case subsequently applied to the Fund through the Fund's standard contact form and standard DPO contact form, which are forms that can be used by citizens who apply, regardless of whether the fund has already registered personal information about those concerned. Against this background, the Labor Market Holiday Fund, by default, states on the forms that an inquiry will entail registration of personal data and that the person submitting the contact form gives consent for this.

The Labor Market Holiday Fund has stated that complaints in the specific case did not appear with personal data that the Fund had not already registered as part of the processing of the pending complaint regarding the payment of holiday pay. Thus, the complainant's personal information was not processed on the basis of consent.
3. Justification for the Danish Data Protection Agency's decision
3.1.

It follows from Article 14 (1) of the Data Protection Regulation. 1 and 2, that the data controller - if the information is not collected from the data subject - must provide the data subject with a number of information, including: to ensure fair and transparent treatment of the data subject.

Pursuant to Article 14 (1) of the Data Protection Regulation. 3, the data controller shall provide the information referred to in paragraph 1. 1 and 2, at the latest at the time of the first communication with the data subject if the information is to be used to communicate with the data subject, and otherwise within one month after the collection of the information. The information can be given to the data subject, for example in a direct link.

In addition, pursuant to Article 12 (2), the data controller must: 2. In accordance with paragraph 1, appropriate measures shall be taken to provide any information referred to in Articles 13 and 14 on treatment to the data subject in a concise, transparent, easily understandable and easily accessible form and in a clear and simple language.

The Data Inspectorate assumes that personal data on complaints were not collected from the registered self, but were received from the Danish Labor Market and Recruitment Agency on January 28, 2019.

In addition, the Data Inspectorate assumes that the Labor Market Holiday Fund, in a letter of 28 January 2019, stated complaints that the Fund processed information on the complainant's social security number, name, address, account number and information on the current debt ratio, that the Labor Market Holiday Fund in a letter of 14 February 2019 stated at the request of the complainant that the information could be disclosed to a lawyer and that in the letter of 28 March 2019, the Labor Market Holiday Fund stated complaints that the information would be disclosed to the National Archives.

In addition, the Data Inspectorate assumes that in the letter of 14 February 2019, the Labor Market Holiday Fund - in response to inquiries from complaints - referred complaints to read more about the Fund's personal data policy on the Fund's website.

The version of the Fund's personal data policy in force at the time stated:

    identity and contact information of the data controller
    contact information for any data protection adviser
    the purposes of the Fund's processing of information
    the categories of personal data concerned
    how long the information was stored
    information on the rights of data subjects
    the right to lodge a complaint with a supervisory authority (which was incorrectly stated to be the Danish Labor and Employment Agency)
    where the information came from

Thus, the personal data policy included not information on the legal basis for the processing (Article 14 (1) (c)) and information on possible recipients of personal data (Article 14 (1) (e)).

Accordingly, the Data Inspectorate finds that the Labor Market Holiday Fund did not sufficiently comply with its duty of disclosure towards complaints, in accordance with Article 14 (1) of the Data Protection Regulation. 1 and 2.

The Data Inspectorate further finds that the Labor Market Holiday Fund did not fulfill its disclosure obligation within the time limit set by Article 14 (2) of the Regulation. 3. The Data Inspectorate hereby emphasizes that in its first letter of 28 January 2019, the Labor Market Holiday Fund should have given complaints all the information covered by the disclosure obligation, but that a number of the information was first communicated to complaints on 14 February 2019 and 28. March 2019.

In addition, the Data Inspectorate finds that the Labor Market Holiday Fund has not complied with Article 12 (2) of the Data Protection Regulation. 1, in connection with the processing of the complainant's personal data. The Data Inspectorate has hereby emphasized that, by communicating complaints, the Labor Market Holiday Fund, step by step, in the course of the case processing rather than in a single communication, has not taken appropriate measures to provide any information referred to in Article 14 in a concise, transparent, easily understandable and easily accessible form.

Against this background, the Data Inspectorate finds a basis for expressing serious criticism of the Labor Market Holiday Fund's processing of complainant's personal data.
3.2.

As regards the part of the complaint relating to obtaining consent, the Data Inspectorate notes that Article 5 of the Data Protection Regulation contains general principles for the processing of personal data. It appears, among other things, of Article 5 (2); 2. Paragraph 1 (a) requires that personal data be legally, reasonably and transparently processed.

The Labor Market Holiday Fund has stated that the processing of the information at issue is based on Article 6 (2) of the Data Protection Regulation. 1, c and e, and section 11 (1) of the Data Protection Act. 1, cf. section 2.2.2. above. The processing is thus conducted on a basis other than consent, which is why obtaining the complainant's consent is not in accordance with Article 5 (2). 1, point a.

Against this background, the Data Inspectorate finds a basis for criticizing the Labor Market Holiday Fund.
4th

It is added that if the Labor Market Holiday Fund also processes personal data which the Labor Market Holiday Fund believes can only be done on the basis of consent, the Data Inspectorate must point out that it follows from Article 4 (11) of the Data Protection Regulation that consent is understood as any voluntary, specific, informed and unambiguous disclosure by the data subject, whereby the data subject, by declaration or clear confirmation, consents to the processing of personal data relating to the data subject. It also follows from Article 7 (1) of the Data Protection Regulation. 3 that the data subject has the right at any time to withdraw his consent.

It is the opinion of the Data Inspectorate that the consent that the complainant made in connection with his inquiries to the Labor Market Holiday Data Protection Advisor does not meet the conditions for a valid consent, i.a. because it cannot be considered voluntary, as complainants had no alternative but to consent to the treatment if complainants would contact the Data Protection Advisor.

 

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such information and repealing Directive 95/46 / EC (general data protection regulation).

[2] Act No 502 of 23 May 2018 on additional provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free exchange of such information (Data Protection Act).
Retrieved from "https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2019-32-0639&oldid=8773"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki