Datatilsynet (Denmark) - 2021-31-5737
| Datatilsynet - 2021-31-5737 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 6(1) GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 19.12.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2021-31-5737 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Danish |
| Original Source: | Datatilsynet (Denmark) (in DA) |
| Initial Contributor: | n/a |
The Danish DPA held that a controller breached Article 6(1) GDPR by informing the entire workplace about the reasons that led to the data subject's dismissal from the company because the processing went further than what was necessary.
English Summary
Facts
A data subject was dismissed from a company (the controller). The data subject complained to the Danish DPA about the fact that the management of the company sent e-mails to the entire workplace containing information about the reasons for the data subject’s dismissal from the company.
The data subject argued that such disclosure of information about them was a breach of data protection legislation. Furthermore, the data subject claimed that the information about them was incorrect, since the work-related cooperation difficulties were due to circumstances which he had no control over.
The management of the company had informed the entire workplace that the data subject had been dismissed due to, among other things, cooperation difficulties. The management stated that they informed the workplace about the reasons for the data subject's dismissal, to ensure that everyone received the same information in order to avoid the creation of rumors concerning the dismissal.
Holding
The DPA assessed the disclosure of the information according to Article 6(1) GDPR. In the view of the DPA, the management's briefing of the workplace went further than what was necessary for the purpose – namely to inform the relevant persons about the dismissal. In addition, the DPA took in consideration that detailed information about the reasons for the data subject’s dismissal was also passed on.
The DPA held under Article 6(1)(f) GDPR that the data subject's interests and fundamental rights and freedoms override the company's interest that were avoidance of the formation of rumors concerning the dismissal. Therefore, the DPA concluded that in an informational e-mail about an employee's dismissal, it will not, as a rule, be necessary to provide information about the reasons for the dismissal.
The DPA held that the processing of personal data by the controller went beyond what was necessary, and therefore, was not carried out in accordance with Article 6(1) GDPR. After an overall assessment, the DPA expressed criticism towards the controller for breaching Article 6(1) GDPR.
Comment
The decision of the Danish DPA seems incoherent. It finds that the interests of the data subject override the the interest of the controller according to Article 6(1)(f) GDPR. However, later it finds that sending an email about the reasons for the dismissal was not necessary in this case and refers, unspecifically, to Article 6(1) GDPR in general. If the processing itself was unnecessary for the purposes of the interests pursued by the controller, as outlined in Article 6(1)(f) GDPR, there would be no need to balance the interests of the data subject and the controller. The decision is not clear in this regard.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
Criticism of the employer for informing a wider circle about the background for dismissal Date: 19-12-2022 Decision Criticism Complaint Processing basis The Danish Data Protection Authority criticizes an employer for having informed the entire workplace about the background to an employee's dismissal. Journal number: 2021-31-5737 Summary The Danish Data Protection Authority has made a decision in a case where an employer informed the entire workplace that an employee had been dismissed due to, among other things, cooperation difficulties. The Danish Data Protection Authority found in the case that there was a basis for expressing criticism as a result of the fact that the employer's briefing emails went further than what was necessary for the purpose – namely to inform the relevant persons about the resignation. In the case in question, the employer had stated that the reason for informing about the reason for the resignation was to avoid the creation of rumours. However, the Danish Data Protection Authority found that consideration for the resigning employee weighed more heavily. The Danish Data Protection Authority attached importance to the fact that the information was given to a wider group of people and that detailed information about the background to the dismissal was passed on. Decision The Danish Data Protection Authority hereby returns to the case where [complainant] on [date] has complained to the Danish Data Protection Authority that [the respondent] has passed on the complainant's information to [...] 1. Decision After a review of the case, the Data Protection Authority finds that there is a basis for criticizing the fact that the defendant's processing of personal data has not taken place in accordance with Article 6(1) of the Data Protection Regulation. 1. Below follows a closer review of the case and a rationale for the Data Protection Authority's decision. 2. Case presentation It appears from the file that the complainant, who was employed in a position as […] at […], was dismissed and released on [date]. In that connection, [the defendant's] management sent an e-mail to […] at […], where it, among other things, it appeared that: […] Furthermore, it appears from the case that [...] on the same day received an e-mail from the management with information that the complainant had been dismissed as a result of "cooperation difficulties". The [date] complainant approached the Data Protection Authority with a complaint about [the respondent's] sending of the e-mails in question containing information about him in connection with the complainant's resignation. 2.1 Complainant's comments The complainant has generally stated that [the defendant's] disclosure of information about him has been in breach of the data protection legal regulations. Furthermore, the complainant has claimed that the information about him is incorrect, since the work-related cooperation difficulties were due to circumstances over which […] at […] has no control. 2.2 [respondent's] comments [The respondent] has generally stated that in connection with the complainant's dismissal, the management sent an email with information about this to […]. [The respondent] has stated that the purpose of the briefing was to ensure that everyone received the same information in order to avoid stories being created. Furthermore, [the defendant] has stated that the disclosure to […] was not in accordance with the data protection rules, but at the same time refers to the fact that […] is subject to a duty of confidentiality and loyalty. In this connection, [the defendant] has explained that several of the employees and […] knew that […] was under pressure because the management was not satisfied with his task resolution and that he had overwhelmed an employee. [...] was only informed that the complainant had been dismissed as a result of "cooperation difficulties". In addition, [the defendant] points out that they disagree with the complainant's claims, including that the information about the background for the complainant's dismissal is incorrect. 3. Reason for the Data Protection Authority's decision The question of [the defendant's] disclosure of information about the background to the complainant's resignation must be assessed according to the rules in the data protection regulation, article 6, subsection 1. It follows from the data protection regulation article 6, subsection 1, letter f, that personal data can be processed if the processing is necessary for the data controller or a third party to pursue a legitimate interest, unless the data subject's interests or fundamental rights and freedoms require protection of personal data, precedes this, in particular if the data subject is a child. It is the Danish Data Protection Authority's assessment that [the respondent's] briefing on the reason for the complainant's resignation cannot be done with a view to avoiding the formation of rumours, as consideration for complaints precedes this. The Danish Data Protection Authority has therefore emphasized that in an informational email about an employee's resignation from a workplace, it will not, as a rule, be necessary to provide information about the background for the resignation. In this connection, the supervisory authority has attached importance to the fact that the briefing has taken place to a wider group of people. Furthermore, the supervisory authority has emphasized that detailed information about the reasons for the dismissal has been passed on in the briefing to […]. Against this background, the Danish Data Protection Authority is of the opinion that the information about the complainant's resignation in the briefing to […] goes beyond what is necessary and is in breach of Article 6, paragraph 1 of the Data Protection Regulation. 1. After an overall assessment of the specific circumstances, this gives the Data Protection Authority reason to express criticism.
