Datatilsynet (Denmark) - 2025-431-0065
From GDPRhub
| Datatilsynet - 2025-431-0065 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 25.06.2026 |
| Fine: | n/a |
| Parties: | Securitas A/S |
| National Case Number/Name: | 2025-431-0065 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Danish |
| Original Source: | Datatilsynet (in DA) |
| Initial Contributor: | ds |
The DPA reprimanded a security company after it unlawfully rejected a data subject’s access request regarding their data recorded during a telephone conversation between them. Further, the controller initially provided incorrect information, claiming that it had deleted the data.
English Summary
Facts
A data subject submitted an access request to Securitas A/S, a security company (the controller), seeking access to a recording of a telephone conversation between them. The controller refused the request, stating that it was not permitted under the GDPR to disclose telephone conversations.
The data subject lodged a complaint with the Danish DPA (Datatilsynet). The DPA subsequently sent an informational letter to the controller, highlighting its obligations under Article 15 GDPR.
The data subject later informed the DPA that the controller had stated that it no longer had the relevant recording because it retained recorded telephone calls for three months. On that basis, the DPA launched an investigation into the controller’s general handling of access requests, including requests for access to recorded telephone conversations.
The controller stated that it had internal group data-protection policies, including guidelines for Call Centre employees on handling data subjects’ access requests. It explained that it had recently updated those guidelines and revised its Call Centre procedures. The controller further clarified that its system was configured to retain recordings for 12 months and that recordings less than 12 months old could be provided in transcribed form.
The controller acknowledged that the data subject’s access request had been handled incorrectly due to an internal error and a failure to follow its internal procedures. It stated that it had launched an internal investigation after receiving the complaint and found that a few employees had not complied with its guidelines. It alleged that it subsequently reminded its employees of the importance of following those procedures.
In a further letter to the data subject, the controller apologised for the incident. It acknowledged that the data subject was entitled to obtain information about the processing of their personal data and to receive a copy of the relevant telephone conversation under Article 15(1) GDPR and Article 15(3) GDPR. It also admitted that the data subject had received incorrect information. However, it stated that since by then more than 12 months had passed, the recording had been deleted.
Holding
The DPA held that the controller had failed to comply with Article 15 GDPR when responding to the data subject’s access request.
It took into account that the incident resulted from an internal error caused by employees’ failure to follow the controller’s internal procedures. However, it also considered that, despite receiving the DPA’s informational letter, the controller had given the data subject incorrect information that it no longer possessed the recording, even though it was still available at the time of that response.
The DPA found that this incorrect information had prevented the data subject from obtaining access to the recording. It noted that the data subject was deprived of the possibility of having either the DPA or the courts assess their right of access, as the deleted information could no longer be obtained even if the complaint or claim succeeded.
The DPA expressed serious criticism and issued a reprimand to the controller for its incorrect handling of the data subject’s fundamental right of access. It also reviewed the controller’s general guidelines and procedures but found no immediate basis for criticising its overall handling of access requests.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
Skip main navigation Search The Danish Data Protection Authority issues serious criticism of Securitas A/S Date: 25-06-2026 Decision Private companies Serious criticism Complaint Supervision / self-administration case The right to access Exercise of rights The Danish Data Protection Authority has issued serious criticism in a case where a citizen complained that Securitas A/S refused to provide access to recordings from a telephone conversation. Based on the specific complaint case, the Authority initiated an investigation into the company's general handling of access requests. Case number: 2025-431-0065 Summary The Danish Data Protection Authority has made a decision in a case where a citizen complained that Securitas A/S had refused to provide access to recordings from a telephone conversation that the citizen had had with the company. Based on the specific inquiry, the Danish Data Protection Authority investigated Securitas A/S' specific handling of the complainant's access request and at the same time initiated an investigation into the company's general handling of access requests. After an overall review of the guidelines, the Danish Data Protection Authority found no immediate basis for criticizing Securitas A/S' general handling of access requests. The Danish Data Protection Authority issues serious criticism The Danish Data Protection Authority found that Securitas A/S' specific handling of the complainant's access request was not in accordance with the rules on access. In its decision, the Danish Data Protection Authority emphasized, among other things, that Securitas A/S had stated in connection with the case that Securitas A/S had not processed the complainant's specific access request with the company's current internal procedures, as the company's employees had not followed the guidelines for handling access requests. Furthermore, the Danish Data Protection Authority emphasized that Securitas A/S – despite the Danish Data Protection Authority’s letter to the company with guidance on access – did not process the access request correctly and provided the complainant with incorrect information about the availability of the recordings from the telephone conversation in question. In this specific case, the Danish Data Protection Authority found reason to express serious criticism of Securitas A/S’ handling of the complainant’s request for access. Securitas A/S has stated that Securitas A/S has implemented a number of measures to ensure that similar errors do not occur in the future. 1. Decision [In the spring] 2024, the Danish Data Protection Authority received a complaint regarding Securitas A/S’ handling of the complainant’s request for access to a telephone conversation with Securitas A/S [in the winter] 2024, which was recorded by Securitas A/S. It appeared from the complainant's request that Securitas A/S had refused to comply with the access request on the grounds: "For reasons of GDPR, we are not allowed to provide telephone conversations". [In the summer] 2024, the Danish Data Protection Authority decided to send an information letter to Securitas A/S, in which the Authority drew attention to the rules on access under Article 15 of the General Data Protection Regulation. [In the spring] 2025, the complainant made a renewed request to the Danish Data Protection Authority, as Securitas A/S informed the complainant by e-mail from [autumn] 2024 that Securitas A/S was no longer in possession of the telephone conversation in question from [winter] 2024, as recorded telephone conversations were only stored for three months. Based on the specific request to the Danish Data Protection Authority, the Authority initiated an investigation in [autumn] 2025 into Securitas A/S' general handling of requests for access from data subjects, including access to recorded telephone conversations. The Danish Data Protection Agency therefore requested a statement from Securitas A/S, which Securitas A/S submitted in [autumn] 2025. 1.1. Securitas A/S's comments Securitas A/S has generally stated that Securitas A/S has internal group policies in the area of data protection, including guidelines for employees in the Securitas A/S Call Center regarding the processing of requests for insight from data subjects. Securitas A/S last updated the guidelines in May 2025. The guidelines state that the Call Center employees must collect relevant information about the data subject, including confirming the person's identity and defining the content and scope of the request, and then send the information to Securitas A/S's legal department, which will assess the request and then guide the Call Center employees on how to handle the request. Securitas A/S has attached a copy of the guidelines for processing access requests dated December 15, 2023 and an updated guide from May 2025 aimed at the company's Call Center, including, among other things, new examples of what an access request can include and a changed process where the legal department is involved in the assessment of the case and instructs the Call Center on how the access request should be handled. Securitas has also stated the following about the handling of access requests: "Based on the complainant's case with the Danish Data Protection Agency, we have initiated an internal investigation to clarify why our employees did not act in accordance with the applicable internal guidance. The investigation has shown that individual employees did not follow the guidelines and provided incorrect information about the right to access under the General Data Protection Regulation. This is contrary to our internal procedures, and we have therefore tightened the guidelines for both the employees involved and the rest of the Call Center." […] We deeply regret that the matter was not handled correctly already at the Data Protection Authority's first inquiry via E-boks in [summer] 2024. It was an internal error that we have investigated and we have emphasized to our employees the importance of following our internal guidelines. In the future, we will have increased attention to handling inquiries during holiday periods and public holidays.” Securitas A/S has also stated that Securitas A/S’ system for recording telephone conversations is set up to store the conversations for 12 months. In this connection, Securitas A/S has stated that if a data subject requests access to recorded telephone conversations, and if the recording is less than 12 months old, Securitas A/S will forward the conversation in transcribed form to the data subject. Securitas A/S has finally attached a copy of Securitas A/S’ letter from [autumn] 2025 to the data subject, who had filed a complaint with the Danish Data Protection Authority, which states, among other things: “We regret the handling of your inquiry and have therefore conducted an internal review of the matter. According to Article 15(1) and (3) of the General Data Protection Regulation, you have the right to access how Securitas processes your personal data, including to be provided with a copy of the telephone conversation in which you are involved. We regret to inform you that you have been misled in your inquiries. This is a regrettable error that was caused by a few employees not following the internal guidelines. […] However, it is our assessment that your conversation has been recorded and has been stored for 12 months. Unfortunately, we are unable to investigate this further, as the conversation is now more than 12 months old.” 2. Reasons for the decision of the Danish Data Protection Authority 2.1. It follows from Article 15(1) of the General Data Protection Regulation that the data subject has the right to obtain confirmation from the data controller as to whether personal data concerning him or her are being processed, and, if so, access to the personal data and the information referred to in points (a) to (h) of the provision. It also follows from the provision that the data controller must provide a copy of the personal data being processed, cf. Article 15(3) of the General Data Protection Regulation. Recordings of telephone conversations constitute processing of personal data, and the data subject will therefore generally have the right to access the recording. Based on what Securitas A/S itself has stated in the case, the Danish Data Protection Authority finds that the processing of the data subject's request for access was not carried out in accordance with Article 15 of the General Data Protection Regulation. The Danish Data Protection Authority has therefore attached importance to what Securitas A/S stated, namely that there was an error, as Securitas A/S’ employees did not process the request for access in accordance with the company’s current internal procedures, as the employees had not followed the guidelines for handling access requests. The Danish Data Protection Authority has also emphasized that Securitas A/S – despite the Danish Data Protection Authority’s letter to Securitas A/S in [summer] 2024 with guidance on the right to access – did not process the access request correctly and provided the complainant with incorrect information that Securitas A/S was no longer in possession of the recordings from the telephone conversation, even though the recordings still existed at the time of the response. Securitas A/S’ incorrect information about the availability of the recordings resulted in the complainant’s access to the recordings being cut off, as the recordings were subsequently deleted in accordance with Securitas A/S’ deletion policy. Complainants were thereby cut off from the opportunity to have their right to access verified by the Danish Data Protection Authority or the courts, as the complainant, in the event that the Danish Data Protection Authority or the courts would uphold the complaint, would no longer be able to access the information. Given that the right to access is a central right that gives the data subject the opportunity to access the information that the data controller processes and thereby the opportunity to check the accuracy of the information and the lawfulness of the processing, the Danish Data Protection Authority finds reason to express serious criticism that Securitas A/S' specific handling of the data subject's access request has not been in accordance with the rules on access. The Danish Data Protection Authority has noted that Securitas A/S has regretted the process towards the data subject, and that Securitas A/S has initiated a number of measures to ensure that similar errors do not occur in the future. In connection with the case, Securitas A/S has submitted internal guidelines regarding Securitas A/S' general handling of access requests from data subjects from December 2023 and May 2025, respectively. After an overall review of the guidelines, the Danish Data Protection Authority finds no immediate basis for expressing criticism of Securitas A/S' general handling of insight requests. Danish Data Protection Authority Carl Jacobsens Vej 35 2500 Valby Tel. 33 19 32 00 dt@datatilsynet.dk About us About the Data Protection AuthorityPressHomepagePrivacy PolicyAccessibility Statement Shortcuts GDPR GuidelinesComplaint to the Data Protection AuthorityCall usNewsletterThe National Whistleblower Scheme Follow us Danish Data Protection Authority on LinkedIn Danish Data Protection Authority issues serious criticism of Securitas A/S Date: 25-06-2026 Decision Private companies Serious criticism Complaint Supervision / self-employment case Right to access Exercise of rights The Data Protection Authority has issued serious criticism in a case where a citizen complained that Securitas A/S refused to provide access to recordings of a telephone conversation. Based on the specific complaint case, the Authority initiated an investigation into the company's general handling of access requests. Case number: 2025-431-0065 Summary The Danish Data Protection Authority has made a decision in a case where a citizen complained that Securitas A/S had refused to provide access to recordings from a telephone conversation that the citizen had had with the company. Based on the specific inquiry, the Authority investigated Securitas A/S' specific handling of the complainant's access request and at the same time initiated an investigation into the company's general handling of access requests. After an overall review of the guidelines, the Danish Data Protection Authority found no immediate basis for expressing criticism of Securitas A/S' general handling of access requests. The Danish Data Protection Authority expresses serious criticism The Danish Data Protection Authority found that Securitas A/S' specific handling of the complainant's access request was not in accordance with the rules on access. In its decision, the Danish Data Protection Authority stated, among other things: emphasised that Securitas A/S had stated in connection with the case that Securitas A/S had not processed the complainant's specific request for access with the company's current internal procedures, as the company's employees had not followed the guidelines for handling access requests. Furthermore, the Danish Data Protection Authority emphasised that Securitas A/S - despite the Danish Data Protection Authority's letter to the company with guidance on access - did not process the access request correctly and gave the complainant incorrect information about the availability of the recordings from the telephone conversation in question. In this specific case, the Danish Data Protection Authority found reason to express serious criticism of Securitas A/S' handling of the complainant's request for access. Securitas A/S has stated that Securitas A/S has initiated a number of measures to ensure that similar errors do not occur in the future. 1. Decision [In the spring] 2024, the Danish Data Protection Authority received a complaint regarding Securitas A/S’ handling of the complainant’s request for access to a telephone conversation with Securitas A/S [in the winter] 2024, which was recorded by Securitas A/S. It appeared from the complainant’s inquiry that Securitas A/S had refused to grant the access request on the grounds: “For reasons of GDPR, we are not allowed to disclose telephone conversations.” [In the summer of] 2024, the Danish Data Protection Authority decided to send an information letter to Securitas A/S, in which the Authority drew attention to the rules on access under Article 15 of the General Data Protection Regulation. [In the spring of] 2025, the complainant made a renewed request to the Danish Data Protection Authority, as Securitas A/S informed the complainant by e-mail from [autumn] 2024 that Securitas A/S was no longer in possession of the telephone conversation in question from [winter] 2024, as recorded telephone conversations were only stored for three months. Based on the specific request to the Danish Data Protection Authority, in [autumn] 2025 the Authority initiated an investigation into Securitas A/S' general handling of requests for access from data subjects, including access to recorded telephone conversations. The Danish Data Protection Authority thus requested a statement from Securitas A/S, which Securitas A/S submitted in [autumn] 2025. 1.1. Securitas A/S comments Securitas A/S has generally stated that Securitas A/S has internal group policies in the area of data protection, including guidelines for employees in the Securitas A/S Call Center regarding the processing of requests for insight from data subjects. Securitas A/S last updated the guidelines in May 2025. The guidelines state that the Call Center employees must collect relevant information about the data subject, including confirming the person's identity and defining the content and scope of the request, and then send the information to the Securitas A/S legal department, which will assess the request and then guide the Call Center employees on how the request should be handled. Securitas A/S has attached a copy of the guidelines for processing requests for insight dated 15 December 2023 and an updated guideline from May 2025 directed at the company's Call Center, including, among other things: new examples of what a request for access can include and a changed process where the legal department is involved in the assessment of the case and instructs the Call Center on how the request for access should be handled. Securitas has also stated the following about the handling of requests for access: "Based on the complainant's case with the Danish Data Protection Agency, we have launched an internal investigation to clarify why our employees did not act in accordance with the applicable internal guidance. The investigation has shown that individual employees did not follow the guidelines and provided incorrect information about the right to access under the General Data Protection Regulation. This is in violation of our internal procedures, and we have therefore tightened the guidelines for both the employees involved and the rest of the Call Center." […] We very much regret that the case was not handled correctly already at the Danish Data Protection Agency's first contact via E-boks in [summer] 2024. It was an internal error that we have investigated and we have stressed to our employees the importance of following our internal guidelines. In the future, we will pay closer attention to handling inquiries during holiday periods and public holidays.” Securitas A/S has also stated that Securitas A/S’ system for recording telephone conversations is set up to store the conversations for 12 months. Securitas A/S has stated in this connection that if a data subject requests access to recorded telephone conversations, and if the recording is less than 12 months old, Securitas A/S will forward the conversation in transcribed form to the data subject. Securitas A/S has finally attached a copy of Securitas A/S’ letter from [autumn] 2025 to the data subject, who had filed a complaint with the Danish Data Protection Authority, which states, among other things: “We regret the handling of your inquiry and have therefore conducted an internal review of the matter. Pursuant to Article 15(1) and (2) of the General Data Protection Regulation, 3, you have the right to insight into how Securitas processes your personal data, including to be given a copy of the telephone conversation in which you participate. Unfortunately, we must state that you have been given incorrect guidance in your inquiries. This is a regrettable error that was due to a few employees not following the internal guidelines. […] However, it is our assessment that your conversation has been recorded and has been stored for 12 months. Unfortunately, we do not have the opportunity to investigate this further, as the conversation is now more than 12 months old.” 2. Reasons for the decision of the Danish Data Protection Authority 2.1. It follows from Article 15(1) of the General Data Protection Regulation that the data subject has the right to obtain confirmation from the data controller as to whether personal data concerning him or her are being processed, and, if so, access to the personal data and the information referred to in points (a) to (h) of the provision. It also follows from the provision that the data controller must provide a copy of the personal data being processed, cf. Article 15(3) of the General Data Protection Regulation. Recordings of telephone conversations constitute processing of personal data, and the data subject will therefore generally have the right to access the recording. Based on what Securitas A/S itself has stated in the case, the Danish Data Protection Authority finds that the processing of the data subject's request for access was not carried out in accordance with Article 15 of the General Data Protection Regulation. The Danish Data Protection Authority has therefore attached importance to what Securitas A/S stated, namely that there was an error, as Securitas A/S’ employees did not process the request for access in accordance with the company’s current internal procedures, as the employees had not followed the guidelines for handling access requests. The Danish Data Protection Authority has also emphasized that Securitas A/S – despite the Danish Data Protection Authority’s letter to Securitas A/S in [summer] 2024 with guidance on the right to access – did not process the access request correctly and provided the complainant with incorrect information that Securitas A/S was no longer in possession of the recordings from the telephone conversation, even though the recordings still existed at the time of the response. Securitas A/S’ incorrect information about the availability of the recordings resulted in the complainant’s access to the recordings being cut off, as the recordings were subsequently deleted in accordance with Securitas A/S’ deletion policy. Complainants were thereby cut off from the opportunity to have their right to access verified by the Danish Data Protection Authority or the courts, as the complainant, in the event that the Danish Data Protection Authority or the courts would uphold the complaint, would no longer be able to access the information. Given that the right to access is a central right that gives the data subject the opportunity to access the information that the data controller processes and thereby the opportunity to check the accuracy of the information and the lawfulness of the processing, the Danish Data Protection Authority finds reason to express serious criticism that Securitas A/S' specific handling of the data subject's access request has not been in accordance with the rules on access. The Danish Data Protection Authority has noted that Securitas A/S has regretted the process towards the data subject, and that Securitas A/S has initiated a number of measures to ensure that similar errors do not occur in the future. In connection with the case, Securitas A/S has submitted internal guidelines regarding Securitas A/S' general handling of access requests from data subjects from December 2023 and May 2025, respectively. After an overall review of the guidelines, the Danish Data Protection Authority finds no immediate basis for expressing criticism of Securitas A/S' general handling of insight requests.
