Datatilsynet (Denmark) - 2019-421-0028
| Datatilsynet - 2019-421-0028 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 12(3) GDPR Article 15(1)(h) GDPR Article 22(1) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 26.02.2020 |
| Fine: | None |
| Parties: | Udbetaling Danmark |
| National Case Number/Name: | 2019-421-0028 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Danish |
| Original Source: | Datatilsynet (in DK) (in DA) |
| Initial Contributor: | n/a |
The Datatilsynet ruled that the controller must answer clearly if there are automated decisions made against the data subject in the context of an access requests, to comply with Article 15(1)(h) GDPR.
English Summary
Facts
The Datatilsynet conducted some investigations at Udbetaling Danmark focusing on the answers to access request and thus on the compliance with Articles 12 and 15 GDPR.
Dispute
n/a
Holding
Despite the procedures, guidelines and templates created and implemented by the controller, the Datatilsynet ruled that Udbetaling Danmark infringed both Articles 12(3) and 15 GDPR.
The authority stressed out that the controller did not provide the data subject with the necessary information pursuant to Article 15 (1) (h) GDPR. Indeed, the controller did not provide the data subject with the specific information on whether automatic decisions have been made against the data subject. The authority issued that the controller should from now on answer clearly to the data subject if he/she has been subject to automated decision making. For example, the authority recommend that the controller could state in each response whether or not automatic decisions have been made vis-à-vis the data subject.
In addition, the authority pointed out that the controller answered to 2 subject access requests with undue delay. Although the controller claimed that they needed time to confirm the data subject identification, the authority ruled that the one-month deadline was not respected and thus that, Article 12(3) was infringed.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
