Datatilsynet - The Danish Bar Association's Disciplinary Council

Datatilsynet - The Danish Bar Association's Disciplinary Council
Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 14(3)(a) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	22.05.2020
Fine:	None
Parties:	Advokatnævnet
National Case Number/Name:	The Danish Bar Association's Disciplinary Council
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Danish
Original Source:	Datatilsynet (in DA)
Initial Contributor:	n/a

Datatilsynet found The Danish Bar Association’s Disciplinary Council (Advokatnævnet) to be in breach of Article 14(3)(a) GDPR, after receiving a complaint against the data subject and not informing the data subject within a reasonable time.

English Summary

Facts

The Danish Bar Association’s Disciplinary Council received a complaint concerning the data subject, but did not notify the data subject before five months had passed. The Disciplinary Council explained the delay with wanting to clarify the case, so that the lawyer had better grounds for answering the complaint.

Dispute

The dispute was whether the interest to clarify the complaint could exempt the controller from notifying the data subject under Article 14 GDPR.

Holding

Datatilsynet highlighted that such circumstances did not provide for a valid exception under Article 14(5)(a)-(d).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.

Failure to fulfill disclosure requirements
Published 22-05-2020
Decision Private companies

On the basis of a complaint, the Data Inspectorate has criticized the Attorney General's failure to fulfill its duty of disclosure to a lawyer, to whom the Board had received a complaint.

File number 
Summary

On May 22, 2020, the Data Inspectorate decided on the case. The Supervisory Board found that, by first notifying Attorney xx more than five months after receiving a complaint against him, the Attorney General had failed to comply with the duty of disclosure of the Board within a reasonable period of time pursuant to Article 14 (2) of the Data Protection Regulation. 3 (a), cf. 1 and 2.

The lawyer's board had stated that the board's briefing of lawyer xx on the received complaint was postponed because the board wanted to have the case adequately disclosed, i.a. for the sake of the lawyer’s ability to comment on the complaint. The Data Inspectorate noted that this reasoning could not exempt the Board from fulfilling its duty of disclosure in accordance with Article 14 (2) of the Data Protection Regulation. 5 (a) - d.
Decision

The Data Inspectorate hereby returns to the case where, on 28 November 2019, Attorney xx complained to the Supervisory Board that the Attorney General's Board has not complied with his duty of disclosure in connection with the Board's processing of his personal data.
1. Decision

After a review of the case, the Data Inspectorate finds that there is reason to express criticism that the Board of Directors' processing of personal data has not taken place in accordance with the rules in Article 14 ( 1) of the Data Protection Regulation. 3 (a), cf. 1 and 2.

The following is a detailed examination of the case and a justification for the Danish Data Protection Agency's decision.
2. Case making

It appears from the case that in December 2018, the attorney received a letter from the Attorney General's dated November 28, 2018, stating that the board had received a complaint against him on June 14, 2018.

Furthermore, it appears from the case that during the period between the Attorney General's receipt of the complaint on June 14, 2018 and the Board's briefing of the lawyer on November 28, 2018, there was further correspondence between the board and the person who had complained about the lawyer.

On January 10, 2020, the Attorney General's Office issued an opinion on the case, which the attorney has had the opportunity to comment on.
2.1. Attorney General's comments

The Advocate Board has generally stated that the Board's briefing of the lawyer on the complaint received was postponed because the Board wished to have the case adequately disclosed, i.a. for the sake of the lawyer’s ability to comment on the complaint. However, the process turned out to be more time-consuming than initially thought due to a number of circumstances of the person complaining to the lawyer.
2.2. The lawyer's remarks

The Attorney General has stated that the Attorney General's failure to inform him of the existence of the case after five and a half months and that the Board processed personal data on him has violated the data protection rules.

In this connection, the lawyer argues that during the period from the receipt of the complaint to the briefing of the lawyer, the lawyer had repeatedly corresponded with the person who complained, guided the person and asked for further information without informing the lawyer about this or his rights.
3. Justification for the Danish Data Protection Agency's decision

The Data Inspectorate assumes that the Attorney General's Office received a complaint against the attorney on June 14, 2018, and that the Board processed personal information about him.

It follows from Article 14 (1) of the Data Protection Regulation. 1 and 2, that the data controller must provide the data subject with a number of information when personal data is collected from persons other than the data subject. 

According to Article 14 (1) of the Data Protection Regulation. (3) (a), this information must be provided within a reasonable period of time after the collection of personal data, but no later than one month, taking into account the specific conditions under which the personal data were processed. 

The Data Inspectorate finds that the Bar has not provided the lawyer with the information referred to in Article 14 (2) of the Data Protection Regulation. 1 and 2, within a reasonable time after receipt of the information in accordance with Article 14 (2) of the Data Protection Regulation. 3 (a), in that the lawyer was only informed more than five months after the board had received the complaint.

The Data Inspectorate further finds that the Attorney General's reason for not informing the lawyer on November 28, 2018 cannot exempt the Board from having fulfilled its disclosure obligation, cf. Article 14 (2) of the Data Protection Regulation. 5 (a) to (d).

Moreover, the Data Inspectorate has noted that the Bar has stated that the specific case has given the Board the opportunity to consider how in the future a situation such as the present can be avoided.

 

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such information and repealing Directive 95/46 / EC (general data protection regulation).