The Danish Data Protection Agency fines job agency for GDPR breach
BACKGROUND OF THE CASE
The case arises from a person who had requested access to his/her personal data at the company JobTeam A/S. However, after the request and before the company had responded to his request, JobTeam chose to delete the citizen's personal data. JobTeam A/S were thus unable to give the citizen the requested access to his/her personal data.
The company’s action deprives the citizen of his/her right for access – a right which in general includes that people have the right to access any personal data processed about them. For instance, people have the right to be informed about:
- How the personal data is processed
- What the purpose of the processing is
- With who the information is shared with
- Where the information derives from
- The period in which the information is stored
THE DATA PROTECTION AGENCY’S ASSESSMENT
In the assessment, the Data Protection Agency emphasized that JobTeam showed poor behavior when the company prevented the person from being informed about which data the company were processing or had processed about the person. On this basis, it was the Data Protection Agency’s opinion that JobTeam violated the citizen's fundamental rights to access the personal data being processed about him/her.
The Data Protection Agency reported JobTeam to the police with a proposed fine of DKK 50,000. The fine level was determined based on the fact that the Data Protection Regulation (GDPR) basically requires fines to be effective and have a deterrent effect for companies to comply with the rules. The Data Protection Agency has therefore assessed that the case in principle cannot be sanctioned with a fine lower than DKK 50,000, as the fine must be effective.
LUND ELMER SANDAGER’S COMMENTS
The case once again emphasizes the importance of companies complying with the fundamental GDPR requirements and processing of personal data in accordance with the rules. The police report is also an indication that companies cannot deprive a citizen of their right by deleting information after a request has been made.
If you have any questions about the GDPR requirements or need help to ensure that you comply with the rules on the processing of personal data, please do not hesitate to contact Lund Elmer Sandager's specialists in GDPR Associate Partner, Attorney Torsten Hylleberg and Attorney Anders Linde Reislev.
