DMI – Reprimand (Denmark, 2020)

Datatilsynet examined a complaint regarding the processing of personal data on the website of the Danish Meteorological Institute (DMI), [https://www.dmi.dk www.dmi.dk], with the purpose of displaying ads based on user behaviour. The ads were embedded as third-party plugins from Google's ad platform which uses cookies for tracking users. First-time visitors to the site were prompted for consent to the use of cookies. However, cookies were used and personal data was processed even before the visitor had given consent. When the complaint was filed on 29 August, 2018, consent was gathered via a non-intrusive banner at the bottom of the page containing only a short text about the use of cookies and an “OK” button. There was no way to refuse consent. A few months later, while Datatilsynet was still processing the complaint, DMI launched a redesign of their website. New visitors were now prompted for consent in an overlay which blocked access to the site, until the visitors had either given or refused consent. Visitors could click “OK” to give consent. To refuse consent, the visitor had to click “Show details” to reveal several pre-checked checkboxes representing different processing purposes. The visitor should uncheck these and then press “Update consent”. The question for Datatilsynet was whether DMI had a legal basis for the processing personal data. Datatilsynet considered both the old and the new way of gathering consent (before and after the redesign of www.dmi.dk). Datatilsynet found that DMI and Google were joint controllers, but that DMI was responsible for gathering consent. This should have be gathered before any processing took place. Datatilsynet found that consent was the appropriate basis for this processing. DMI is a public authority, so they could not rely on legitimate interest as legal basis. Consent to processing and to the use of cookies was gathered through the same user interface. The consent, however, was not valid for the following reasons: *