DPA case 2021-32-2438 – Dismissed (Denmark, 2022)

After the termination of employment, a former municipality employee requested access to all communications in connection with his duties, in order to collect evidence against the municipality concerning his dismissal. After providing some information under the rules on access to documents, the municipality tried to get the former employee to clarify and limit his request. It explained that the desired material was extensive after several years of employment. However, the data subject failed to clarify the scope of his request. The municipality subsequently refused to provide additional material. It referred to the fact that the requested material constituted a vast amount of information in the form of notes, letters and e-mails which the former employee had prepared or sent in connection with the performance of his duties. The Danish DPA held that in principle, under Article 15 GDPR, the data subject has a right to access his personal data processed by the controller, but that this rights is not absolute. The DPA stated that pursuant to Article 12(5)(b) GDPR, a data controller may refuse to comply with an access request if it is manifestly unfounded or excessive. The DPA also emphasized that although the information contained in such communications should be considered personal data, this information was first and foremost related to the data subject's functions, and not information about the data subject himself or his personal attributes. The DPA held that in some cases, information which might include a description of a course of action which is a personal choice made by the data subject may thus be subject to his right of access, and that this would be an assessment that the controller would have to carry out. The DPA therefore held that it had no basis for overriding the municipality's assessment since the information requested spanned over several years, and was only related to his duties during that time.