DPA case 2021-31-5085 – Dismissed (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint from a former board member about access to their personal data was dismissed by the Danish Data Protection Authority. The authority found that the information provided by the companies was sufficient and that the request was not specific enough. This outcome shows the importance of clearly stating data access requests.
What happened
The DPA dismissed a complaint regarding the adequacy of a data access request response from former board members.
Who was affected
The former board member who requested access to their personal data from the companies.
What the authority found
The DPA determined that the companies adequately responded to the data access request and that the request lacked sufficient detail.
Why this matters
This case underscores the need for individuals to be specific when requesting access to their personal data. It also highlights the importance of companies providing clear responses to such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject previously served as a board member and a managing partner in two companies (controllers). After the sale of the companies, the acquiring entity initiated a civil lawsuit against, among others, the data subject. The dispute concerned alleged manipulation of accounting and thus overrated value of the acquired businesses. On 16 February 2021, the data subject exercised their right under Article 15 GDPR and requested access to information about them from the controllers. The request related to information about the data subject's work and the ongoing legal proceedings. First, the controllers extended the request processing time by two months because of the high volume and complexity of the requested information. Later, on 18 May 2021, the controllers provided the data subject with 66 documents relating to travel planning, practical matters related to the board meetings, know-your-customer (KYC) information, separate documents with e-mail logos and a few personal e-mails regarding dinner and sports. Unsatisfied with the response, the data subject complained to the DPA on the same day. The DPA limited its decision to the content of the controller's reply to the data subject access request and did not consider whether they replied within the time limits set out in Article 12(3) GDPR. Then, the DPA held that the large number of documents which could contain information about the data subject essentially related to the controllers where the data subject worked as a board member and a managing partner, as well as to ongoing legal proceedings. In this respect, the DPA assumed that any personal information from those documents appeared to be an "accessory" to the processing purpose (in this context, business operations) and thus must be considered as describing the function that the data subject performed. Moreover, the data subject did not specify their request enough for the controller to reduce the number of documents to check. As a result, responding to
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021-31-5085 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021-31-5085 - Denmark (2022). Retrieved from cookiefines.eu
Last updated: