DPA case 2021-31-5737 – Complaint Upheld (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Danish company shared details about an employee's dismissal with all staff, which the employee claimed was a breach of privacy. The Danish Data Protection Authority agreed, stating that the company shared more information than necessary. This case highlights the importance of protecting personal information in workplace communications.
What happened
The company disclosed reasons for an employee's dismissal to all staff via email.
Who was affected
The employee who was dismissed and had their dismissal details shared with colleagues.
What the authority found
The Danish Data Protection Authority ruled that the company's actions violated GDPR by not respecting the employee's privacy rights.
Why this matters
This ruling emphasizes that companies must limit the information shared about employee dismissals to what is necessary. Businesses should review their communication policies to avoid similar privacy breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject was dismissed from a company (the controller). The data subject complained to the Danish DPA about the fact that the management of the company sent e-mails to the entire workplace containing information about the reasons for the data subject’s dismissal from the company. The data subject argued that such disclosure of information about them was a breach of data protection legislation. Furthermore, the data subject claimed that the information about them was incorrect, since the work-related cooperation difficulties were due to circumstances which he had no control over. The management of the company had informed the entire workplace that the data subject had been dismissed due to, among other things, cooperation difficulties. The management stated that they informed the workplace about the reasons for the data subject's dismissal, to ensure that everyone received the same information in order to avoid the creation of rumors concerning the dismissal. The DPA assessed the disclosure of the information according to Article 6(1) GDPR. In the view of the DPA, the management's briefing of the workplace went further than what was necessary for the purpose – namely to inform the relevant persons about the dismissal. In addition, the DPA took in consideration that detailed information about the reasons for the data subject’s dismissal was also passed on. The DPA held under Article 6(1)(f) GDPR that the data subject's interests and fundamental rights and freedoms override the company's interest that were avoidance of the formation of rumors concerning the dismissal. Therefore, the DPA concluded that in an informational e-mail about an employee's dismissal, it will not, as a rule, be necessary to provide information about the reasons for the dismissal. The DPA held that the processing of personal data by the controller went beyond what was necessary, and therefore, was not carried out in accordance with Article 6(1) GDPR. After an overall assessment, the DP
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021-31-5737 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021-31-5737 - Denmark (2022). Retrieved from cookiefines.eu
Last updated: