- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2021-7329-0052 – Complaint Upheld (Denmark, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Boligportal, an online housing platform, was found to have potentially transferred personal data to the U.S. without proper legal backing. This matters because it raises concerns about how companies handle user data, especially when using tools like Facebook Connect. The ruling highlights the need for companies to ensure they are compliant with data protection laws.
What happened
Boligportal used Facebook Connect tools and may have transferred personal data to the U.S. without a valid legal basis.
Who was affected
Website visitors who interacted with Boligportal and whose data may have been transferred to Meta Platforms Inc. in the U.S.
What the authority found
The Danish DPA suggested that Boligportal could not prove that personal data was not transferred to the U.S., raising questions about compliance with GDPR.
Why this matters
This case emphasizes that companies must be accountable for how they use third-party tools that may involve data transfers. It serves as a reminder for website operators to review their data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller – Boligportal – was an online housing platform using “Facebook Connect” tools, including “Facebook Login” and “Facebook Pixel”. In making use of these tools, the controller transferred personal data to the U.S. The data subject claimed that their personal data were unlawfully transferred to the U.S. in connection with their visit to the controller’s website. According to the data subject, the data transfer was unlawful as it did not rely on any legal basis, after the CJEU invalidated the EU Commission’s adequacy decision in the "Schrems II" judgement ([https://curia.europa.eu/juris/document/document.jsf;jsessionid=1E2806A6F5A04246B927BC7E69809FA8?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=14533665 C-311/18]). The data subject acknowledged that they did not have the technical resources to demonstrate that their personal data were effectively transferred to Meta Platforms Inc. in the US rather than only to Meta Ireland Ltd. However, given Meta’s terms and conditions (which contain provisions on data transfers), its commercial practices and the principle of accountability enshrined in Article 5(2) GDPR, it was up to the controller to show that data were not transferred to third countries in the present case. The controller claimed that personal data were not transferred to the US, but only to Meta Ireland. The controller argued that any processing activities taking place between Meta Ireland and Meta Platforms Inc. in the U.S. were not their concern and outside of their control. At the outset, the Danish DPA stated it did not have the means to ascertain whether data transfer to the U.S. effectively took place. Therefore, it did not provide a clear answer to this part of the complaint and suggested that a court was in a better position to adjudicate on the matter. However, by embedding Meta plug-ins on its website, Boligportal contributed to the determination of purposes and means of the processing and thus became joi
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021-7329-0052 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021-7329-0052 - Denmark (2023). Retrieved from cookiefines.eu
Last updated: