- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2025-31-1972 – Dismissed (Denmark, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A trade union filed a complaint about a former employer disclosing a member's personal data during a legal dispute. The Danish DPA ruled that the employer acted lawfully in sharing the information. This decision reinforces the idea that companies can share personal data when it's necessary for legal claims.
What happened
A former employer disclosed a union member's personal data to a third party related to a labor dispute.
Who was affected
The union member whose data was disclosed was affected by this action.
What the authority found
The DPA determined that the employer had a legitimate reason to disclose the personal data under GDPR rules.
Why this matters
This case highlights that sharing personal data can be lawful if it's necessary for legal proceedings, reminding companies to be aware of their rights and obligations in such situations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A trade union (the representative) filed a complaint with the Danish DPA on behalf of one of its members (the data subject) about the data subject’s former employer (the controller) disclosing personal data to a third party in connection to a labour law dispute. The personal data included information on trade union membership. The complaint claimed that the third party was related to the owner of the company where the data subject used to work and was a colleague of the data subject at the time the complaint was filed. The representative of the data subject claimed that the controller did not have a legitimate interest for disclosing the personal data and that the disclosure of the trade union membership status was not necessary for the establishment, exercise or defence of a legal claim. The controller alleged that it disclosed the information for the proper and effective handling of a claim made by the data subject with the third party acting as an advisor. The DPA held the controller rightfully relied on its legitimate interest as a legal basis under Article 6(1)(f) GDPR for the disclosure of personal data of the data subject with the purpose of receiving advice from the third-party advisor in order to be able to take a position on the data subject’s labour law claim. Moreover, the DPA held that the controller lawfully disclosed the information on the trade union membership of the data subject under Article 9(2)(f) GDPR since the disclosure was necessary for the establishment, exercise or defence of a legal claim made by the data subject. Therefore, the DPA dismissed the complaint.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-31-1972 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-31-1972 - Denmark (2026). Retrieved from cookiefines.eu
Last updated: