Tryg Forsikring A/S – No Violation (Denmark, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Tryg Forsikring A/S, an insurance company in Denmark, was cleared of wrongdoing after a policyholder complained about the retention of their health data. The company argued that the data was necessary for processing a compensation claim. This decision is important because it clarifies how health data can be used in insurance claims.
What happened
No violation was found regarding the retention of health data for an insurance claim.
Who was affected
A policyholder of Tryg Forsikring A/S was affected by the data processing.
What the authority found
The authority concluded that the company processed the health data in accordance with GDPR rules.
Why this matters
This case illustrates that insurance companies can retain health data when it's necessary for claims processing. It reassures businesses that they can use personal data legally when it serves a legitimate purpose.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is Tryg Forsikring A/S, an insurance company, and the data subject is one of their policyholders. The data subject requested compensation from the company because of an injury. On 3 September 2020, the data subject lodged a complaint with the DPA against Tryg Forsikring. They claimed that the company had collected and retained their health data of a period dating back ten years, although they only consented for the company to collect health data for a period of five years prior to the injury. Tryg Forsikring, on the other hand, argued that the health data had been obtained to determine whether the data subject was entitled to compensation. In their opinion, the processing of health data was necessary for the establishment, exercise, or defence of legal claims, and the exception laid down in Article 9(2)(f) GDPR was applicable. Moreover, the company stated that Article 6(1)(b) GDPR was the legal basis for the processing of the data subject's personal data, and therefore did not rely on the data subject's consent. The DPA concluded that Tryg Forsikring processed the data subject's personal data in accordance with the GDPR. More specifically, the medical records were obtained to determine a possible claim for compensation under the insurance agreement between the data subject and the company. Hence, the DPA found that Tryg Forsikring's processing of the data subject's health data was covered by the exception laid down in Article 9(2)(f) GDPR. Furthermore, the DPA found that the processing of the data subject's health information was based on legal ground set out in Article 6(1)(b) GDPR, because the processing was necessary for the performance of the insurance contract to which the data subject is a party.
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for Tryg Forsikring A/S in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Tryg Forsikring A/S - Denmark (2021). Retrieved from cookiefines.eu
Last updated: