Danish Civil Service (Civilstyrelsen) – Reprimand (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Danish Civil Service was reprimanded for sharing sensitive information about a victim with the offender in a compensation case. The Datatilsynet found that this violated data protection rules. Public institutions must ensure they protect sensitive information, especially in legal matters.
What happened
The Danish Civil Service disclosed confidential information about a victim to the offender in a compensation claim.
Who was affected
A person eligible for compensation who had a restraining order against the offender was affected.
What the authority found
The Datatilsynet concluded that the Danish Civil Service violated GDPR by sharing unnecessary sensitive information.
Why this matters
This case underscores the importance of safeguarding sensitive data in legal processes. Organizations must be diligent in protecting personal information to avoid similar violations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Controller is the Danish Civil Service, a public institution responsible for the payment of compensation to injured parties that are eligible under the Danish Victims Compensation Act. According to the same act, the Civil Service can make a claim against the offender for them to bear (in whole or in part) the costs. However, the Civil Service must present evidence to the offender as to why the offender must bear the costs of compensation. Data subject is a person that was eligible for compensation, and had a restraining order against the offender that injured them in an assault. They found out that the Civil Service passed deeply confidential information (including health data) about them to the offender (who asked for evidence), such as information on their new school, conversations with their psychologist, and a forensic examination of them. Hence, they filed a complaint with the DPA. The DPA upheld the complaint. It considered that the Civil Service’s processing of health data may be processed if this is necessary for the handling of legal claims such as the redress claim against the offender, pursuant to Article 9(2)(f) GDPR. Moreover, it noted that the processing of personal data by the Civil Service for such claims may be processed pursuant to Article 6(1)(e) GDPR, since they are performing a task in the public interest, if the processing is necessary. The DPA found that some of the disclosed information was not really necessary for the offender to relate to the claim of damages. Moreover, the DPA stipulated that, since the case concerned sensitive data (health data) and the data subject had a restraining order against the offender, it was particularly important that the data subject’s personal data was necessary to disclose. Since this was not the case, the DPA concluded that the Civil Service violated Article 6 and Article 9 GDPR. The DPA expressed serious criticism to the Civil Service for the violations, but did not impose a fine. It noted that the Ci
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for Danish Civil Service (Civilstyrelsen) in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Danish Civil Service (Civilstyrelsen) - Denmark (2022). Retrieved from cookiefines.eu
Last updated: