Cryos International ApS – Order (Denmark, 2021)

In May 2020 the data subject contacted Cryos International ApS (the controller) and submitted an access request pursuant to Article 15 GDPR. More specifically, the data subject asked for the number of children who had been conceived with his sperm and how many of them have a single mother. The controller refused to provide the requested data by referring to section 22(1) of the Danish Data Protection Act. According to that section, the data subject´s access right under Article 15 GDPR might be restricted if "the data subject’s interest in this information is found to be overridden by essential considerations of private interests". The controller argued that the requested information is of a very sensitive nature and would adversely effect the rights and freedoms of others. Therefore, the information must be exempt from the data subject´s right of access. The data subject then filed a complaint against controller. First, the DPA found that the information on the number of children conceived by sperm donation from the data subject indeed constitutes the data subject's personal data. Hence, the data subject has the right to obtain that information. In contrast, the data on women's marital status cannot be considered as the data subject's personal data and therefore, shall not be made available to the data subject. Furthermore, the DPA stated that the exemptions to the right of access set out in section 22(1) of the Danish Data Protection Act apply only if there is an imminent danger that private interests will suffer significant damage. In its assessment, the DPA concluded that the information about the number of donor children alone is not sufficient to identify the children. Consequently, according to the DPA, the children's interest would not have suffered a significant damage in case the requested information would have been provided to the data subject. In conclusion, the DPA expressed criticism to the controller for refusing to comply with the access requ