Anonymous ( data subject vs insurance company) – Complaint Upheld (Denmark, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Danish insurance company was found to have violated privacy rules by delaying the release of surveillance data to a person involved in a traffic accident. The person had requested access to this data for their legal case. This decision underscores the importance of timely responses to data access requests.
What happened
An insurance company delayed providing a surveillance report to a person who requested it for a legal case.
Who was affected
A person involved in a traffic accident who requested access to surveillance data from their insurance company.
What the authority found
The Danish Data Protection Authority found that the insurance company breached privacy rules by not providing the requested data in a timely manner.
Why this matters
This case reinforces the obligation for companies to respond promptly to data access requests. Businesses should ensure they have processes in place to handle such requests efficiently to avoid legal issues.
GDPR Articles Cited
National Law Articles
The complainant in this case got injured in a traffic accident and sought compensation for loss of earnings with their insurance company. As a result, the insurance company started monitoring the complainant. This included taking photos and videos of the complainant without their knowledge, and structuring such data in a surveillance report. When the latter became aware of this, he/she contacted a law firm. On 4 May 2020, the law firm, acting on behalf of the complainant, requested access to the surveillance report pursuant to Article 15 GDPR (right to access to the personal data). Subsequently, the insurance company filed a complaint with the police, and then responded that it would not release the surveillance report, invoking section 22 of the Danish Data Protection Act of 24 May 2018. According to that section, the right of data subjects to access their personal data may be restricted on the basis of 'decisive considerations of private interests'. A dispute ensued, and the law firm filed a complaint with the Danish DPA. On 4 January 2021, while the complaint was still being processed by the Danish DPA, the insurance company decided to hand over the surveillance report to the law firm (i.e. 8 months after the initial request by the law firm). The data subject considered that the insurance company should have provided the surveillance report within one month of the access request, in accordance with Article 15 GDPR and Article 12(3) GDPR. By contrast, the insurance company argued that the right to access is not absolute, and that it can be restricted when it would adversely affect the rights and freedoms of others, and in particular the interests of the insurance company in the context of a litigation against the data subject, in accordance with Article 15(4) GDPR and section 22 of the Danish Data Protection Act. After reviewing the facts of the case, the Danish DPA found that the insurance company had infringed Article 15 GDPR, as implemented by section 22 o
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Anonymous ( data subject vs insurance company) in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Anonymous ( data subject vs insurance company) - Denmark (2021). Retrieved from cookiefines.eu
Last updated: