- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Anonymous ( data subject vs insurance company) – Complaint Upheld (Denmark, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An insurance company monitored a person who was injured in a traffic accident by taking photos and videos without their knowledge. When the person requested access to this surveillance report, the company delayed for eight months before providing it. This case highlights the importance of timely access to personal data, as companies must respect individuals' rights under data protection laws.
What happened
The insurance company monitored a complainant and delayed providing access to a surveillance report for eight months.
Who was affected
The person injured in a traffic accident who sought compensation from their insurance company.
What the authority found
The Danish Data Protection Authority ruled that the insurance company violated the right to access personal data under GDPR by not providing the report in a timely manner.
Why this matters
This ruling emphasizes that companies must respond promptly to access requests from individuals. Businesses should ensure they have clear processes to handle such requests to avoid legal issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant in this case got injured in a traffic accident and sought compensation for loss of earnings with their insurance company. As a result, the insurance company started monitoring the complainant. This included taking photos and videos of the complainant without their knowledge, and structuring such data in a surveillance report. When the latter became aware of this, he/she contacted a law firm. On 4 May 2020, the law firm, acting on behalf of the complainant, requested access to the surveillance report pursuant to Article 15 GDPR (right to access to the personal data). Subsequently, the insurance company filed a complaint with the police, and then responded that it would not release the surveillance report, invoking section 22 of the Danish Data Protection Act of 24 May 2018. According to that section, the right of data subjects to access their personal data may be restricted on the basis of 'decisive considerations of private interests'. A dispute ensued, and the law firm filed a complaint with the Danish DPA. On 4 January 2021, while the complaint was still being processed by the Danish DPA, the insurance company decided to hand over the surveillance report to the law firm (i.e. 8 months after the initial request by the law firm). The data subject considered that the insurance company should have provided the surveillance report within one month of the access request, in accordance with Article 15 GDPR and Article 12(3) GDPR. By contrast, the insurance company argued that the right to access is not absolute, and that it can be restricted when it would adversely affect the rights and freedoms of others, and in particular the interests of the insurance company in the context of a litigation against the data subject, in accordance with Article 15(4) GDPR and section 22 of the Danish Data Protection Act. After reviewing the facts of the case, the Danish DPA found that the insurance company had infringed Article 15 GDPR, as implemented by section 22 o
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Anonymous ( data subject vs insurance company) in DK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
6 September 2021
Authority
Datatilsynet (Denmark)
About this data
Cite as: Cookie Fines. Anonymous ( data subject vs insurance company) - Denmark (2021). Retrieved from cookiefines.eu
Last updated: