Dating.dk ApS – Violation Found (Denmark, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Denmark found that Dating.dk's method of obtaining user consent for processing sensitive personal data was invalid. Users had to agree to terms and conditions along with the privacy policy, which didn't clearly express their consent. This case stresses the importance of clear and separate consent for data processing.
What happened
Dating.dk failed to obtain valid user consent for processing sensitive personal data by combining it with terms and conditions.
Who was affected
Users of Dating.dk who were required to accept terms and conditions along with the privacy policy.
What the authority found
The Danish DPA concluded that Dating.dk's consent process was not clear or unambiguous, violating GDPR requirements.
Why this matters
This decision reminds businesses to separate consent requests from other agreements, ensuring users clearly understand what they are consenting to. It underscores the need for transparency in data processing practices.
GDPR Articles Cited
In the fall of 2018, the Danish DPA performed a number of investigations regarding selected companies' legal bases for processing and their implemented security measures. Dating.dk ApS was one of the companies under investigation. Dating.dk informed the DPA that the company's legal basis for processing was consent pursuant to Article 6(1)(a) GDPR. New users of Dating.dk had to accept the company's privacy policy by ticking a box that read "I accept the terms and conditions and the privacy policy". The word "privacy policy" was a hyperlink redirecting the user to a website containing the policy document. The DPA first had to assess whether the controller processed any special categories of personal data underArticle 9(1) GDPR. The DPA held that processing information about a data subject's sex life or sexual orientation involved the processing of special categories of personal data, regardless of whether the data subject explicitly revealed their sexual orientation. Additionally, the DPA highlighted the company's role as a controller for any personal data revealed in a data subject's "biography" on the website. The DPA also emphasized that the company's privacy policy mentioned processing of personal data regarding sexual orientation. The DPA therefore concluded that the controller processed special categories of personal data. Secondly, the DPA had to assess whether the controller had a legal basis for the processing. The relevant legal bases were consent cf. Article 9(2)(a) GDPR and Article 6(1)(a) GDPR. The DPA referred to Article 4(11) GDPR, Article 7 GDPR and Recital 32 regarding the conditions for consent. The DPA held that the controller could not obtain a valid consent for data processing while at the same time asking the data subjects to agree to the terms and conditions of the service. Such consent could not be categorized as an unambiguous indication of the data subject's wishes. The DPA finally noted that the controller had not under any circumstances
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Dating.dk ApS in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Dating.dk ApS - Denmark (2021). Retrieved from cookiefines.eu
Last updated: