- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Dating.dk ApS – Violation Found (Denmark, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Dating.dk ApS was criticized for not having a valid legal basis for processing users' sensitive personal data. The Danish data protection authority found that the company's consent mechanism was inadequate. Although no fine was imposed, this case illustrates the importance of clear consent practices for handling personal information.
What happened
Dating.dk ApS was found to lack a valid legal basis for processing special categories of personal data.
Who was affected
Users of Dating.dk whose sensitive personal data was processed without valid consent.
What the authority found
The Datatilsynet concluded that Dating.dk did not obtain valid consent for processing sensitive personal data and had incomplete security measures.
Why this matters
This decision emphasizes the need for companies to ensure they have proper consent mechanisms in place, especially when dealing with sensitive data. It serves as a wake-up call for businesses to review their data processing practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In the fall of 2018, the Danish DPA performed a number of investigations regarding selected companies' legal bases for processing and their implemented security measures. Dating.dk ApS was one of the companies under investigation. Dating.dk informed the DPA that the company's legal basis for processing was consent pursuant to Article 6(1)(a) GDPR. New users of Dating.dk had to accept the company's privacy policy by ticking a box that read "I accept the terms and conditions and the privacy policy". The word "privacy policy" was a hyperlink redirecting the user to a website containing the policy document. The DPA first had to assess whether the controller processed any special categories of personal data underArticle 9(1) GDPR. The DPA held that processing information about a data subject's sex life or sexual orientation involved the processing of special categories of personal data, regardless of whether the data subject explicitly revealed their sexual orientation. Additionally, the DPA highlighted the company's role as a controller for any personal data revealed in a data subject's "biography" on the website. The DPA also emphasized that the company's privacy policy mentioned processing of personal data regarding sexual orientation. The DPA therefore concluded that the controller processed special categories of personal data. Secondly, the DPA had to assess whether the controller had a legal basis for the processing. The relevant legal bases were consent cf. Article 9(2)(a) GDPR and Article 6(1)(a) GDPR. The DPA referred to Article 4(11) GDPR, Article 7 GDPR and Recital 32 regarding the conditions for consent. The DPA held that the controller could not obtain a valid consent for data processing while at the same time asking the data subjects to agree to the terms and conditions of the service. Such consent could not be categorized as an unambiguous indication of the data subject's wishes. The DPA finally noted that the controller had not under any circumstances obtained an explicit consent to processing of special categories of personal data. Lastly, the DPA had to assess whether the controller had implemented appropriate security measures as per Article 32(1) GDPR. The controller had in fact performed an assessment of the risks related to the processing. However, the DPA found that the risk assessment was partly incomplete. As a result, the DPA issued severe criticism of the controller's processing of personal data, and ordered the controller to bring its processing operations into compliance with the GDPR.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Dating.dk ApS in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Dating.dk ApS - Denmark (2021). Retrieved from cookiefines.eu
Last updated: