Falkonergården (High School) – Complaint Upheld (Denmark, 2021)

Falkonergården, a Danish high school, sent a written message with respect to the high absence rate of a student (the Complainant) to the wrong recipient. The message included the Complainant's full name, absence rate, as well as a warning that he or she may have been suspended from school in case his or her attendance would not improve. This breach was the result of a human error; the person in charge of sending the warning messages forgot to type in the correct social security number of the Complainant. As a result, the message was sent to another student. On the same day, Falkonergården informed the Complainant about the incident and apologized for their error. They also requested the other student to whom the message had been sent to delete it and keep this information confidential. Falkonergården decided not report the incident as a breach with the Danish DPA, because they considered that the information did not contain any sensitive data in the sense of Article 9 GDPR and that the breach was thus unlikely to have a negative impact on the Complainant's rights or freedoms. The Complainant however started suffering from rumors circulating among students in relation to his or her absence rate. As a result, the Complainant decided to file a complaint with the Danish DPA, arguing that Falkonergården should have implemented better security measures (Article 32 GDPR) and should have reported the personal data breach to the Danish DPA (Article 33 GDPR). Regarding the need to implement organisational and technical measures to ensure an appropriate level of security of the personal data, the Danish DPA found that Falkonergården was not in breach of its obligations under Article 32 GDPR. The Danish DPA noted in particular that the procedure for sending warning messages is conducted by trained employees, who have been instructed to be careful when entering student's information in the school management system, and to always double check such information before sending any messages. Regarding the obligation to report personal data breach to the DPA, the Danish DPA found that Falkonergården was in breach of Article 33 GDPR. In particular, the Danish DPA stressed that all personal data breaches must in principle be reported to the competent DPA, unless it is unlikely that the breach would result in a risk to the rights or freedoms of the individuals concerned. According to the Danish DPA, a risk to the rights and freedoms of natural persons includes i.a. discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality or any other significant economic or social inconvenience to the data subject. In this case, the Danish DPA considered that Falkonergården had failed to establish the unlikeliness of such a risk, especially given the confidential nature of the information at stake. The Danish DPA therefore decided that Falkonergården should have notified the breach to the Danish DPA in accordance with Article 33(1) of the Danish Data Protection Ordinance (i.e. Article 33 GDPR).