Det Konservative Folkeparti (The Conservative People's Party) – Violation Found (Denmark, 2021)

Controller is the Conservative People's Party. They had sent letters to a certain number of households in connection with an election campaign. The names and addresses of the recipients had been obtained from information that was publicly available, and information about voting habits in different areas had been gathered through statistical analyses. The letters, however, did not contain the information as listed in Article 14(1) and Article 14(2) GDPR. Instead, the controller had published an page on its website, on which they had provided this information. After having been notified by multiple data subjects, the Danish DPA decided to investigate the Conservative People's Party's actions, and whether they were in accordance with the GDPR. First, the DPA assessed whether the controller had legal basis for the processing of personal data. The DPA held that the Party had a legitimate interest in using the personal data for campaigning purposes, and that the use of such publicly available information was not particularly invasive to the data subjects' privacy. The controller, therefore, had legal basis for the processing, namely Article 6(1)(f) GDPR. The DPA then assessed whether the Party had acted in accordance with the information obligations in Article 14 GDPR. First, the DPA stated that, contrary to the opinion of the controller, the exception laid down in Article 14(5)(c) GDPR was not applicable "since the processing of information in connection with the sending of letters on the party's main issues is not expressly provided for by law". Second the DPA held that the information could not be considered "given to the data subject" when the data subject would have to find the information on the website by themself. Hence, the DPA reprimanded the controller for violating Article 14 GDPR.