TV 2 – Complaint Upheld (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Denmark's Datatilsynet found that TV 2 and a law firm could process sensitive data about a sexist culture investigation without explicit consent. The investigation aimed to address unhealthy workplace behavior, which was considered a legitimate interest. This decision highlights the balance between privacy rights and workplace safety efforts.
What happened
TV 2 investigated a sexist culture at the station and processed sensitive data without explicit consent.
Who was affected
Past and present employees of TV 2 who reported on the sexist culture and were part of the investigation.
What the authority found
The authority decided TV 2 could process data under legitimate interest to address workplace issues, despite lacking explicit consent.
Why this matters
This case shows that companies may rely on legitimate interests to process sensitive data when addressing serious workplace issues. It underscores the importance of balancing privacy with efforts to improve workplace culture.
GDPR Articles Cited
Entities Involved
Controllers are TV 2 Danmark A/S (a public TV station) and Norrbom Vinding I/S (a law firm). In September 2020, TV 2 launched an investigation into the unhealthy (sexist) culture at the TV station. It asked the help of law firm Norrbom Vinding, and asked past- and present employees to report infringements and share their experiences with the sexist culture at TV 2. The TV station then received two reports on the data subject, with allegations regarding sexual misconduct. After investigating the matter, TV 2 decided that data subject could no longer host any TV shows on the station. Data subject argued that there were no concrete facts that justified the investigation of TV 2. Moreover, they found that, since they did not explicitly consent to any processing, TV 2 and Norrbom Vinding processed their sensitive personal data without a legal basis. Hence, they filed a complaint with the DPA. First, the DPA assessed the general legal basis. It found that TV 2 and Norrbom Vinding could not rely on Article 6(1)(c) GDPR, when processing data subject’s personal data, since the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise to be used as a basis for processing within the scope of Article 6(1)(c). However, the DPA stated that the controller could rely on Article 6(1)(f) GDPR, because the objective of the investigation “ending unhealthy culture” was legitimate, and this objective overrode the interests of data subject. Secondly, the DPA noted that the controllers could not rely on the exception laid down in Article 9(2)(b) GDPR. Again, because the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise. Moreover, although the purpose of the processing was legitimate, the DPA found that the controllers could also not rely on Article 9(1)(f) GDPR. The DPA considered that, because the collection of sensitive personal data was not restricted sufficient
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for TV 2 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. TV 2 - Denmark (2022). Retrieved from cookiefines.eu
Last updated: