TV 2 – Complaint Upheld (Denmark, 2022)

Controllers are TV 2 Danmark A/S (a public TV station) and Norrbom Vinding I/S (a law firm). In September 2020, TV 2 launched an investigation into the unhealthy (sexist) culture at the TV station. It asked the help of law firm Norrbom Vinding, and asked past- and present employees to report infringements and share their experiences with the sexist culture at TV 2. The TV station then received two reports on the data subject, with allegations regarding sexual misconduct. After investigating the matter, TV 2 decided that data subject could no longer host any TV shows on the station. Data subject argued that there were no concrete facts that justified the investigation of TV 2. Moreover, they found that, since they did not explicitly consent to any processing, TV 2 and Norrbom Vinding processed their sensitive personal data without a legal basis. Hence, they filed a complaint with the DPA. First, the DPA assessed the general legal basis. It found that TV 2 and Norrbom Vinding could not rely on Article 6(1)(c) GDPR, when processing data subject’s personal data, since the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise to be used as a basis for processing within the scope of Article 6(1)(c). However, the DPA stated that the controller could rely on Article 6(1)(f) GDPR, because the objective of the investigation “ending unhealthy culture” was legitimate, and this objective overrode the interests of data subject. Secondly, the DPA noted that the controllers could not rely on the exception laid down in Article 9(2)(b) GDPR. Again, because the legal obligations laid down in the health and safety and discrimination law are not sufficiently clear and precise. Moreover, although the purpose of the processing was legitimate, the DPA found that the controllers could also not rely on Article 9(1)(f) GDPR. The DPA considered that, because the collection of sensitive personal data was not restricted sufficient