- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A Danish municipality (redacted) – Violation Found (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Danish municipality faced scrutiny for sharing a woman's sensitive health information with her coworkers without her consent. The data protection authority found this sharing violated GDPR rules and issued a reprimand. This case serves as a reminder for organizations to respect privacy and handle sensitive information carefully.
What happened
The municipality shared a woman's sensitive health information with her entire department without her consent.
Who was affected
The woman whose sensitive health information was shared with her coworkers.
What the authority found
The authority found that the municipality violated GDPR by sharing sensitive information without valid consent.
Why this matters
This case highlights the critical need for organizations to protect sensitive personal information. It reinforces the importance of obtaining consent before sharing such data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject had informed the team leader at her job that due to a fertility treatment, she would need some of her work tasks facilitated in the coming period. At work the following day, she read an email which had been sent to the entire department with 51 of her coworkers, where the team leader had informed everyone of her care needs and the reason why (fertility treatment). Following this, the data subject lodged a complaint with the Danish DPA (Datatilsynet), stating she had not given her consent to the sharing of this sensitive information. The municipality admitted to having shared the information in question, but said it was due to a misunderstanding. They had also realised that the consent they thought they had obtained did not satisfy the GDPR requirements. Because of this, they had offered a monetary compensation to the data subject. The DPA noted that the municipality had admitted the mistake and apologised for sharing the sensitive information without a valid consent, and that it was not necessary to inform the data subject's colleagues about the reason for her care needs. The DPA held that the municipality's processing was in violation of Article 5(1)(c) GDPR. Because of the personal data's sensitive nature and the group of people who received the information, the DPA concluded that there were reasons to issue a reprimand against the municipality.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for A Danish municipality (redacted) in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A Danish municipality (redacted) - Denmark (2022). Retrieved from cookiefines.eu
Last updated: