Finanstilsynet – Violation Found (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Danish DPA found that the Financial Supervisory Authority failed to properly anonymize whistleblower information, allowing a journalist to identify individuals. This case underscores the need for strong data protection measures, especially for sensitive information. Organizations must ensure their anonymization methods are robust and cannot be easily reversed.
What happened
The Danish Financial Supervisory Authority did not adequately anonymize whistleblower information, leading to a data breach.
Who was affected
Individuals who reported through the whistleblower scheme and whose identities were exposed.
What the authority found
The Danish DPA found that the Financial Supervisory Authority did not implement sufficient security measures to protect whistleblower identities.
Why this matters
This case highlights the critical importance of effective anonymization techniques, especially for sensitive data like whistleblower reports. Organizations must ensure their data protection methods are foolproof to prevent unauthorized access to personal information.
GDPR Articles Cited
The Danish Financial Supervisory Authority (FSA) (the controller) received a request for access to documents from a journalist regarding information collected via its whistleblower scheme. On 31 May 2020, the FSA complied with the request under [https://www.retsinformation.dk/eli/lta/2020/145 The Public Access to Information Act] after removing the identifiable personal data relating to the reporting individuals. On 6 June 2020, one of the whistleblowers complained with the FSA that the journalist contacted them by email. The FSA investigated the matter and learned that, due to a software feature, it was possible to unredact the blackened parts and extract the supposedly anonymised information. After learning about the data breach, the Danish DPA (Datatilsynet) assessed whether the controller implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risks of processing. The DPA held that processing information received via a whistleblower scheme poses a higher risk to data subjects' rights. Therefore, the appropriate security measure must ensure that material passed on to others does not contain personal data that could reveal their identities. According to the DPA, especially in such cases, the controller must choose an anonymisation method that does not leave traces of the removed personal data, not even in metadata. As a result, it should not be easy to circumvent the redaction with standardised tools. The DPA established that the controller's internal policies were not clear and precise enough to ensure that the caseworkers adequately anonymise personal data. Also, the peer training did not provide appropriate security by providing clear and accurate instructions. Moreover, the DPA noted that the controller lacked the necessary understanding of which methods it must implement to remove information from the documents, including the metadata, so that the information can no longer be retrieved. Consequently, th
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Finanstilsynet in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Finanstilsynet - Denmark (2022). Retrieved from cookiefines.eu
Last updated: