Statens Serum Institute – Violation Found (Denmark, 2023)

Following a citizen’s inquiry, the Danish DPA initiated an investigation regarding a medical institute’s (Statens Serum Institut or SSI) fulfillment of the obligation to provide information under Article 14(1) to 14(4) GDPR with regard to certain operations carried out by the SSI. The SSI receives and analyses biological samples taken from patients (for example blood samples) for diagnostic analysis purposes which is done as part of the institute's exercise of authority pursuant to Section 222 of the Danish Health Act. In addition, SSI processes other information about the person (e.g. the person’s name and ID number). After a diagnostic analysis has been carried out, often resulting excess biological material is stored in Denmark's National Biobank for future research purposes. The SSI argued that the exception under Article 14(5)(b) of said information obligations applies, as informing would require a disproportionately large effort in the form of large administrative and financial costs. The SSI's laboratory information system is over 20 years old and does not currently support automatic notifications which means that the SSI would need to inform individuals manually. Additionally, the SSI viewed that the concerned persons’ interests were covered by making general information about the collection available online on their websites. With regard to storing data in the national biobank for further research purposes, the SSI argued that the processing is compliant with the GDPR, as the further processing is not seen incompatible with the original processing purposes pursuant to Article 5(1)(b) GDPR. The Danish DPA made the assessment separately regarding when the SSI a) received biological samples for analysis and b) where residual material is stored in the national biobank. Firstly, the DPA considered that a balancing of interests must be done when assessing whether compliance with the obligation to provide information can be considered to require a disproportio