No compensation for injury in spite of violation of the Danish data processing rules

Two employees were not awarded compensation in spite of a violation of the Danish Act on Processing of Personal Data. The extent of the violation was limited and had not affected the substantive correctness of the findings in the two personnel matters. That was the conclusion reached in the ruling made by the Danish Supreme Court in a case (277/2015) about the award of compensation to two employees because their employer had processed their personal data contrary to the Danish Act on the Processing of Personal Data.

Banedanmark dismissed three employees due to long periods of absence from work owing to illness. In accordance with the procedural rules, the employees were requested to submit medical reports in connection with the dismissal procedure. Under the procedural rules, the medical reports were to be sent directly to the Health Board without the employer being informed of the contents.

Due to an error, the medical reports relating to two of the employees were scanned, added to the case files and used in the case administration. Banedanmark admitted in the court that this action violated section 7(1) of the Danish Act on Processing of Personal Data on sensitive data, including health data.

Accordingly, the question was whether the two employees were entitled to compensation for injury under section 26(1) of the Danish Liability for Damages Act due to a violation of the Danish Act on Processing of Personal Data.

According to the evidence submitted in the Danish High Court the health data had not been distributed to a large number of persons, as only a limited number of persons handling personnel matters in Banedanmark had access to the medical reports that were kept in a "closed" filing system. In its judgment, the Danish High Court also took into account that the violation had not affected the substantive correctness of the result of the personnel matters.

The Danish High Court thus found that even if the Danish Act on Processing of Personal Data had been violated, it was not such an unlawful violation of the employees' rights that there would be any basis for awarding compensation for injury under section 26(1) of the Danish Liability for Damages Act.

The Danish Supreme Court upheld the Danish High Court's judgment on this point, citing the Danish High Court's reasons.

The result shows that a violation of the Danish Act on Processing of Personal Data has to be particularly "gross" in order to be an "unlawful violation" entitling persons to compensation for injury under section 26 of the Danish Liability for Damages Act.

However, extensive case law shows that a violation of the Danish Act on Processing of Personal Data may entitle persons to compensation for injury. It is therefore important to remember that a violation of the Danish Act on Processing of Personal Data cannot merely entail criminal liability but, in cases of a more serious nature, also liability to pay compensation for injury, which can be very expensive if there are many aggrieved parties.

Read the Danish Supreme Court's judgment (in Danish)

Latest news on Data Protection Law

Data Protection Law