On September 12, 2023, the Danish data protection authority (Datatilsynet) published, its decision in Case No. 2022-31-6316, as issued on the same date, in which it expressed criticism against a housing association, for violations of the General Data Protection Regulation (GDPR), following a complaint made to the Datatilsynet.

Background to the case

The complainant stated that on March 31, 2022, they submitted a data subject access request (DSAR) to the housing association requesting access to records of complaints made against them including witness statements and related documents.

The Datatilsynet noted that the housing association responded to the complainant on April 11, 2022, stating that it would not give access to the complainant, on the basis that the association was not subject to the rules on access to documents under the Public Information Act or the Public Administration Act.

Findings of the Datatilsynet

Following its investigation, the Datatilsynet noted that the complainant's DSAR covered personal data about the complainant in the form of reports made by the complainant's neighbors in the housing association. In this regard, the Datatilsynet found that by denying the DSAR the housing association had violated Article 15(1)(g) of the GDPR which gives a data subject the right to access any available information such as the source of personal data when it is not collected from the data subject.

Further, the Datatilsynet noted that the housing association's handling of the DSAR was in violation of Articles 12(1), 12(2), and 12(3) of the GDPR.

Outcomes

Ultimately, the Datatilsynet issued criticism against the housing association for the aforementioned violations.

You can read the press release here and the decision here, both only available in Danish.