What happened
The authority expressed serious criticism of Nuuday A/S for processing that did not comply with section 11(2) of the Danish Data Protection Act or with Articles 12(3) and 15 of the Regulation. A person telephoned to ask whether broadband was available at their address and was asked for their national identity number; they wrote the same day asking why it had been collected and on what basis, and asked for access to everything the company held about them. The decision records the request as made on 5 Dec 2020 and answered on 3 May 2021. The answer was also incomplete: further data held under a mail product and under a brand that had since closed came to light only after the requester commented in the complaint, and were sent afterwards. The company accepted that it had neither a purpose nor a legal basis for collecting the number, and that access had not been given in time.
What changes at the desk
An identifier collected as a matter of routine is collected without a basis, and it costs twice: once as unlawful processing and once as data you then have to disclose and explain. Before you close a request, walk the systems the relationship has actually passed through, including brands and products that no longer trade, because a second answer sent after somebody complains is still a late answer and the authority counts it as one.
Primary source
DecisionDenmark16 Feb 2022
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.