[Complainants contact information]
Excempt from publicity:
The Freedom of Information Act
Section 13, cf. the Personal Data Act
Section 24 first paragraph, second
sentence
Your reference Our reference Date
20/02107-18 02.03.2023
Closure of case – Transmotor ApS
Datatilsynet refers to your complaint of 6 May 2019 regarding the processing of your personal
data by Transmotor ApS (Transmotor). We informed you in a letter of 21 January 2021 that
this is a so-called cross-border case, which according to data protection rules is subject to
different case handling rules than ordinary cases, see Article 4(23) and 56(1) GDPR. The case
has been handled by the Data Protection Authority in Denmark as lead supervisory activity,
since the company has company has its sole establishment in Denmark. The Norwegian and
Swedish Data Protection Authorities have participated in the case as concerned supervisory
authorities.
About the case handling
The Danish Data Protection Authority has investigated the case by contacting Transmotor.
They also asked for your feedback to the company’s response. They have cooperated with us
and the Swedish Data Protection Authority to assess the case based on your complaint and
other information you have given us, in addition to the response from the company. We have
together with them made a decision. The case handling has followed the procedure in Article
60 of the GDPR, whereby the Data Protection Authority in Denmark presented a draft
decision. We agree with the Danish Data Protection Authority’s draft decision and we are
therefore taking the final decision in line with their conclusions.
Our assessment
The Data Protection Authority closes the case with reference to the reasons in the decision
that follows below. The decision is written in English, but we can assist with translation. If
you want us to translate, please contact us.
Postadresse: Kontoradresse: Telefon: Org.nr: Hjemmeside: 1
Postboks 458 Sentrum Trelastgata 3 22 39 69 00 974 761 467 www.datatilsynet.no
0105 OSLO 0191 OSLO
Complaint about Transmotor ApS
1. The Danish Data Protection Agency (hereinafter referred to as the ‘Danish DPA’)
hereby returns to the case, where you on 6 May 2019 have complained to the Norwegian
Data Protection Authority about the processing of your personal data.
In accordance with Article 56 of the GDPR1, the Danish DPA has been designated as
the lead supervisory authority in the case. The Norwegian and Swedish DPAs have been
involved as concerned supervisory authorities.
2. Facts of the case
The Danish DPA has understood your inquiry as a complaint regarding the Chief
Executive Officer of Transmotor ApS’ (hereinafter “Transmotor”) access to your work
e-mail for an undefined period of time, without your consent and without informing you
of this access, while you were employed at Transmotor Norge AS.
According to the case facts, Transmotor Norge AS was a subsidiary to Transmotor ApS
while you were employed. Subsequently, Transmotor Norge AS went bankrupt. It is the
the DPA’s understanding, that the Chief Executive Officer of Transmotor ApS acted as
Chief Executive Officer of Transmotor AS as well.
Furthermore, you have stated that Transmotor disclosed personal data regarding your
resignation to Transmotor’s customers, suppliers and collaborators.
In contrast, Transmotor has stated that the company informed you about Transmotor’s
access to your work e-mail. Transmotor claims that the access to your e-mail has been
in accordance with the Danish DPA’s guidelines and the principles for the processing
of personal data in Article 5 of the GDPR. According to Transmotor, the company had
a legitimate interest on the basis of Article 6(1)(f) of the GDPR in accessing relevant
correspondence with suppliers and business partners and that the access to your e-mail
has been used only for this operational purpose after termination of the employment.
Furthermore, Transmotor has stated that Transmotor only kept the e-mail active for a
period as short as possible after the termination of the employment considering your
position and function, and that your e-mail has been deactivated subsequently.
Furthermore, Transmotor has stated, that Transmotor is not the data controller of the
processing of personal data. In the view of Transmotor, the fact that Transmotor Norge
AS was declared bankrupt does not mean that the Danish company succeeds in the
controllership of Transmotor Norge AS.
On the 22th of June 2022, the Danish DPA requested you of a copy of the transmitted
e-mail regarding your resignation. By e-mail of August 2 2022 you have stated, that you
cannot find the e-mail in question.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2
3. The Danish DPA’s assessment
The Danish DPA has considered the information provided in the case, and on this basis
conducted a brief investigation of the matter. Subsequently, The Danish DPA has
concluded that the DPA will not take further action in connection with your inquiry of
6 May 2019. The case hence is concluded with this letter.
The reasons for the Danish DPA’s conclusion are set out below.
Initially, the Danish DPA notes that there is conflicting information in the case with
regards to whether Transmotor provided you with sufficient information regarding
Transmotor’s access to your work e-mail. You claim that you did not receive
information hereof and Transmotor, on the other hand, stated that you were well aware
and sufficiently informed. The Danish DPA notes, that the DPA is not able to carry out
an actual evidence assessment when there is disagreement between the parties about the
facts in the case as the Danish DPA handles cases on a written basis. The final
assessment of such evidential issues should be determined by the police or the courts,
which, unlike the Danish DPA, have the opportunity to clarify the facts, e.g. by
questioning witnesses. The Danish DPA finds that there are no grounds for the DPA in
the present case to file a police report.
Furthermore, in the Danish DPA’s view, it is uncertain whether Transmotor ApS (and
not Transmotor Norge AS) is to be considered the data controller for the processing of
personal data in question, including sending the e-mail to Transmotor’s customers,
suppliers and collaborators.
Finally, in the opinion of the Danish DPA, your complaint only to a limited extent
concerns data protection law, as the case mainly concerns issues of employment law
due to an employment law dispute.
It is the Danish DPA’s assessment, that a further examination and use of the Danish
DPA’s resources associated with such an examination is not commensurate with what
could be achieved by doing so.
The Danish DPA refers to Article 57(1)(f) of the GDPR, which states that the DPA must
deal with complaints lodged by a data subject and, where appropriate, investigate the
subject matter of the complaint.
It follows from the said provision that the DPA decides whether it is appropriate to
examine the subject matter of the complaint. In making this assessment, the DPA may,
for example, consider the resources available to the DPA and the potential result
expected to be achieved by an examination of the subject matter of the case. When the
Danish DPA has concluded that it does not intend to initiate a further investigation of
the matters, it is due to the fact that the Danish DPA has assessed what could potentially
be achieved by initiating a further investigation of the case, including to what extent it
could specifically improve your legal position, or whether such an investigation could
in general be suitable for raising the level of data protection.
3
The Danish DPA hereby considers the case to be closed, after having obtained the
approval of the concerned supervisory authorities, and will take no further action in
connection with your inquiry.
Legal review of the decision
Since this is a cross-border case and a final decision has been made, it is not
possible to file an administrative complaint against the decision. The Personal Data Act
section 22 second paragraph, second sentence, states that decisions made through cooperation
between the lead supervisory authority and other supervisory authorities concerned cannot be
appealed to the Privacy Appeals Board.
You may challenge the decision before the courts if you are of the opinion that the decision is
incorrect or invalid.
Best regards
Tobias Judin
Head of Section
Guro Fiskvik Åsbø
Senior legal advisor
This document is signed electronically and therefore includes no handwritten signatures
4