30 May 2023
J.No. 2021-7329-0015
Doc.no. 585600
Caseworker
Final decision in A60DD388828
The Danish Data
Protection Agency
1. The Danish Data Protection Agency, Datatilsynet (“Danish DPA”) refers to the complaint Carl Jacobsens Vej 35
against Resurs Bank AB (“Resurs Bank”) you submitted on May 26 2020 concerning the fact 2500 Valby
Denmark
that, in May 2020, an employee at Resurs Bank disclosed your sensitive personal data about
T 3319 3200
a plastic surgery to third parties. [email protected]
datatilsynet.dk
After having reviewed your complaint, the Danish DPA concluded that your complaint con- VAT No. 11883729
cerned a cross-border processing of personal data (within the meaning of Article 4(23) of the
General Data Protection Regulation (GDPR)) 1, which meant that the case had to be processed
in cooperation with the supervisory authorities of other EU/EEA Member States in accordance
with Article 60 GDPR.
In cases that concern a cross-border processing of personal data, the supervisory authority of
the main establishment or of the single establishment of the relevant company – which in this
case is located in Sweden – shall be competent to act as lead supervisory authority. Thus, in
the present case, the Swedish Authority for Privacy Protection, (“IMY”), acted as lead supervi-
sory authority.
2. Initially, before it was clarified that IMY was the lead supervisory authority in the case, the
Danish DPA – on 23 June 2020 – asked Resurs Bank about the circumstances regarding your
complaint. The Danish DPA received an answer from Resurs Bank on 25 June 2020.
Following the finding that IMY was the lead supervisory authority – on 16 June 2021 – the
Danish DPA shared your complaint and Resurs Bank’s answer of 25 June 2020 with IMY for
the further handling of the case.
3. After examining the case, IMY did not find any reason to take any action on the complaint.
This was due to the fact that IMY shall handle complaints and, to the extent appropriate, in-
vestigate the subject matter of the complaint.
1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the pro-
tection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeal-
ing Directive 95/46/EC (General Data Protection Regulation
A further investigation of the case — regardless of whether IMY would find that there had been Page 2 of 2
a breach of data protection law — will not significantly improve your legal position. IMY is of
the opinion that the use of resources associated with such a further investigation is not com-
mensurate with what could be achieved by the investigation.
In this assessment IMY has emphasized that, Resurs Bank has notified IMY of the personal
data breach as a consequence of your complaint, that the notification contains a description
of the measures taken by Resurs Bank, inter alia Resurs Bank have taken labour law mea-
sures, the relevant department was gathered immediately for a renewed oral training on bank-
ing secrecy and an information letter was sent to the entire office in Denmark explaining how
important and central banking secrecy is in the bank’s operations and the consequences of
breaching it as an employee.
4. On this basis the Danish DPA must close the case and will take no further actions. However,
it takes note of the information you provided in your complaint, which may be used for future
investigative purposes.
The Danish DPA refers to Article 57(1)(f) of the General Data Protection Regulation, which
states that the supervisory authority must deal with complaints lodged by a data subject and,
where appropriate, examine the subject matter of the complaint.
5. The Danish DPA notes that the supervisory authority’s decisions cannot be challenged be-
fore another administrative authority, cf. Section 30 of the Data Protection Act. However, the
Danish DPA’s decisions may be brought before the courts, cf. section 63 of the Constitution.