The Danish Data Protection Authority ruled that an employer could legitimately refuse an access request from a former employee because the requested data were subject to ongoing judicial proceedings, constituting an overriding private and public interest justifying a derogation from the right of access. However, the authority criticized the employer for not sufficiently justifying its refusal to the data subject.

Facts and context

The Danish Data Protection Authority (Datatilsynet) published a decision in which it considered that an employer could refuse an access request from a former employee but issued a criticism for insufficient justification of this refusal.

The case originated from a complaint by a former employee who was dismissed and denied access to data used as the basis for his dismissal, including private correspondence on an instant messaging service.

Reasons for the decision

• Obligation to respond to an access request (Article 15 of the GDPR): The authority considered that the employer was entitled to refuse the access request. It held that the complainant's interest in obtaining the information had to give way to overriding private and public interests, pursuant to Article 22 of the Danish Data Protection Act. These overriding interests consisted of the need to protect individuals involved in private criminal proceedings initiated by the complainant himself, as well as to ensure the proper conduct of these judicial proceedings. The authority thus validated the reasoning that the judicial context justified a limitation of the right of access.

• Obligation to provide information on the outcome of a request (Article 12, paragraph 4, of the GDPR): However, the authority criticized the employer regarding the justification of its refusal. The justification provided to the complainant was deemed too general and did not sufficiently specify the concrete circumstances and specific interests taken into account in the balancing exercise. Referring to Article 12, paragraph 4, of the GDPR and the European Data Protection Board (EDPB) Guidelines 01/2022, the authority recalled that a justification must be detailed enough to allow the data subject to understand the reasons for the refusal and to assess the opportunity to exercise a remedy.

Decision of the authority

Consequently, the authority issued a criticism to the company for not providing sufficient justification for its refusal of access.

Lessons learned

This decision reminds that:

• The right of access is not absolute and may be limited when the requested data are at the heart of ongoing judicial proceedings, as protecting the rights of other parties and ensuring the proper administration of justice may constitute overriding private and public interests.
• The refusal to grant an access request must be justified in a sufficiently concrete and specific manner, explaining the interests that prevailed, so as to enable the data subject to understand the decision and consider a remedy.
• A supervisory authority may refrain from ruling on the lawfulness of processing when this issue is already being examined by a court in separate proceedings.