The court in Aarhus has per. on 12 February 2021 handed down the first Danish GDPR judgment, and the Court has imposed a fine of DKK 100,000 on the company Ilva A / S. Ilva A / S had unnecessarily stored around 350,000 personal data in an older and almost phased-out customer data system.
It was the Danish Data Protection Agency that recommended the case to the prosecution with a decision that the fine should be DKK 1.5 million. The prosecution subsequently agreed with this decision.
These were mediating circumstances
The court in Aarhus ruled that Ilva A / S’s violation of GDPR GDP’s rules had been negligent, and that it was merely an oversight. In addition, the Court found it reprehensible that the Public Prosecutor’s Office and the Danish Data Protection Agency had not taken acceptable consideration in the mediating direction of the circumstances which make the assessment of an illegal act more lenient, as these mitigating circumstances appear directly from the GDPR rules.
These were the following mediating circumstances:
- A first-time offense
- The information was not of a personal nature
- The customer data system in which the information was located was older and partly phased out
- No registered persons were injured
- The infringement was of a formal nature
Ilva A / S had also carried out a number of compliance measures to ensure that the company’s legal and IT technical systems were in accordance with the GDPR’s set of rules. There were a total of 57 computer systems. This weighed heavily in the Court’s assessment.
This verdict is the first that has been handed down in the courts, and the case will most likely be appealed to the High Court. We at Advokatgruppen therefore follow the ruling with great interest. If you are more interested in GDPR, you can read about the Danish Data Protection Agency’s new guide on calculating GDPR fines for companies here.
Do you need to check if your company follow the GDPR rules?
We at Advokatgruppen have a large team of specialists within GDPR. We can therefore give you and your company competent advice, as we are always up to date. We are strongly represented in Jutland, and you can find our skilled lawyers in Horsens, Fredericia and Aarhus. Therefore, contact us for a non-binding and free conversation about GDPR.