Transmitting sensitive information through text message Summary Our remarks During the evening of 2nd September 2021, a young • The Danish DPA is generally of the opinion that person approached Joannahuset, which is a child/ the transmission of sensitive data via transmitting youth crisis center offering shelter to young people. sensitive information through text message involves Joannahuset then contacted the young person’s a significant risk to the rights and freedoms of current foster home to obtain consent for the young data subjects. As with transmission by e-mail, the person to spend the night at Joannahuset. risk of transmitting sensitive information through text message via the Internet is at the ”high end of The Danish DPA was informed that Joannahuset had the scale”. The Danish DPA states that these risks previously been in dialogue with the young person and can only to a very limited extent be mitigated by had given him or her shelter. According to Joannahuset, measures taken by the data controller itself. the dialogue with the young person’s municipality of origin had previously been difficult. • In the specific case, the Danish DPA assessed that data protection requirements in special cases On this basis, the staff at Joannahuset assessed that must give way to other weightier considerations, in the specific situation, there was a particular need including, for example, the urgent need to to ensure that the identity of the young person and safeguard life and health in relation to particularly the identity of the person who gave consent from the vulnerable groups of people. According to the municipality were clearly established and could be Danish DPA, such relaxation of data protection documented. Joannahuset, therefore, requested the must be based on a specific assessment, and the municipality of origin to transfer the young person’s considerations must be documented. social security number via transmitting sensitive information through text message. The normal procedure for securely obtaining social security numbers thus deviated from fulfilling the young person’s urgent request for shelter. The Danish Data Protection Agency’s decision The Danish DPA did not overturn Joannahuset’s assessment in this specific situation, considering the young person’s best interests, arising in an acute situation and with limited possible solutions. This outweighed the consideration of the protection of personal data since the young person could have suffered a greater loss of rights if the transmitting sensitive information through text message in question had not been sent. Published: 27-04-2022 Journal number: 2021-431-0151 Tags: 05 Data security 114