Criticism of failure to fulfill information obligations Summary Our remarks The case began when the Danish DPA became aware • Sharing information about a party’s key issues to of the Conservative political party’s processing of potential voters may constitute a legitimate interest personal data in relation to sending letters to selected that can serve as a legal basis for processing households about the European Parliament elections personal data in the form of names and addresses. and general election in 2019 following several specific inquiries in 2019. • The exception to the obligation to provide information in Article 14(5)(c), which allows for The Conservative Party collected the names and exemption when personal data is an explicitly addresses of selected recipients to send them letters established right according to Danish practice, about the party’s key issues. When asked to provide should be interpreted narrowly. For the exemption information to the data subjects (recipients of the to apply, legislation must explicitly state that the letters), the party stated that they were exempted obligation to provide information is exempted from from this obligation as the collection of names and the processing activity in question. addresses for the purpose of sending a letter is an explicitly established right under Danish case law and • In the context of sending letters, publishing does not override the interests of the data subject. information on the controller’s website does not fulfill the information obligation, as the controller is The Conservative party cited GDPR, Article 6(1)(f) not actively providing the information to the data (legitimate interest) as the basis for processing. subject. The Danish Data Protection Agency’s decision The DPA concluded that the Conservative Party’s processing of personal data was conducted within the framework of GDPR, Article 6(1) (legal basis for the processing of general personal data). The Danish DPA criticized that the party’s processing of personal data had not been carried out in accordance with the rules in GDPR, Article 14 (obligation to provide information when the data has not been collected from the data subject). Published: 22-12-2021, Journal number: 2019-431-0031 Topics: 02 Right of access and obligation to provide information 117