Denmark

Datatilsynet criticized Odense Municipality for inadequate deletion routines and excessive retention of citizen case files, contrary to GDPR Article 5.

Datatilsynet participated in coordinated scrutiny of Meta's behavioural advertising practices, emphasizing lawful basis and transparency obligations under GDPR Articles 6, 12 and 13.

Datatilsynet reviewed customer communications and retention controls at Danske Bank, identifying shortcomings in lawful retention and internal access governance under GDPR Articles 5, 6 and 32.

Datatilsynet issued serious criticism after personal data was exposed through misconfigured municipal self-service systems, raising GDPR Articles 24, 25 and 32 concerns.

Datatilsynet assessed loyalty-program processing and found insufficient transparency around profiling and marketing uses of customer data under GDPR Articles 12, 13 and 21.

Datatilsynet criticized the Capital Region over excessive employee access to patient information and insufficient logging controls, implicating GDPR Articles 5 and 32.

Datatilsynet found unlawful disclosure of children's and parents' data through school IT systems and criticized the municipality for inadequate risk assessment and security under GDPR Articles 5, 24 and 32.

Datatilsynet proposed a fine after a processor security incident involving inadequate access restrictions and insufficient technical safeguards under GDPR Articles 28 and 32.

Datatilsynet criticized and referred Gladsaxe Municipality after serious security deficiencies exposed schoolchildren's and employees' personal data, engaging GDPR Articles 5, 24 and 32.

Datatilsynet recommended a fine against taxi company Taxa 4x35 for retaining customer booking data for too long without a valid retention basis, contrary to GDPR Articles 5 and 25.