Disclosure of sensitive information about an ex-employee requires specific consent

Last updated on July 31, 2011

The Supreme Court held that a local authority's disclosure of sensitive information to a future employer was contrary to the Danish Data Protection Act as the employee had not given her express consent. As a result of the disclosure of the information, the local authority was ordered to pay DKK 25,000 as compensation for tort to the ex-employee.

Facts of the case: During a job interview with the Local Authority of Skævinge (now the Local Authority of Hillerød) the employee A consented to the local authority's collection of reference information from her former employer, the Local Authority of Elsinore. After the interview, it appeared that the appointments committee of the Local Authority of Skævinge did not consider A to be the right candidate for the job. But as there were no other candidates for the job, the Local Authority of Skævinge nevertheless contacted the former employer (the Local Authority of Elsinore) to collect reference information on A.

During the reference conversation, the Local Authority of Skævinge asked generally about the reason why A was dismissed by the Local Authority of Elsinore, and the reason was many days of absence due to sickness. In that connection, it was mentioned that the Local Authority of Elsinore had confronted A with suspicion of alcohol abuse, which was, however, strenuously denied by A.

The Local Authority of Skævinge found that the reference information did not change their opinion of A not being the right candidate for the job, but on the contrary confirmed their opinion. The Local Authority of Skævinge subsequently called A to inform her that she did not get the job and she was also informed about the suspicion of alcohol abuse.

A then contacted her union that brought the case before the courts claiming damages and compensation as they believed that the information was confidential and decisive for the Local Authority of Skævinge's decision not to employ A. The union sued both local authorities claiming that the local authorities had acted contrary to the Statement of Health Act, the Data Protection Act and the Public Administration Act.

The Supreme Court held first and foremost that the Statement of Health Act does not cover information concerning the abuse of stimulants.

The Supreme Court therefore heard the matter on the basis of the Data Protection Act and the Public Administration Act and held in that connection that the information about the possible alcohol abuse was given unsolicited. The Local Authority of Skævinge could not be held accountable for having asked generally about the reason for A's dismissal.

On the other hand, the Local Authority of Elsinore could be held liable for violation of the prohibition against disclosure of sensitive information contained in the Data Protection Act as A had not specifically consented to the disclosure of the suspicion of her possible alcohol abuse. The Local Authority of Elsinore was consequently ordered to pay DKK 25,000 to A as compensation for tort.

The Supreme Court held that there was no basis for awarding A damages as the information was not considered decisive for the decision of the Local Authority of Skævinge not to employ A.

iuno's opinion

The course of events was characterised by uncertainty as to whether the abuse of stimulants is covered by the Statement of Health Act, but the Supreme Court held that that was not the case.

The decision further shows that an employer must exercise utmost care and obtain express consent if the employer wishes to disclose sensitive information about an employee.

[Decision made by the Supreme Court on 27 May 2011 in case no.- 286/2009]