The Danish Supreme Court held that any unauthorised disclosure of personal data in connection with a case concerning access to files constitutes an actionable error that may result in the payment of compensation under Article 82(1) of the General Data Protection Regulation (GDPR) provided that the data subject proves that the disclosure is likely to affect the data subject’s sense of self-respect and honour or otherwise have a negative impact on the data subject.
Background to the case
In April 2019, the Municipality of Hillerød received a request for access to files from a resident’s former spouse. When processing the request for access to files, an otherwise experienced case handler with the Municipality failed to notice a health detail about the mental health condition of the resident’s current spouse, appearing from an application for financial support for a stay at a residential secondary school, as well as information on the resident’s monthly disposable income, which appeared from the grant decision itself. The information was therefore, by mistake – and as part of the standard procedure for processing requests for access to files – disclosed to the resident’s former spouse.
The resident’s former spouse subsequently disclosed the health detail to the Agency of Family Law, where a case was pending concerning visitation rights in respect of the former spouse’s and the resident’s child.
It was undisputed before the Supreme Court that the disclosure of the data on the spouse’s health took place in violation of Article 9 of the GDPR, and that the disclosure of data on the resident’s monthly disposable income took place in violation of Article 6 of the GDPR.
The two spouses each claimed compensation of DKK 55,000. They claimed, among other things, that the unauthorised disclosure had caused them non-material damage falling within the scope of Article 82 of the GDPR, and that the disclosure also constituted an infringement of their right to privacy under Article 8 of the European Convention on Human Rights (ECHR).
Partner Jacob Schall Holberg, lawyer, represented the Municipality of Hillerød and Local Government Denmark, intervening as a third party before the High Court and the Supreme Court.
Judgment of the High Court of Eastern Denmark
The High Court of Eastern Denmark found that the spouse had suffered non-material damage within the meaning of the GDPR, in particular as the High Court attached importance to the fact that the information in question was highly sensitive health data, that the information had subsequently been used by the former spouse in an email reply to the Agency of Family Law in a family law dispute and to the spouse’s explanation of the disclosure.
The High Court also found that the Municipality of Hillerød had not proved that it was not at fault in the event that gave rise to the damage and, consequently, the Municipality could not be exempted from liability under Article 82(3) of the GDPR.
Following an overall assessment, the compensation payable to the spouse was fixed at DKK 2,500. In determining the amount, the High Court took into account, for example, the nature of the health data, its subsequent disclosure to the Agency of Family Law and the Municipality regretting the incident.
However, the High Court found that the resident had not suffered any non-material damage within the meaning of the GDPR as a result of the disclosure of the spouse’s health data or the resident’s monthly disposable income.
The High Court further found that the data breach was not of such a serious nature as to provide grounds under s. 26 of the Danish Liability for Damages Act (erstatningsansvarsloven) for awarding compensation for injury to the plaintiff's dignity or self-respect, nor had Article 8 of the ECHR been violated.
The resident and the spouse subsequently lodged an appeal with the Supreme Court against the judgment delivered by the High Court of Eastern Denmark.
Supreme Court judgment of 24 August 2026
In its judgment (in Danish only), the Supreme Court found, at the outset, that four of the appellants’ six claims had to be dismissed, in particular as they constituted allegations in support of the appellants’ two claims for payment.
The Supreme Court subsequently ruled that the Municipality of Hillerød could not be exempted from liability under Article 82(3) of the GDPR, stating in that respect that "[…] the Municipality’s disclosure of the information on A and B to C must be deemed to give rise to liability on the part of the Municipality of Hillerød. It was thus a clear error that the information was disclosed in violation of Articles 6 and 9 of the GDPR."
As for the disclosure of information on the spouse’s health, the Supreme Court found that the spouse had suffered damage within the meaning of Article 82 of the GDPR due to the fact that the health data constituted "highly sensitive and private information" which was disclosed to a private individual (the former spouse), with whom the spouse "had conflicting interests and who, as a result of the disclosure, became aware – or at least had confirmed – that A suffers from a serious mental health condition".
The Supreme Court found that the former spouse had disclosed the information to the Agency of Family Law and that: "The disclosure of the information to C [the former spouse] was, by its very nature, likely to affect the [spouse’s] sense of self-respect and honour". The former spouse had explained that, even before the Municipality disclosed the information, she was aware that the current spouse suffered from the condition in question. In this case, however, the Supreme Court emphasised that "the Municipality’s disclosure of the information meant, according to [the former spouse], that she was certain that it was true".
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
