Processing of personal data related to Danish research projects

3 October 2022

Background information

  • Date of final decision: 8 September 2022
  • Cross-border case or national case: cross-border case
  • If cross-border, LSA: Icelandic SA
  • and CSAs: Danish SA
  • Controller: deCODE Genetics
  • Legal Reference: Principles relating to processing of personal data (Article 5), Lawfulness of the processing (Article 6), Processor agreement (Article 28), Security of processing (Article 32)                   
  • Decision: in accordance with the GDPR
  • Key words: sensitive data, health records, research


Summary of the Decision


Origin of the case

A complaint from the Danish patient rights organisation Patientdataforeningen on behalf of a Danish person.


Key Findings

The case regards the processing of personal data related to Danish research projects by the genetic research company deCODE Genetics. The processing has taken place with reference to data processing agreements which the Danish Capital Area has made with the company, and the complainant considered that the company had exceeded its role as a processor and thus itself become a controller of unlawful processing. The Icelandic SA did not consider the case file to support this and the conclusion was therefore that the processing had been in accordance with the law.



The processing was considered to be in accordance with the law.


For further information: decision in national language "A ruling on the processing of personal data related to Danish research projects".

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.