Denmark: Issued ruling in Datatilsynet investigation into Dansk Retursystem's app "Pant" for alleged unauthorised processing of sensitive user financial information

On 26 September 2024, the Danish Data Protection Authority (Datatilsynet) issued a decision in an investigation into Dansk Retursystem's mortgage app, 'Pant' for unauthorised processing of sensitive user financial information. The investigation focused on the concerns raised regarding the app's features, such as its ability to track user's locations, access extensive information on devices, and interact with user's banks. The decision mandates that Dansk Retursystem review its data processing practices to comply with Article 5 on the principles relating to processing of personal data and Article 25 on data protection by design of the General Data Protection Regulation to ensure that only necessary information is processed legally, fairly, and transparently. The decision set a compliance deadline of 2 January 2025 and warned that using a third-party solution for account information, which may involve processing excessive personal data, could violate data protection regulations.