Privacy and Data Security
The Data Protection Regulation encompasses the EU legal rules on data protection applicable to all member states in the EU. In Denmark, the Data Protection Regulation is supplemented by the Data Protection Act.
The purpose of data protection rules is to strengthen the legal rights of individuals in relation to public authorities, private companies, multinational corporations, associations, etc., who process personal data.
What is considered personal data?
Data protection rules concerns the processing of personal data. Personal data means any information relating to an identified or identifiable natural person. When processing personal data, a distinction is made between personal data (non-sensitive personal data) and special categories of personal data (sensitive personal data). Non-sensitive personal data may include, for example, name, address, email, etc. Sensitive personal data, on the other hand, includes information about racial or ethnic origin, political opinions, religious, or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying, health information, and sexual life or sexual orientation.
When is personal data processed?
Data protection rules apply to the processing of personal data, which includes any operation or set of operations which involves personal data, such as collection, recording, organization, structuring, storage, adaptation, etc.
There must always be a legal basis for processing personal data, and stricter requirements apply to the processing of sensitive personal data. Generally, processing sensitive personal data is prohibited, but the data protection rules include some exceptions.
As an employer, it is crucial to be aware that personal data is processed both before employment (during recruitment), during employment, and after the expiry of the employment relationship.
Rights of the Data Subject
The individual whose personal data is processed is referred to as the "data subject." According to data protection rules, the data subject has certain rights which the data controller (typically the employer in an employment relationship) must adhere to during the processing of personal data.
The data subject has the right to be informed about the processing of their personal data. The specific information which must be provided depends on whether the personal data has been collected from the data subject or from a third party.
The data subject has a right to access. This allows the data subject to confirm whether the data controller processes their personal data and, if so, which personal data is being processed. The data subject may also be entitled to receive a copy of the personal data.
The data subject also has the right to rectification, whereby the data controller must ensure that inaccurate or incomplete personal data about the data subject is completed.
Furthermore, the data subject is entitled to, in certain cases, have their information deleted. This may be the case, for example, when the personal data is no longer necessary for the purpose for which it was collected, or if the data subject withdraws their consent to the processing of personal data.
The data subject has the right to restrict future processing of their personal data. This applies, for example, when there is doubt about the accuracy of the personal data, preventing further processing until the accuracy has been clarified.
Moreover, the data subject may under specific circumstances be entitled to object to otherwise lawful processing and to data portability. The right to data portability allows the data subject, under specific circumstances, to have their data moved from one data controller to another.
The data controller must establish procedures to ensure the observation of the data subject's rights before commencing the processing of personal data. Additionally, all information provided by the data controller to the data subject must be presented in a transparent, concise, understandable, and easily accessible manner.
Sanctions for Violating Data Protection Rules
In Denmark, the Danish Data Protection Agency oversees compliance with data protection rules. The Danish Data Protection Agency's two main tasks are handling complaints and supervision. In this context, the Danish Data Protection Agency has the authority to issue warnings, express criticism, or issue orders. Additionally, the Danish Data Protection Agency can impose proposed fines.
Violating the data protection rules may have significant consequences for companies – both financially and in terms of the company's reputation. We assist companies and other employers who are data controllers, in complying with data protection rules.
