The last lesson pulls the threads together. What do you risk if the rules are broken? And what must your employer take care of, whatever you have learned here?
The powers of Datatilsynet
Under Article 58, Datatilsynet can investigate companies, ask for information and gain access to premises and systems. The Agency can also:
- issue a warning or a reprimand
- issue an order that a company must comply with a right or bring processing into order
- restrict or ban processing, temporarily or permanently
Anyone can complain to Datatilsynet (Article 77). A person who has suffered damage can obtain compensation from the controller or the processor (Article 82).
Fines: in Denmark the courts decide
Article 83 of the Regulation sets fines of up to EUR 10 million or 2 % of total annual turnover and, for the more serious infringements, up to EUR 20 million or 4 %, whichever is higher. The Danish legal system is not based on administrative fines. In Denmark it is therefore, as a starting point, the courts that impose the fine under § 41 of the Data Protection Act:
- Infringements of the Regulation's essential rules are punishable by a fine or imprisonment for up to 6 months (§ 41(1) and (2)).
- When setting the penalty, the court must follow Article 83(2), for example the nature, gravity and duration of the infringement and whether it was intentional or negligent (§ 41(3)).
- Companies can be punished under Chapter 5 of the Criminal Code (straffeloven) (§ 41(6)).
- Criminal cases become time-barred after 5 years (§ 41(7)).
Datatilsynet cannot impose a fine itself. If the Agency thinks a company should be punished, it refers the case to the police. The prosecution service decides whether to bring charges, and a court sets the fine. In simple cases, however, Datatilsynet can offer a fine notice (bødeforelæg, § 42). If the person who broke the rules pleads guilty and accepts the fine, the case ends without a trial. Otherwise the case can go on to the police and the court. The provision is aimed at "anyone who infringes", so punishment can in principle hit both companies and individuals. Serious or deliberate infringements, for example looking up well-known people in a system without a work-related need, can also have consequences under employment law.
What can you do yourself?
- Process information only on your employer's instructions and for the purposes of your work (Article 29).
- Follow policies and procedures, and ask when you are in doubt.
- Report breaches and requests immediately.
- Observe the duty of confidentiality. Many professions also have a statutory duty of confidentiality of their own.
What the employer must do
This course is a general introduction. It does not replace the company's own duties. The employer, as controller, must among other things:
- have its own policies and instructions for your job and your systems, so that you know what you may do
- keep a record of processing activities (Article 30) where required. The exemption for small companies applies only in narrow cases, so many smaller companies must keep one too
- conclude data processing agreements with suppliers (Article 28)
- carry out risk assessments and ensure appropriate technical and organisational measures (Article 32), and in certain cases a data protection impact assessment (Article 35)
- appoint a data protection officer (DPO) where the rules require it (Article 37), for example in public authorities
- have procedures for breaches and for requests from data subjects
- provide training that fits your particular job. Employees in HR, health, social services or marketing need more than a general introduction
It is the employer who decides whether this course covers the company's need for training.
Summary: Use only what you need. Protect what you have. Speak up if something goes wrong.