You may not process personal data just because you have access to it. There must always be a lawful basis for processing. The ordinary bases are in Article 6(1), and in Denmark § 6 of the Data Protection Act repeats them.
The six bases
Processing is lawful if at least one of these applies:
- a) Consent from the data subject.
- b) Contract: the processing is necessary to perform an agreement with the person, for example to deliver goods or pay wages.
- c) Legal obligation: the law requires it, for example keeping vouchers or reporting pay to the tax authorities.
- d) Vital interests: the processing is necessary to protect someone's life.
- e) Public interest or the exercise of official authority. This is used mainly by public authorities.
- f) Legitimate interest: the company has a legitimate interest, and it outweighs the person's interests and rights. This requires a specific balancing of interests. Public authorities cannot use this basis in their tasks.
Consent must be genuine
Consent must be freely given, specific, informed and unambiguous (Article 4(11) and Article 7). It requires an active act. A pre-ticked box is not consent. The person can withdraw consent at any time, and it must be as easy to withdraw it as to give it. The company must be able to demonstrate that consent was given.
In an employment relationship consent is often a weak basis. The employee depends on the employer and may feel pressured, and then the consent is not freely given. The Act does, however, allow consent in employment relationships (§ 12(3)), so it depends on the situation.
Children: When an information society service, for example a social medium or an app, uses consent as its basis, a child can give it themselves from the age of 15 in Denmark (§ 6(2)). If the child is younger, the consent of the holder of parental responsibility is required. The age limit was raised from 13 to 15 on 1 January 2024.
Special category data
Article 9 calls some information special categories of personal data. Danish texts often say følsomme oplysninger (sensitive data). It is information about:
- racial or ethnic origin
- political opinions, religious or philosophical beliefs
- trade union membership
- genetic data and biometric data, when used to identify a person
- health
- sex life or sexual orientation
The starting point is that this information may not be processed. There are exceptions, for example explicit consent, or where it is necessary to comply with obligations and rights in employment law. The Data Protection Act (§ 7(2) and § 12) allows employers to do so if the processing is necessary.
In practice
- Do not write diagnoses, religion or trade union membership in free-text fields unless recording them is your job.
- An employee's statement that they are ill is health data. The employer may record the absence, but rarely needs to know a diagnosis.
- If you are unsure which basis covers what you are about to do, ask the person responsible for data protection where you work.
Rule: No basis, no processing. The more sensitive the information, the stricter the requirements.