Some information is not "sensitive" under Article 9, but it still has to be handled with extra care. The most important are the CPR number and information on criminal offences. Here Denmark has its own rules in the Data Protection Act.
The CPR number (§ 11)
The CPR number (the Danish personal identification number) is the key to a person in many public and private registers. If it gets out, it can be used for identity theft. That is why the rules are stricter.
- Public authorities may process the CPR number for unique identification and as a file number (§ 11(1)).
- Private parties, for example most companies, may process the CPR number only when one of these conditions is met (§ 11(2)):
- It follows from legislation. Employers, for example, must use the CPR number to report pay to the tax authorities.
- The person has given consent under Article 7.
- It is done solely for scientific or statistical purposes, or it is a disclosure that is a natural part of normal operations and decisive for secure identification, or that an authority requires.
- The conditions in § 7 on special category data are met.
- The CPR number may not be published unless the person has given consent under Article 7 (§ 11(3)).
In practice this means you should not ask for a CPR number if you have no clear basis. A shop may not use the CPR number as a customer number. Nor should you put it in an email's subject line or in a file name.
When you need to use a CPR number
- Ask yourself whether the information is necessary. Often a date of birth and a name are enough.
- Never send a CPR number in an ordinary, unencrypted email. Use the company's secure solution.
- Do not write it in documents that will be widely shared, for example a shared spreadsheet or a notice board.
- Pass it on only to those who have a lawful need.
Information on criminal offences
Information on criminal convictions and offences is covered by Article 10 and § 8 of the Data Protection Act. For private parties the following applies (§ 8(3)):
- processing can take place with the data subject's explicit consent, or
- if it is necessary to pursue a legitimate interest that clearly outweighs the interests of the person.
This information may not be disclosed without explicit consent, unless it is done to pursue interests that clearly outweigh the interest in secrecy (§ 8(4)). You may therefore not spread or write down a rumour that a colleague has received a sentence.
Images and video
An image in which a person can be recognised is personal data. That also applies to images on the intranet, the website or social media. The company must have a basis. If it is consent, the person can withdraw it. Ask before you post a picture of colleagues, customers or children. For CCTV there is also a special act, tv-overvågningsloven (the Television Surveillance Act).
Employees and their information
Employees' information is also personal data. The employer may process it when necessary to comply with obligations under employment law, for example for pay, holiday and sickness (§ 12(1)). That does not mean that all colleagues may see it. Only those who need it for their work should have access.
Remember: Before you use a CPR number or information about criminal offences, you must know which requirement in the law covers it.