Almost every job involves information about people. A receptionist writes down a guest's name. A shop assistant takes a delivery address. A caseworker reads a file. The rules on protecting personal data therefore apply to you and not only to your boss. Together they are called the data protection rules, and people often simply say GDPR.
The rules in Denmark
- The General Data Protection Regulation (databeskyttelsesforordningen) is EU Regulation 2016/679. It applies directly in Denmark.
- The Data Protection Act (databeskyttelsesloven, Act no. 502 of 23 May 2018, as amended) supplements the Regulation with Danish rules, for example on the CPR number (the Danish personal identification number), employment relationships and penalties.
- Datatilsynet (the Danish Data Protection Agency) is the authority that supervises the rules in Denmark.
The Regulation applies when personal data is processed wholly or partly by electronic means. It also applies to paper records if the data is in a filing system, for example a folder sorted by name. Purely private matters are exempt, for example your own address book at home.
What is personal data?
Personal data is any information about an identified or identifiable natural person (Article 4(1) of the Regulation). It can be:
- name, address, email and telephone number
- CPR number, customer number and employee number
- images and sound recordings in which the person can be recognised
- IP addresses and location data
- pay, grades, sickness absence and descriptions of an employee's work
The information does not have to be secret. Even an email address that is on a website is personal data. Information about a company is not personal data, but information about the person behind a sole-trader business is. Anonymous information, where nobody can work out who the person is, falls outside the rules. Pseudonymised information is still personal data.
What is processing?
Processing is everything you can do with information: collect, record, store, read, search, send, change, share and delete (Article 4(2)). When you merely look at something in a system, you are already processing data.
Who is who?
- The data subject is the person the information is about: the customer, the patient, the pupil or the colleague.
- The controller decides why and how the information is processed (Article 4(7)). That is usually your employer, not you personally.
- The processor processes information on behalf of the controller, for example a payroll bureau or the supplier of an IT system (Article 4(8)). There must be a written data processing agreement (Article 28).
As an employee you may process information only on your employer's instructions (Article 29). You cannot decide for yourself to use the customer list for a new purpose.
Why it matters
The rules protect people's privacy. If information falls into the wrong hands, a person can be exposed to fraud, bullying or discrimination. Mistakes also damage the company's reputation, and they can lead to sanctions.
Remember: Before you use information about a person, ask yourself: Do I need it for my work, and may I use it in this way?