General Data Protection Regulation 2018

SmartTID frequently receives questions from customers and business partners regarding the new General Data Protection Regulation, which takes effect on May 25, 2018. We will therefore attempt to provide general answers to the most common questions here.

The important thing to remember is that all processing of personal data is prohibited unless it is permitted.

In other words, the General Data Protection Regulation must explicitly state that the processing is lawful. If it does not, then the processing is unlawful.

Without providing a comprehensive overview of the regulation, we instead refer to Article 6 of the General Data Protection Regulation, which describes when the most common types of processing are lawful. If you are processing particularly sensitive information, you should read Article 9 of the General Data Protection Regulation.

If you process personal data based on the data subject’s consent, you must review the conditions for consent set forth in Article 7 of the General Data Protection Regulation. Please note, however, the information below regarding the use of consent in employment relationships.

Employment Relationship

Our customers typically process information about their employees, and we are often asked whether they will still be able to process such information once the General Data Protection Regulation takes effect.

The answer, of course, depends on a specific review of the processing information, but we would still like to try to provide a more general response.

Our customers often process master data regarding their employees’ names, addresses, phone numbers, email addresses, dates of birth, contact persons, next of kin, hire dates, special pay supplements, as well as records of working hours, vacation, and absences.

If an employee has left the company, our customers will often also process information regarding the date of departure and the reason for leaving.

Such information, which is necessary for the performance of the employee’s contract, may be processed in accordance with Article 6 (1)(b) of the General Data Protection Regulation.

In the case of highly sensitive information, such as trade union membership, the legal basis must be found in Article 9 of the General Data Protection Regulation.

If you need to process information about an employee to comply with a collective bargaining agreement, you are permitted to do so, as Denmark has the option to establish special rules in this regard. This is set forth in Article 88 of the General Data Protection Regulation. The Danish Data Protection Act is expected to be enacted on February 20, 2018.

Special Provisions Regarding Consent in Employment Relationships

We are also often asked whether it is not simply possible to include a consent form in the employee’s employment contract or similar document. We believe that if another legal basis for processing personal data is available, it should be used, and consent should only be relied upon as the basis for processing in employment relationships in very exceptional cases.

This is because consent must be voluntary. In employment relationships, there is generally an imbalance of power between the employer and the employee. One must therefore be very mindful of whether the employee’s consent truly reflects the employee’s voluntary choice, or whether the consent was given out of fear of significant negative consequences. You can read more about the conditions for consent in Article 7 of the General Data Protection Regulation.

Data Processor/Data Controller

SmartTID will most often act as a data processor. This means that we operate under the instructions of the data controller (our customer or business partner) and in accordance with a data processing agreement.

The data controller is responsible for ensuring—and must be able to demonstrate—that personal data is processed on a lawful basis. We are happy to provide advice and guidance on this matter to the best of our ability; however, since the data belongs to the data controller and since we operate solely on the data controller’s instructions, the responsibility lies with the data controller.

However, as a data processor, we can guarantee, among other things, that:

• We implement the appropriate technical and organizational measures to ensure that data processing complies with the requirements of the General Data Protection Regulation and safeguards the rights of data subjects.
• We do not use other data processors without prior written approval from the data controller
• Acts only on instructions from the data controller
• We ensure that those who process personal data are bound by a duty of confidentiality

[See also the requirements set forth in Article 28(1) of the General Data Protection Regulation].