DenmarkDanish Data Protection Act (Databeskyttelsesloven)
Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af… personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Denmark, including data collected by crawling.NIST Privacy FrameworkCT.PO-P1
- Conduct a Data Protection Impact Assessment for high risk processing under GDPR Article 35.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text. Also read by: Datatilsynet (the Danish Data Protection Agency) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datatilsynet.dk/regler-og-vejledning/grundlaeggende-begreber/hvornaar-maa-du-behandle-personoplysninger
- Guidance body
- Datatilsynet (the Danish Data Protection Agency)
- Open questions
- Is a private party's disclosure of a CPR number 'et naturligt led i den normale drift af virksomheder m.v. af den pågældende art' and 'af afgørende betydning for at sikre en entydig identifikation' under section 11(2)(3) of the Databeskyttelsesloven when it discloses the number to a business partner that has no statutory right to receive it?
What it makes you log
Logging duty
The Act supplements the GDPR with national rules on purpose, lawful basis, children's consent, the CPR number and supervision. It states no duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation, which the Act does not repeat.
- Kind
- None
- As of
What this law does
The Danish Data Protection Act gives the General Data Protection Regulation (GDPR) domestic effect in Denmark and supplements it with Denmark-specific derogations for matters GDPR leaves to member states.
Section 6(2) and (3) set the digital age of consent at 15 years, section 11 lets a private party process a CPR (civil registration) number only on listed grounds such as the person's consent, section 2(4) applies the Act and the GDPR to every form of television surveillance, and section 3(8) disapplies chapters II to VII and IX of the GDPR to processing carried out solely for journalistic purposes, except Articles 28 and 32.
The age was raised from 13 to 15 by Act No. 1783 of , in force from . Datatilsynet, the Danish Data Protection Agency, enforces it, with the distinctive feature that Denmark cannot itself impose an administrative fine (see the enforcement instrument below).
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .