Data protection (GDPR)

Some public authorities are about to develop e-government solutions, for example application systems or self-service systems. Others wish to use new e-government solutions such as apps, text messages, chat, smartphones, Facebook, etc.

A key challenge is to handle the data protection law issues resulting from e-government, such as its relationship with the practices of the Danish Data Protection Agency which can be hard to assess at times.

The General Data Protection Regulation has been agreed on. It contains a number of completely new requirements to be fulfilled by public bodies, such as the mandatory use of data protection officers, an obligation to prepare data protection impact assessments, secure documentation for data processing, and a data protection by design and by default obligation when creating new digital solutions, etc.

Our advice

We advise clients on all data protection law aspects, including questions about:

• the authority to process personal data
• good data processing practices
• disclosure
• international transfers of data in connection with outsourcing
• notification to the Danish Data Protection Agency
• duty of disclosure
• erasure
• security requirements
• data controllers/data processors
• staff checks
• CCTV, etc.

We also assist our clients with drafting data processing agreements, declarations of consent, notifications to the data subject as well as personal data policies and security policies, impact assessments, etc.

We also advise on the problem areas before decisions of major importance are to be made and help follow the case through before the courts. At other times, we become involved much later on in the proceedings. The common feature is that we turn our many years of experience into operational solutions that fulfil our clients' needs and bear the scrutiny of the Danish Ombudsman, the Danish Data Protection Agency or the courts.

Experience and cases

• participation in a project process with the Danish Environmental Protection Agency and Niras about the development of a digital decision module for Danish municipalities
• assistance to the former Danish National IT and Telecom Agency with the central internet warning service GovCert
• assistance to the Danish Agency for Labour Market and Recruitment in connection with several digital self-service solutions.

Personal data compliance checks

A personal data compliance check ensures that the organisation complies with the legislation in the area and that action can be taken in the right places to minimise the risk of errors.

Poul Schmith carries out compliance checks and also helps with the implementation of solutions by for instance drafting data processing agreements for (sub-)processors, guidelines, privacy policies and notifications to the Danish Data Protection Agency.