The Danish Data Protection Act supplements the GDPR by allowing the processing of sensitive data, where processing is necessary for the purpose of observing and respecting employment-law obligations and rights of the controller or data subject, as laid down by other law or collective agreements (Section 12(1)).
Moreover, the DPA allows consent to be used as a legal basis in an employment context, provided consent is given in accordance with the conditions laid down in Article 7 of the GDPR (Section 12(3)). This rule has been highly discussed in Denmark, as it is contrary to the Article 29 Working Party’s opinion that consent can almost never be given freely in an employment relationship.
