Processing of special categories of personal data
In addition to the exemptions stated in Article 9, the processing of sensitive data is also allowed if the following applies:
- The Danish Data Protection Agency has provided authorization for processing the data for certain research purposes.
The following legislation contains stricter provisions than the DPA, particularly in employment relationships:
- Act on the Use of Health Information in the Labour Market
- Act on Prohibition against Discrimination in the Labour Market
Other sensitive personal data
The processing of other sensitive personal data (see definition above) is generally prohibited, unless one of the general exemptions (see above) for the processing of sensitive personal data applies, or the processing is necessary for the purpose of pursuing a legitimate interest, and the interests of the data controller clearly override the interests of the data subject.
Processing personal identification numbers (CPR nos.)
Processing of CPR nos. is generally prohibited; however, private individuals or entities may process CPR nos. if one of the following exemptions applies:
- this follows from the law,
- the data subject has given explicit consent or
- the processing is carried out solely for scientific or statistical purposes
The CPR no. can be disclosed, if
- such disclosure is a natural element of the ordinary operation of the company and essential for identifying particular individuals
- the processing is demanded by a public authority
However, a company must obtain the explicit consent of the individual to disclose a CPR no.
