Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors
Filter by Categories
location

FIND LOCATION

DA/EN

The Data Protection Regulation and the Data Protection Act, which have been in force since 25 May 2018, provide for a new, significantly increased level of fines that must be effective and deterrent. With the regulation, it is also assumed that the Member States harmonize the sanctions for breaches of the data protection rules.

In Denmark, it is the Data Protection Authority that, as the supervisory authority, controls the compliance of private and public authorities with the data protection rules. As far as the Courts’ processing of personal data is concerned, the task is left to the Danish Courts Agency. The Norwegian Data Protection Authority processes complaints and can, if necessary, initiate investigations on its own initiative.

As part of the enforcement of the data protection rules, the Danish Data Protection Authority has been granted a number of powers. These powers are divided into investigative powers, corrective powers and approval and advisory powers. This article deals exclusively with the first two types of powers.

As far as the investigation of the data processor’s compliance with the data protection rules is concerned, the Data Protection Authority can demand from the data processor any information that is of importance to its business – in other words, the Data Protection Authority can issue orders that the data processor must hand over information. Next, the Danish Data Protection Authority has access, without a court order, to the premises of the data processor, from which processing of personal data is carried out.

If the Norwegian Data Protection Authority concludes that the data processor does not comply with the data protection rules, it is assigned a number of so-called corrective powers, of which warnings, criticism, various orders, prohibitions and fines are the most important. This article deals exclusively with fines for companies.

When the Danish Data Protection Authority has to set a fine, this is generally done based on the considerations set out in the data protection regulation article 83. The fine must thus be effective, proportionate to the violation and have a deterrent effect.

Based on the general principles that follow from the data protection regulation, the Danish Data Protection Authority has issued fine guidelines regarding both fines for natural persons and fines for companies. As far as fines for companies are concerned, it follows from the guidelines for the assessment of fines for companies that the Danish Data Protection Authority first determines the so-called basic amount, which is then adjusted on the basis of a number of elements:

  1. The Norwegian Data Protection Authority determines the basic amount
  2. The basic amount is adjusted based on the nature, seriousness and duration of the violation
  3. Additional aggravating or mitigating circumstances are included
  4. If the fine now exceeds the data protection regulation’s maximum, it will be adjusted down
  5. If there are good reasons for this, the fine can be adjusted due to the company’s ability to pay

Since the calculation of the total fine is relatively complex, this article deals only with the general features of the calculation of the basic amount. In the calculation of the basic amount, the nature of the violation and the size of the company are taken into account. The Danish Data Protection Authority has published a number of decisions which can contribute to a more concrete understanding of the level of fines. You can find the published fine cases here.

According to the data protection regulation, companies can be fined a maximum of up to:

  • 75 million DKK (static fine ceiling) or 2% of the company’s total global turnover (dynamic fine ceiling), whichever amount is higher. The Danish Data Protection Authority has divided these violations into categories 1-3, where category 3 can result in the largest fine.
  • 150 million DKK (static fine ceiling) or up to 4% of the company’s total global turnover (dynamic fine ceiling), whichever amount is higher. The Danish Data Protection Authority has divided these violations into categories 4-6, where category 6 can result in the highest fine.

In addition to the powers to issue fines, the Danish Data Protection Authority is authorized to publish its statements and decisions. In practice, this means that the data processor’s errors can be published on the Danish Data Protection Authority’s website, from which anyone (including journalists) has access to the circumstances of the case and the Danish Data Protection Authority’s position on this.

Concluding remarks
The data protection rules can seem very confusing to many ordinary people. As stated above, lack of knowledge of the rules can have very large financial consequences as well as consequences for the publicity of your company.

If you are in doubt as to whether your company’s processing of personal data is in accordance with the data protection rules, you can always contact DreistStorgaard Advokater. We are available for any questions you may have. You can contact us on phone 56 63 44 66 or by email kontakt@dslaw.dk.

OTHER RELEVANT NEWS

Is your company obliged to appoint a data protection advisor?

Is your company obliged to appoint a data protection advisor?

Læs mere
MADS MAGNUS GYLLING OLSEN

MADS MAGNUS GYLLING OLSEN

Stud.Law

mmo@dslaw.dk

Dir.(+45) 56 64 33 14

OTHER RELEVANT NEWS

Is your company obliged to appoint a data protection advisor?

Is your company obliged to appoint a data protection advisor?

Læs mere

Her finder du os

Køge

Bag Haverne 32
4600 Køge

Næstved

Garnisonsvej 2
4700 Næstved

Aarhus

Søren Frichs vej 42 A
8230 Åbyhøj

Holbæk

Sports Allé 5B, 1.th.
4300 Holbæk

København

Nimbusparken 24, 2.
2000 Frederiksberg

Sorø

Energivej 3
4180 Sorø

Du kan kontakte os

Mandag – fredag kl. 8.30 – 16.00
Tlf.: 56 63 44 66
E-mail: kontakt@dslaw.dk
CVR: 32300456

Ejendomsadministration

Tlf.: 55 75 00 75
Telefontid hverdage kl. 10.00 – 14.00
E-mail: ejendom@dslaw.dk

CSR

© 2023 DreistStorgaard. All Rights Reserved