Skip to content

Statistics Denmark's compliance with GDPR

Statistics Denmark’s compliance with GDPR

Statistics Denmark guarantees to protect data in our possession about citizens and companies. This means e.g. that the data is safeguarded and that it is used by Statistics Denmark for the sole purpose of statistics. Statistics Denmark has a strong focus on compliance with the data protection rules set out in the General Data Protection Regulation (GDPR) and the Danish Data Protection Act. The data protection rules apply when we process data about natural persons. The concept of “natural person” also includes sole proprietorships (businesses owned by one individual). This is because there is no practical way of distinguishing between data about the owner as an individual and data about the business.

Personal data in statistics

Since 1850, Statistics Denmark has been a key to understanding Danish society. To produce the best possible statistics, we have access to data from administrative registers in public administration. Furthermore, we have a statutory authority to collect data from public authorities, the business sector and private individuals.

We organise the data in databases for the statistical domains for which the data is required. This means that data about a person or a business are not all gathered in one place. The statistical basis relies on data about people and businesses. Statistics are aggregate data about groups of people or businesses from which facts about individual units cannot be identified. Before we publish a set of statistics, we make sure that it is not possible to disclose data about identifiable natural or legal persons by means of the statistics.

Our Data Security Policy gives a detailed description of how Statistics Denmark ensures confidentiality regarding statistical data, while our Information Security Policy deals with security in general in Statistics Denmark. Our policies are available here.

In a number of situations, Statistics Denmark acts as a data processor for a data controller. In order for data controllers to fulfil their obligations to supervise Statistics Denmark, Statistics Denmark each year commissions four external ISAE 3000 audit reports. The reports cover Statistics Denmark’s statistical production in general as well as that of three offices engaged in data for customers. These three offices are Research Services (data for research in a secure environment), DST Consulting (customised statistics) and DST Survey (data collection). The audit reports provide assurance for the data controller that Statistics Denmark processes the personal data for which the controller is responsible in a proper manner. The data controller can obtain an audit report by contacting us at databeskyttelse@dst.dk.

Below is the answer to a number of questions that you may be curious about as a person registered in our statistics.

1. Who is the data controller and how do I get in touch?

Statistics Denmark is data controller of the processing made in connection with collection, production, development and dissemination of statistics. This means that we have responsibilities and obligations pursuant to the data protection rules regarding the personal data we have collected about you.

Statistics Denmark has the following contact information:

Statistics Denmark
Sankt Kjelds Plads 11
2100 Copenhagen
dst@dst.dk
CVR – 17150413
Phone +45 39 17 39 17

If you need to include sensitive or confidential personal data in your enquiry, we encourage you to send your enquiry to us via Digital Post. To do so, log in at Digital Post and select Statistics Denmark as receiver from the list of government agencies. You can also send us a letter.

2. How do I contact the data protection officer (DPO)?

Statistics Denmark has appointed a DPO who gives us advice e.g. on how to process data about you properly and in compliance with data protection rules regarding personal data.

Our data protection officer (DPO) is Charlotte Poulsen and you may contact her at databeskyttelse@dst.dk or tel. +45 39 17 39 95.

If you need to include sensitive or confidential personal data in your enquiry, we encourage you to send your enquiry to us via Digital Post. To do so, log in at Digital Post and select Statistics Denmark as receiver from the list of government agencies. You can also send us a letter.

3. Why does Statistics Denmark process data about me?

Statistics Denmark processes data about you for the purpose of producing and disseminating statistics on Danish society – either as part of official statistics or on request and as part of a task of importance to society.

In addition, we make pseudonymised data available for carrying out statistical or scientific surveys of importance to society. We are only allowed to disclose data for statistical or scientific purposes. The data may not be used for any other purpose, e.g. administrative, legal or tax purposes, or for decisions aimed at you.

However, there are situations in which national law obliges Statistics Denmark to disclose data for administrative purposes. This is the case for the AUB’s statistics on FTE employees with vocational training in connection with calculation of the work placement dependent AUB contribution, and for the Public Benefits Administration’s assessment of length of service, which is necessary for calculating the right to early retirement, the so-called ‘Arne pension’.

4, What is the statutory basis for processing data about me?

Statistics Denmark processes personal data in compliance with the provisions in Act on Statistics Denmark, the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

The legal basis for Statistics Denmark’s processing of personal data for statistical purposes is article 6(1)(e), article 9(2)(j), article 10 of the GDPR and sections 10 and 11(1) of the Danish Data Protection Act.

In cases where Statistics Denmark discloses data for the purpose of production by others of statistical or scientific surveys of significant importance to society, ministerial order no. 1509 of 18 December 2019 on disclosure of personal data under section 10(1) and (2) of the Danish Data Protection Act also applies.

Statistics Denmark’s obligation to disclose data for the purpose of the AUB’s statistics on FTE employees with vocational training is laid down in section 2 of the ministerial order no. 233 of 22 March 2018 (on AUB’s education register for statistics on FTE employees with vocational training, which is used to calculate employers’ contribution to the work placement programme).

Statistics Denmark’s obligation to disclose data to the Public Benefits Administration for the purpose of assessing length of service is laid down in section 12 of act no. 2202 of 29 December 2020 (act to amend the act on social pension and various other acts (implementation of a right to early retirement)).

5. Where does the data about me come from?

Statistics Denmark collects personal data through:

  • Public registers

Statistics Denmark is charged with producing, developing and disseminating statistics in Denmark to focus on matters of public interest. This is why Act on Statistics Denmark gives us authority to collect data from public registers. For example, Statistics Denmark receives data from the Civil Registration System, the Ministry of the Interior and Health, the Danish Motor Vehicle Agency’s motor vehicle register, and the Danish Tax Agency’s eIncome register.

  • Reports from public authorities and institutions and economic operators

Act on Statistics Denmark gives us the authority to instruct public authorities and institutions to inform us of the data they have in their possession.

The Act further gives us the authority to instruct economic operators to impart specific data with us that they have in their possession. In sections 8-12 of the Act, you can read about the data concerned.

  • Voluntary interview surveys

Furthermore, Statistics Denmark communicates with private individuals in order to collect data. When Statistics Denmark contacts private individuals, their participation is always voluntary. The Labour Force Survey is an example of a survey in which we ask private individuals to participate. We randomly select the people whom we invite to participate. Such responses are of great value, as they form the basis of statistics of great significance to society.

6. What categories of personal data about me does Statistics Denmark process?

Statistics Denmark collects the following categories of personal data for the purpose of producing statistics:

  • general data – e.g. ownership of property, data about unemployment, or data about your marital status, 
  • special categories of data – e.g. contact with the psychiatric treatment system, 
  • data relating to criminal convictions and offences – e.g. data about a sentence registered in the central register of criminal offences, as well as 
  • data about your civil registration number. 

7. To whom does Statistics Denmark disclose personal data, and who has access to the personal data?

Employees of Statistics Denmark producing statistics and with a work related requirement have access to personal data related to the relevant set of statistics to be produced. The employee only has access for the period of time that is necessary for producing the statistics. None of Statistics Denmark’s employees has access to all pieces of data about you.

Statistics Denmark may disclose data about you to others who produce statistical or scientific surveys of significant importance to society. By default, data will be pseudonymised, i.e. data may be combined with other sets of data, but individuals will not be immediately identifiable. Consequently, no one working with pseudonymised data will know that data about you are part of the set of data. Only in exceptional cases will we disclose the data in a format that allows the data to be immediately traced to you.

Statistics Denmark may disclose data about you to others who produce statistical or scientific surveys. This happens via the researcher programme, the authority programme and the law model programme, where the data is pseudonymised to prevent it from being traceable to identifiable individuals. In addition, Statistics Denmark makes personal data available via data warehouse programmes, where data is aggregated or pseudonymised before it is displayed.

’DST Survey’ is a division under Statistics Denmark that collects data via interviews and questionnaires on behalf of customers. These results are disclosed as pseudonymised data to the customer who is responsible for the data collection. Before you start an interview or respond to a questionnaire, you are informed on whose behalf the survey is made and for what purpose the data will be used.

When we no longer need to store data about you, it may be transferred to the national archives, Rigsarkivet, in accordance with the statutory rules on archives.

8. Does Statistics Denmark disclose data about me to a third country?

Statistics Denmark discloses data to the official statistics authorities in Greenland and in the Faroe Islands.

The data for the statistical authority of Greenland is about the highest educational attainment of people residing in Greenland. The disclosure happens for the purpose of the Greenlandic statistical authority’s production of statistics. The disclosure is based on general provisions on the protection of data adopted by the European Commission describing the required and appropriate safeguards.

The data for the statistical authority in the Faroe Islands is about persons residing in the Faroe Islands and the Faroese residing in Denmark regarding their education, employment, income and health.  The disclosure happens for the purpose of the Faroese statistical authority’s production of statistics. The disclosure happens on the basis of the EU Commission’s adequacy decision. This means that the EU Commission has assessed that the level of protection with regard to personal data in the Faroe Islands corresponds to the level of data protection in the EU/EEA.

9. For how long does Statistics Denmark store the data?

Data that we collect for the purpose of producing statistics are not deleted. This is so because we must be able to produce statistics showing developments and changes over time. The data is stored for production of time series.

10. What rights do I have?

In the case of Statistics Denmark’s processing of personal data about you for statistical purposes, you cannot assert your right of access, to rectification, erasure, restriction, objection and data portability (right to receive your personal data in a structured, commonly used and machine-readable format).

This is due to article 89(2) of the General Data Protection Regulation stipulating that the individual countries may provide opt-outs for the rights of those registered when it comes to processing for statistical purposes. Section 22(5) of the Data Protection Act stipulates that articles 15 (right of access), 16 (right to rectification), 18 (right to restriction of processing) and 21 (right to objection) of the regulation do not apply if the data is processed solely for scientific or statistical purposes.

Article 17 of the regulation regarding the right to erasure does not apply to the extent that the processing is necessary for statistical purposes, cf. article 17(3)(d).

Likewise, the right to data portability in article 20 of the regulation does not apply in Statistics Denmark, as the right can only be asserted when the processing is made automatically and is based on consent or a contract. Statistics Denmark’s processing is in pursuance of article 6(1)(e) on the performance of a task in the public interest or falling within the exercise of public authority imposed on the data controller, in which case the right to data portability is thus not applicable.

11. Do I have complaint options?

If you believe that Statistics Denmark’s processing of personal data about you is not carried out in compliance with the data protection rules, you have an option to file a complaint to the Danish Data Protection Agency.

You can read more about this on the Danish Data Protection Agency’s website, or contact them at +45 33 19 32 00.

Contact

Databeskyttelse
Phone: +45 39 17 39 95