The Ministry of Justice has now published the long awaited White Paper concerning the data protection regulation and the legal framework for Danish legislation in this respect.
The White Paper consists of three comprehensive binders containing a detailed analysis of the provisions and answers of the regulation to questions on the future personal data legislation in Denmark, including whether Denmark can maintain its special rules.
The White Paper is part of the Ministry of Justice's project work to adapt Danish legislation to the data protection regulation, which will come into force on 25 May 2018. It is the Ministry's plan that a bill concerning a new personal data act is to be based on the White Paper. The bill is expected to be presented to the parliament in the autumn of 2017.
The White Paper's conclusion is that the regulation largely corresponds to the applicable legal position under the Personal Data Act and the Data Protection Directive, including the practice of for instance the ECJ and the Danish Data Protection Agency. Authorities and private organisation that already comply with the Personal Data Act will therefore not experience material changes.
But it appears from the conclusion that "there will probably be public authorities and private organisations etc. which do not at this time fulfil all the requirements of the Personal Data Act, and which are therefore not compliant with applicable law".
Some of the highlighted novelties in relation to the regulation are:
- A requirement for data protection advisors at public authorities and some private companies.
- A requirement for reporting of security breaches to the Data Protection Agency.
- A requirement for feasibility studies and registration of processing activities.
- An explicit provision on "data protection by design".
- The possibility of significantly increased fines in connection with breach of the regulation's rules.
The White Paper is only the first of a number of aids to construction from the Ministry of Justice. The plan is to publish more guidance as to the interpretation of the regulation before January 2018.