Data protection & GDPR

We assist companies, organisations and authorities as to how processing of HR data may be arranged in accordance with the GPDR. We have wide experience in relation to companies' compliance with the rules on the duty to inform employees and obtain consent to processing of personal data, and assessment of which data may be stored and transferred, including in connection with exchange of HR data between different affiliates of multi-national groups.

Horten has also assisted with the drafting of guidelines in relation to storage and deletion of personal data for a number of companies and public authorities based on general as well as specific regulation of the individual areas.

In addition, Horten has advised on a number of specific issues in connection with registration of the employees' use of the Internet and e-mails, recording of telephone conversations for training purposes, etc. and TV surveillance.

Contacts:
Erik Wendelboe Christiansen

Horten has assisted with the establishment of a large number of whistleblower schemes on behalf of Danish and foreign companies and authorities. Horten has also assisted with investigations concerning reports made under whistleblower schemes.

In this connection, Horten has advised on many questions on personal data law relevant in relation to the establishment and use of whistleblower schemes, especially:

• The content and scope of whistleblower schemes, including preparation of whistleblower policies
• Assessment of the need for and assistance in relation to impact assessments
• Observance of the duty to notify persons reported under a whistleblower scheme, especially in relation to reports and investigations.

Contacts:
Søren Hornbæk Svendsen

In connection with collection, storage and transfer of personal data, a number of questions arise as to right and duty, e.g. due to special legislation, and it is often difficult to comply with the general rules on processing of personal data and special legislation at the same time.

Horten has wide experience advising companies and public institutions within this interface between general personal data legislation and special legislation.

There are also special rules on processing of personal data in certain areas which take precedence over the rules of the Personal Data Act, including, in particular, in the healthcare area and within the financial sector. Horten also has wide expertise and experience within these rules.

The rules on data protection are usually relevant when concluding IT contracts, establishing cloud solutions and apps and using AI, and also the use of social media raises a number of problems and challenges in terms of data protection law. We have wide experience in advising on these issues.

Marketing vis-à-vis consumers often requires consent and observance of the duty to inform. Companies' use of cookies also raises problems in relation to observance of the duty to inform and obtain consent.

Another recurring issue is the use of customer data for the purpose of marketing for other companies.

Horten advises private as well as industry organisations on how to carry out marketing and use cookies to achieve the purpose while observing the rules at the same time.

Horten provides DPO services adapted to the controller's specific needs. This service includes:

• Information and advice to the controller and its employees on data protection
• Observance of the controller’s compliance with the data protection rules
• Advice in connection with the preparation of the controller's impact assessments
• Cooperation with the Danish Data Protection Agency on behalf of the controller
• The role as the Danish Data Protection Agency’s contact person in relation to all questions concerning processing of personal data on behalf of the persons subject to processing
• Guidance of the data subject on behalf of the controller.