Various companies

The Danish Data Protection Agency has the authority and right to carry out data protection audits and inspections without a court order, including the right to demand access to all necessary premises where personal data are processed. The Danish Data Protection Authority carries out a number of planned inspections every year. During the past 1.5 years, the main subjects of the audits and inspections have been as follows: 2018: - Legal bases for processing of personal data, including the consent of the data subject - Deletion of personal data - Use of data processing equipment by the municipalities - Appointment of data protection officers - establishment of records of processing activities - The rights of the data subjects 2019: - Security measures of public authorities and private companies - Encryption of e-mails by private companies - The data subject's right of access to personal data processed by public authorities and private undertakings - Aggregation and compilation of personal data for resale by private companies - Data processors and data processing agreements - Daily monitoring - Data protection in relation to employees - Automated decision making and profiling The Danish Data Protection Authority has reported two companies to the Danish police and proposed two fines. The first proposed fine was a fine of DKK 1.2 million (approx. EUR 160,000) for a company's failure to take action to make personal data anonymous (e.g. timely deletion of personal data). The second was a fine of DKK 1.5 million (approx. EUR 201,000) for the company's failure to comply with the principle of storage limitation. Authority: Danish Data Protection Authority (Datatilsynet)