Part 4
Processing of data

5. - (1)  Data shall be processed in accordance with good practices for the processing of data.

  (2) The collection of data shall take place for specified explicit and legitimate purposes and they shall not be further processed in a way incompatible with these purposes. Further processing of data which takes place exclusively for historical, statistical or scientific purposes shall not be considered incompatible with the purposes for which the data were collected.

  (3) Data which are to be processed shall be adequate, relevant and not excessive in relation to the purposes for which the data are collected and the purposes for which they are subsequently processed.

  (4) The processing of data shall be organised in a way which ensures the required up-dating of the data. Furthermore, necessary checks should be made to ensure that no inaccurate or misleading data are processed. Data which turn out to be inaccurate or misleading shall be erased or rectified without delay.

  (5) The data collected may not be kept in a form which makes it possible to identify the data subject for a longer period than is necessary for the purposes for which the data are processed.

6. - (1)  Personal data may be processed only if:

1. the data subject has given his explicit consent; or
2. processing is necessary for the performance of a contract to which the data subject is a
   party or in order to take steps at the request of the data subject prior to entering into a con-tract; or
3. processing is necessary for compliance with a legal obligation to which the controller is subject; or
4. processing is necessary in order to protect the vital interests of the data subject; or
5. processing is necessary for the performance of a task carried out in the public interest; or
6. processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller or a third party to whom the data are disclosed; or
7. processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party to whom the data are disclosed, and these interests are not overridden by the interests of the data subject.

  (2) A company may not disclose data concerning a consumer to a third company for the
purpose of marketing or use such data on behalf of a third company for this purpose, unless the
data subject has given his explicit consent. The consent shall be obtained in accordance with the rules laid down in section 6 (a) of the Danish Marketing Practices Act.

  (3) However, the disclosure and use of data as mentioned in subsection (2) may take place
without consent in the case of general data on customers which form the basis for classification
into customer categories, and if the conditions laid down in subsection (1) 7 are satisfied.

  (4) Data of the type mentioned in sections 7 and 8 may not be disclosed or used by virtue of
subsection (3). The Minister of Justice may lay down further restrictions in the access to
disclose or use special types of data by virtue of subsection (3).

7. - (1)  No processing may take place of personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, trade union membership, or data concerning health 
or sex life.

  (2) The provision laid down in subsection (1) shall not apply where:

1. the data subject has given his explicit consent to the processing of such data; or
2. processing is necessary to protect the vital interests of the data subject or of another person where the person concerned is physically or legally incapable of giving his consent; or
3. the processing relates to data which have been made public by the data subject; or
4. the processing is necessary for the establishment, exercise or defence of legal claims.

  (3) Processing of data concerning trade union affiliation may further take place where the pro-cessing is necessary for the controller's compliance with labour law obligations or specific rights.

  (4) Processing may be carried out in the course of its legitimate activities by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade- union aim of the data mentioned in subsection (1) relating to the members of the body or to persons who have regular contact with it in connection with its purposes. Disclosure of such data may only take place if the data subject has given his express consent or if the processing is covered by subsection (2) 2 to 4 or subsection (3).

  (5) The provision laid down in subsection (1) shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health care services, and where those data are processed by a health professional subject to a statutory obligation of professional secrecy.

  (6) Processing of the data mentioned in subsection (1) may take place where the processing is required for the performance by an official authority of its tasks in the area of criminal law.

  (7) Exemptions may further be laid down from the provision in subsection (1) where the pro-cessing of data takes place for reasons of substantial public interests. The supervisory authority shall give its authorisation in such cases. The processing may be made subject to specific conditions. The supervisory authority shall notify the Commission of any derogation.

  (8) No automatic filing systems may be kept on behalf of a public administration containing data on political affiliations which are not open to the public.

 8. - (1)  No data about criminal records, serious social problems and other purely private data than those mentioned in section 7 (1) may be processed on behalf of a public administration, unless such processing is necessary for the performance of the tasks of the administration.

  (2) The data mentioned in subsection (1) may not be disclosed to any third party. Disclosure may, however, take place where:

1. the data subject has given his explicit consent to such disclosure; or
2. disclosure takes place for the purpose of pursuing private or public interests which clearly override the interests of secrecy, including the interests of the person to whom the data relate; or
3. disclosure is necessary for the performance of the activities of an authority or required for a decision to be made by that authority; or
4. disclosure is necessary for the performance of tasks for an official authority by a person or a company.    

  (3) Administrative authorities performing tasks in the social field may only disclose the data
mentioned in subsection (1) and the data mentioned in section 7 (1) if the conditions laid down
in subsection (2) 1 or 2  are satisfied, or if the disclosure is a necessary step in the procedure
for dealing with the case or necessary for the performance by an authority of its supervision or
control function.

  (4) Private individuals and bodies may process data about criminal records, serious social problems and other purely private matters than those mentioned in section 7 (1) if the data subject has given his explicit consent. Processing may also take place where necessary for the purpose of pursuing a legitimate interest and this interest clearly overrides the interests of the data subject.

  (5) The data mentioned in subsection (4) may not be disclosed without the explicit consent of
the data subject. However, disclosure may take place without consent for the purpose of pursuing
public or private interests, including the interests of the person concerned, which clearly override
the interests of secrecy.
      
  (6) Processing of data in the cases which are regulated by subsections (1), (2), (4) and (5) may otherwise be carried out if the conditions laid down in section 7 are satisfied.

  (7) A complete register of criminal convictions may be kept only under the control of an official authority.

9. - (1)  Data as mentioned in section 7 (1) or section 8 may be processed where the processing is carried out for the sole purpose of operating legal information systems of significant social importance and the processing is necessary for operating such systems.

  (2) The data covered by subsection (1) may not subsequently be proposed for any other purpose. The same shall apply to the processing of other data which is carried out solely for the purpose of operating legal information systems, cf. section 6.

  (3) The supervisory authority may lay down more detailed conditions concerning the processing operations mentioned in subsection (1). The same shall apply to the data mentioned in section 6 which are processed solely in connection with the operation of legal information systems.

10. - (1)  Data as mentioned in section 7 (1) or section 8 may be processed where the processing is carried out for the sole purpose of carrying out statistical or scientific studies of significant social importance and where such processing is necessary in order to carry out these studies.

  (2) The data covered by subsection (1) may not subsequently be processed for other than statistical or scientific purposes. The same shall apply to processing of other data carried out solely for statistical or scientific purposes, cf. section 6.

  (3) The data covered by subsections (1) and (2) may only be disclosed to a third party with prior authorisation from the supervisory authority. The supervisory authority may lay down more detailed conditions concerning the disclosure.

11. - (1)  Official authorities may process data concerning civil registration numbers with a view to unambiguous identification or as file numbers.

  (2) Private individuals and bodies may process data concerning civil registration numbers where:

1. this follows from law or regulations; or
2. the data subject has given his explicit consent; or
3. the processing is carried out for scientific or statistical purposes or if it is a matter of disclosing a civil registration number where such disclosure is a natural element of the ordinary operation of companies, etc. of the type mentioned and the disclosure is of decisive importance for an unambiguous identification of the data subject or the disclosure was demanded by an official authority.      

  (3) Irrespective of the provision laid down in subsection (2) 3, no disclosure may take place of a civil registration number without explicit consent.

12. - (1)  Controllers who sell lists of groups or persons for marketing purposes or who perform mailing or posting of messages to such groups on behalf of a third party may only process:

1. data concerning name, address, position, occupation, e-mail address, telephone and fax number;
2. data contained in trade registers which according to law or regulations are intended for public information; and
3. other data if the data subject has given his explicit consent. The consent shall be obtained in accordance with section 6 (a) of the Danish Marketing Practices Act.

  (2) Processing of data of the type mentioned in section 7 (1), or section 8, may, however, not take place. The Minister of Justice may lay down further restrictions in the access to process special types of data.

13. - (1)  Official authorities and private companies, etc. may not carry out any automatic registration of the telephone numbers to which calls are made from their telephones. However, such registration may take place with the prior authorisation from the supervisory authority in cases where important private or public interests speak in favour hereof. The supervisory authority may lay down more detailed conditions for such registration.

  (2) The provision laid down in subsection (1) shall not apply where otherwise provided by statute or as regards the registration by suppliers of telecommunications network and by teleservices of numbers called, either for own use or for use in connection with technical control.

14.  Data covered by this Act may be transferred to storage in a filing system under the rules laid down in the legislation on files.

Part 5
Disclosure to credit information agencies of data on debts to public authorities

15. – (1)  Data on debts to public authorities may be disclosed to credit information agencies in accordance with the provisions laid down in this Part of the Act.
  (2) No disclosure may take place of data mentioned in section 7 (1) or section 8 (1) of this Act.
  (3) Confidential data disclosed in accordance with the rules laid down in this Part shall not for this reason be deemed to be otherwise accessible to the general public.

16. – (1) Data on debts to public authorities may be disclosed to a credit information agency where

1. permitted by law or regulations; or
2. the total amount of debts is due and payable and is in excess of DKK 7,500; however, this amount must not include debts covered by an agreement for an extension of the time for payment or for payment by instalments which has been observed by the data subject.

  (2) It is a condition that the same collection authority administers the total amount of debts, cf. subsection (1) 2.

  (3) It is further a condition for the disclosure of data under the provisions of subsection (1) 2, that:

1. the debt may be recovered by means of a distraint, and that two letters requesting payment have been sent to the debtor;
2. execution has been levied, or attempts have been made to levy execution in respect of the claim;
3. the claim has been established by a final and conclusive court order; or
4. the public authorities have obtained the debtor’s written acknowledgement of the debt being due and payable.

17. – (1)  The public authority concerned shall notify the debtor in writing prior to the disclosure of such data. Disclosure may at the earliest take place 4 weeks after such notification.

  (2) The notification referred to in subsection (1) shall include information stating:

1. which data will be disclosed;
2. the credit information agency to which disclosure of the data will take place;
3. the time at which the disclosure of the data will take place; and
4. that no disclosure of the data will take place if payment of the debt is effected prior to the disclosure, or if an extension of the time for payment is granted or an agreement is entered into and observed on payment by instalments.

18.  The competent minister may lay down more detailed rules on the procedure in relation to disclosure to credit information agencies of data on debts to public authorities. In this connection it may be decided that data on certain types of debts to public authorities may not be disclosed, or may be disclosed only where further conditions than those referred to in section 16 have been complied with.

Part 6
Credit information agencies

19.  Any person who wishes to carry on business involving processing of data for assessment of financial standing and creditworthiness for the purpose of disclosure of such data (credit information agency) shall obtain authorisation to do so from the Data Protection Agency prior to commencing such processing, cf. section 50 (1) 3.

20. – (1)  Credit information agencies may only process data which by their nature are relevant for the assessment of financial standing and creditworthiness. 

  (2) Data as mentioned in section 7 (1) and section 8 (4) may not be processed.  

  (3) Data on facts speaking against creditworthiness and dating back more than 5 years may not be processed, except where it is obvious in any specific case that the facts in question are of decisive importance for the assessment of the financial standing and creditworthiness of the person concerned.

21.  According to the provisions of section 28 (1) or section 29 (1), credit information agencies shall notify the person to whom the data relate of the data mentioned in these provisions.

22. – (1)  Credit information agencies shall, at any time, at the request of the data subject, notify him within 4 weeks, in an intelligible manner, of the contents of any data or assessments relating to him that the credit information agency has disclosed within the immediately preceding 6 months, and of any other data relating to the data subject that the agency records or stores at the time of the receipt of the request, whether in a processed form or by way of digital media, including any credit ratings. 

  (2) Where the agency is in possession of further material relating to the data subject, the existence and type of such further material shall at the same time be communicated to him, and he shall be informed of his right to inspect such material by personally contacting the agency.  

  (3) The agency shall further provide information on the categories of recipients of the data and any available information as to the source of the data referred to in subsections (1) and (2).

  (4) The data subject may demand that the agency’s communication as referred to in subsections (1) to (3) shall be given in writing. The Minister of Justice shall lay down rules on the payment of a fee for communications given in writing.

23. – (1)  Data on financial standing and creditworthiness may be given only in writing, cf., however, section 22 (1) to (3). The agency may, however either orally or in a similar manner, disclose summary data to subscribers, provided that the name and address of the inquirer are recorded and stored for at least 6 months.

  (2) Publications from credit information agencies may contain data in a summary form only and may be distributed only to persons or enterprises subscribing to notices from the agency. The publications may not indicate the civil registration numbers of data subjects.

  (3) Disclosure of summary data on indebtedness may only take place where the data originate from the Danish Official Gazette, have been notified by a public authority under the rules laid down in Part 5 of this Act, or if the data relate to indebtedness in excess of DKK 1,000 to a single creditor and the creditor has obtained the written acknowledgement by the data subject of the debt being due and payable, or where legal proceedings have been instituted against the debtor concerned. Data on approved debt re-scheduling schemes may, however, not be disclosed. The rules referred to in the first and second clauses of this subsection shall also apply to the disclosure of summary data on indebtedness in connection with the preparation of broader credit ratings.

  (4) Summary data on the indebtedness of individuals may be disclosed only in such a manner that the data cannot form the basis for assessment of the financial standing and creditworthiness of other persons than the individuals concerned.

24.  Any personal data or credit ratings which turn out to be inaccurate or misleading shall be rectified or erased without delay.

25.  Where any data or credit ratings which turn out to be inaccurate or misleading have already been disclosed, the agency shall immediately give written notification of the rectification to the data subject and to any third party who has received the data or the credit rating during the six months immediately preceding the date when the agency became aware of the matter. The data subject shall also be notified of any third party that has been notified under clause 1 of this section, and of the source of the personal data or credit rating.

26. – (1)  Where a data subject requests the erasure, rectification or blocking of data or credit assessments which are alleged to be inaccurate or misleading, or requests the erasure of personal data which may not be processed, cf. section 37 (1), the agency shall reply in writing without delay and within 4 weeks from receipt of such a request. 

  (2) Where the agency refuses to carry out the requested erasure, rectification or blocking, the data subject may within 4 weeks from receipt of the reply of the agency or from expiration of the time-limit for replying laid down in subsection (1) bring the matter before the Data Protection Agency, which shall decide whether erasure, rectification or blocking shall take place. The provisions laid down in section 25 shall be correspondingly applicable.

 (3) The reply of the agency in the cases mentioned in subsection (2) shall contain information about the right to bring the matter before the Data Protection Agency and about the time-limit for such submission.

Part 7
Transfer of personal data to third countries

27. – (1) Transfer to a third country of data may take place only if the third country in question ensures an adequate level of protection, cf. however subsection (3).

  (2) The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation, in particular the nature of the data, the purpose and duration of the processing operation, the country of origin and country of final destination, the rules of law in force in the third country in question and the professional rules and security measures which are complied with in that country;

 (3) In addition to the cases mentioned in subsection (1), transfer of data to a third country may take place on condition that:

1. the data subject has given his explicit consent; or
2. the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject’s request; or
3. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
4. the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
5. the transfer is necessary in order to protect the vital interests of the data subject; or
6. the transfer is made from a register which according to law or regulations is open to consultation either by the public in general or by any person who can demonstrate legitimate interests, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case; or
7. the transfer is necessary for the prevention, investigation and prosecution of criminal offences and the execution of sentences or the protection of persons charged, witnesses or any other persons in criminal proceedings; or
8. the transfer is necessary to safeguard public security, the defence of the Realm, and national security.

  (4) Outside the scope of the transfers referred to in subsection (3), the Data Protection Agency may authorise a transfer of personal data to a third country which does not comply with the provisions laid down in subsection (1), where the controller adduces adequate safeguards with respect to the protection of the rights of the data subject. More detailed conditions may be laid down for the transfer. The Data Protection Agency shall inform the European Commission and the other Member States of the authorisations that it grants pursuant to this provision.

Title III
The data subject’s rights

Part 8
Information to be provided to the data subject

28. – (1)  Where the personal data have been obtained from the data subject, the controller or his representative shall provide the data subject with the following information:

1. the identity of the controller and of his representative;
2. the purposes of the processing for which the data are intended;
3. any further information which is necessary, having regard to the specific circumstances in which the personal data are obtained, to enable the data subject to safeguard his interests, such as: 
   (a)  the categories of recipients;
   (b)  whether replying to the questions is obligatory or voluntary, as well as possible consequences of failure to reply;
   (c) the rules on the right of access to and the right to rectify the data relating to the data subject.

   (2) The provisions of subsection (1) shall not apply where the data subject already has the information mentioned in paragraphs 1 to 3.

29. - (1)  Where the data have not been obtained from the data subject, the controller or his representative shall at the time of undertaking the recording of the data, or where disclosure to a third party is envisaged, no later than the time when the data are disclosed, provide the data subject with the following information:

1. the identity of the controller and of his representative;
2. the purposes of the processing for which the data are intended;
3. any further information which is necessary, having regard to the specific circumstances in which the data are obtained, to enable the data subject to safeguard his interests, such as:
   (a) the categories of data concerned;
   (b)  the categories of recipients;
   (c) the rules on the right of access to and the right to rectify the data relating to the data subject.

  (2) The rules laid down in subsection (1) shall not apply where the data subject already has the information referred to in paragraphs 1 to 3 or if recording or disclosure is expressly laid down by law or regulations.

  (3) The rules laid down in subsection (1) shall not apply where the provision of such information to the data subject proves impossible or would involve a disproportionate effort.

30. – (1)  Section 28 (1) and section 29 (1) shall not apply if the data subject’s interest in obtaining this information is found to be overridden by vital private interests, including the interests of the subject data himself. 

  (2) Derogations from section 28 (1) and section 29 (1) may also take place if the data subject’s interest in obtaining this information is found to be overridden by vital public interests, including in particular:

1. national security;
2. defence;
3. public security;
4. the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for regulated professions;
5. an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters; and
6. monitoring, inspection or regulatory functions, including temporary tasks, connected with the exercise of official authority in cases referred to in paragraphs 3 to 5.

Part 9
The data subject’s right of access to personal data

31. – (1)  Where a person submits a request to that effect, the controller shall inform him whether or not data relating to him are being processed. Where such data are being processed, communication to him shall take place in an intelligible form about:

1. the data that are being processed;
2. the purposes of the processing;
3. the categories of recipients of the data; and
4. any available information as to the source of such data.

  (2) The controller shall reply to requests as referred to in subsection (1) without delay. If the request has not been replied to within 4 weeks from receipt of the request, the controller shall inform the person in question of the grounds for this and of the time at which the decision can be expected to be available.

32. – (1) Section 30 shall be correspondingly applicable. 

  (2) Data which are processed on behalf of the public administration in the course of its administrative procedures may be exempted from the right of access to the same extent as under the rules of section 2, sections 7 to 11 and section 14 of the Act on Public Access to Documents in Administrative Files 

  (3) The right of access shall not apply to data processed on behalf of the courts where the data form part of a text which is not available in its final form. This shall, however, not apply where the data have been disclosed to a third party. There is no right of access to the records of considerations of verdicts or to any other court records of the deliberations of the court or material prepared by the courts for the purpose of such deliberations.

  (4) Section 31 (1) shall not apply where data are processed solely for scientific purposes or are kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics.

  (5) As regards processing of data in the area of criminal law carried out on behalf of the public administration, the Minister of Justice may lay down exemptions from the right of access under section 31 (1) in so far as the provision of section 32 (1), cf. section 30, is assumed to result in requests for rights of access in general being turned down.

33.  A data subject who has received a communication in accordance with section 31 (1) shall not be entitled to a new communication until 6 months after the last communication, unless he can prove that he has a specific interest to that effect.

34. – (1)  Communication in accordance with section 31 (1) shall be in writing, if requested. In cases where the interests of the data subject speak in favour thereof, the communication may, however, be given in the form of oral information about the contents of the data.

  (2) The Minister of Justice may lay down rules for payment of a fee for communications which are given in writing by private companies, etc.

Part 10
Other rights

35. - (1)  A data subject may at any time object in relation to the controller to the processing of data relating to him.

  (2) Where the objection under subsection (1) is justified, the processing may no longer involve those data.

36. - (1)  If a data subject objects, a company may not disclose data relating to that person to a third company for the purposes of marketing or use the data on behalf of a third company for such purposes.

  (2) Before a company discloses data concerning a consumer to a third company for the purposes of marketing or uses the data on behalf of a third company for such purposes, it must check in the CPR-register whether the consumer has filed a statement to the effect that he does not want to be contacted for the purpose of marketing activities. Before data relating to a consumer who has not given such information to the CPR-register are disclosed or used as mentioned in the first clause of this subsection, the company shall provide information about the right to object under subsection (1) in a clear and intelligible manner. At the same time, the consumer shall be given access to object in a simple manner within a period of two weeks. The data may not be disclosed until the time limit for objecting has expired.

  (3) Contacts to consumers under subsection (2) shall otherwise take place in accordance with the rules laid down in section 6 (a) of the Danish Marketing Act and rules issued by virtue of section 6 (a) (6) of the Danish Marketing Act.

  (4) The company may not demand any payment of fees in connection with objections.

37. - (1)  The controller shall at the request of the data subject rectify, erase or block data which turn out to be inaccurate or misleading or in any other way processed in violation of law or regulations.

  (2) The controller shall at the request of the data subject notify the third party to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with subsection (1). However, this shall not apply if such notification proves impossible or involves a disproportionate effort.

38.  The data subject may withdraw his consent.

39. - (1)  Where the data subject objects, the controller may not make him subject to a decision which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects.

  (2) The provision laid down in subsection (1) shall not apply if that decision:

1. is taken in the course of the entering into or performance of a contract, provided the request for the entering into or the performance of the contract, lodged by the data subject, has been satisfied or that there are suitable measures to safeguard his legitimate interests; or
2. is authorised by a law which also lays down measures to safeguard the data subject's legitimate interests.

  (3) The data subject has a right to be informed by the controller as soon as possible and without undue delay about the rules on which a decision as mentioned in subsection (1) is based. Section 30 shall be correspondingly applicable.

40.  The data subject may file a complaint to the appropriate supervisory authority concerning the processing of data relating to him.

Part 12
Notification of processing carried out for a public administration

43. - (1)  The controller or his representative shall notify the Data Protection Agency before processing of data is carried out on behalf of the public administration, cf., however, section 44. The controller may authorise other authorities or private bodies to make such notifications on his behalf.

  (2) The notification shall include the following information:

1. the name and address of the controller and of his representative, if any, and of the processor, if any;
2. the category of processing and its purpose;
3. a general description of the processing;
4. a description of the categories of data subjects and of the categories of data relating to them;
5. the recipients or categories of recipients to whom the data may be disclosed;
6. proposed transfers of data to third countries;
7. a general description of the measures taken to ensure security of processing;
8. the date of the commencement of the processing;
9. the date of erasure of the data.

44. - (1)  Processing operations which do not cover data of a confidential nature shall be exempt from the rules laid down in section 43, cf., however, subsection (2). Such processing may further without notification include identification data, including civil registration numbers, and data concerning payments to and from public authorities, unless it is a matter of processing as mentioned in section 45 (1).

  (2) The Minister of Justice shall lay down more detailed rules on the categories of processing operations mentioned in subsection (1).

  (3) Processing whose sole purpose is the keeping of a register which according to law or regulations is intended to provide information to the public in general and which is open to public consultation shall also be exempt from the rules laid down in section 43.

  (4) The Minister of Justice may lay down rules to the effect that certain categories of processing of data shall be exempt from the provisions laid down in section 43. This shall, however, not apply to the categories of processing mentioned in section 45 (1).

45. - (1)  Before processing operations covered by the obligation to notify in section 43 are carried out, the opinion of the Danish Data Protection Agency shall be obtained where:

1. processing includes data which are covered by section 7 (1) and section 8 (1); or
2. processing is carried out for the sole purpose of operating legal information systems; or
3. processing is carried out solely for scientific or statistical purposes; or
4. processing includes alignment or combination of data for control purposes.

  (2) The Minister of Justice may lay down rules to the effect that the opinion of the Agency shall be obtained prior to the start of any other processing operations than those mentioned in subsection (1).

46. - (1)  Changes in the information mentioned in section 43 (2) shall be notified to the Agency prior to being implemented. Less important changes may be notified subsequently, but not more than 4 weeks after the implementation.

  (2) The opinion of the Agency shall be obtained prior to the implementation of changes in the information mentioned in section 43 (2) contained in notifications of processing operations
covered by section 45 (1) or (2). Less important changes shall only be notified. Notification may take place subsequently, but not more than 4 weeks after the implementation.

47. - (1)  In cases where the data protection responsibility has been delegated to a subordinate authority and the Agency cannot approve the carrying out of a processing operation, the matter shall be brought before the competent Minister who shall decide the matter.

  (2) If the Agency cannot authorise the carrying out of a processing operation on behalf of a municipal or county authority, the matter shall be brought before the Minister of the Interior who shall decide the matter.

Part 13
Notification of processing operations carried out on behalf of a private controller

48. - (1)  Prior to the commencement of any processing of data which is carried out on behalf of a private controller, the controller or his representative shall notify the Danish Data Protection Agency, cf., however, section 49.

  (2) The notification shall include the information mentioned in section 43 (2).

49. - (1)  Processing of data shall, except in the cases mentioned in section 50 (2), be exempt from the rules laid down in section 48 where:

1. the processing relates to data about employees, to the extent that the processing does not relate to data as mentioned in section 7 (1) and section 8 (4); or
2. the processing relates to data concerning the health of employees, to the extent that the pro- cessing of health data is necessary to comply with provisions laid down by law or regulations; or
3. the processing relates to data concerning employees if registration is necessary under collective agreements or other agreements on the labour market; or
4. the processing relates to data concerning customers, suppliers or other business relations, to the extent that the processing does not relate to data as mentioned in section 7 (1) and section 8 (4), or to the extent that it is not a matter of processing operations as mentioned in section 50 (1) 4; or
5. the processing is carried out for the purpose of marketing, to the extent that the processing does not relate to data as mentioned in section 7 (1) and section 8 (4); or
6. the processing is carried out by an association or similar body, to the extent that only data concerning the members of the association are processed; or
7. the processing is carried out by lawyers or accountants in the course of business, to the extent that only data concerning their clients are processed; or
8. the processing is carried out by doctors, nurses, dentists, dental technicians, chemists, ther- apists, chiropractors and other persons authorised to exercise professional activities in the health sector, to the extent that the data are used solely for these activities and the processing of the data is not carried out on behalf of a private hospital; or
9. the processing is carried out for the purpose of being used by an occupational health service.

  (2) The Minister of Justice shall lay down more detailed rules concerning the processing operations mentioned in subsection (1).

  (3) The Minister of Justice may lay down rules to the effect that other types of processing operations shall be exempt from the provision laid down in section 48. However, this shall not apply to processing operations covered by section 50 (1) unless the processing operations are exempted under section 50 (3).

50. - (1)  Prior to the commencement of any processing of data which is subject to the obligation to notify in section 48, the authorisation of the Data Protection Agency shall be obtained where:

1. the processing relates to data as mentioned in section 7 (1) and section 8 (4); or
2. the processing of data is carried out for the purpose of warning third parties against entering into business relations or an employment relationship with a data subject; or
3. the processing is carried out for the purpose of disclosure in the course of business of data for  assessment of financial standing and creditworthiness; or
4. the processing is carried out for the purpose of professional assistance in connection with staff recruitment; or
5. the processing is carried out solely for the purpose of operating legal information systems.

  (2) In the case of transfer of data as mentioned in subsection (1) to third countries by virtue of section 27 (1) and subsection (3) 2 to 4, the authorisation of the Data Protection Agency to such transfer shall be obtained, also if the processing is otherwise exempt from the obligation to notify by virtue of section 49 (1).

  (3) The Minister of Justice may lay down exemptions from the provisions of subsection (1) 1 and subsection (2).

  (4) The Minister of Justice may lay down rules to the effect that the authorisation of the Agency shall be obtained prior to the commencement of other processing operations subject to the obligation to notify than those mentioned in subsection (1) or subsection (2).

  (5) The Agency may when granting an authorisation under subsection (1), subsection (2) or subsection (4) lay down more detailed conditions for the carrying out of the processing operations for reasons of the protection of the privacy of the data subjects.

51. - (1)  Changes in the information mentioned in section 48 (2), cf. section 43 (2), shall be notified to the Agency prior to being implemented. Less important changes may be notified subsequently, but not more than 4 weeks after the implementation.

  (2) The authorisation of the Agency shall be obtained prior to the implementation of changes in the information mentioned in section 48 (2), cf. section 43 (2), contained in notifications of processing operations covered by section 50 (1), (2) or (4). Less important changes shall only be notified. Notification may take place subsequently, but not more than 4 weeks after the implementation.

Part 14
Notification of processing operations carried out on behalf of the courts-of-law

52.  The rules laid down in sections 43 to 46 shall apply to the notification to the Danish Court Administration of processing of data carried out on behalf of the courts-of-law.

Part 15
Miscellaneous provisions

53.  Processors established in Denmark and offering electronic processing services shall prior to the commencement of such processing operations notify the Data Protection Agency hereof.

54. - (1)  The supervisory authority shall keep a register of processing operations notified under sections 43, 48 and 52. This register, which shall, as a minimum, contain the items of information mentioned in section 43 (2), shall be open to consultation by the general public.

  (2) A controller shall make the information mentioned in section 43 (2) 1, 2 and 4 to 6 concerning the processing operations performed on his behalf available to any person who makes a request to this effect.

Title VI

Supervision and final provisions