Written by
Reference register – no objections
According to the assessment of the Data Protection Agency, there were no grounds for the Agency to initiate a case against a municipality based on the establishment of a reference register.
Written by
Selma Carøe
Forfattere
A municipality was planning to establish a reference register. After the media questioned the lawfulness of establishing such registers, the Data Protection Agency requested the municipality to answer a number of questions about the contemplated reference register.
In its response to the Data Protection Agency, the municipality stated, among other things, that the reference register would only be established and used within the same administrative department in the municipality and thereby not across administrative branches or legal entities, and that the register was thus only a matter of internal sharing of personal data that was already processed within the administrative department in question.
The municipality also stated that only employees who had acted in material breach of their employment in the specific administrative department, particularly in relation to citizen-related matters, would be listed in the reference register.
Registration would be based on a specific assessment made by the dismissing manager and HR in connection with the dismissal of an employee. This assessment would include whether the circumstances on which the dismissal was based could be expected to affect the overall assessment of whether the employee should be offered new employment in the event of a future application, and in this regard special consideration for citizens and the risk of recurrence would be given importance.
Furthermore, the municipality stated that only managers and supervisors in the specific administrative department in the municipality would have access to search the reference register, and that the reference register would only contain information about whether the applicant was registered, which could be checked by searching the person’s social security number in the register. The manager would then be directed to contact HR.
Finally, the municipality stated that, as a general rule, the information in the reference register would be deleted after five years.
Based on the municipality’s statement, the Data Protection Agency assessed that there was no basis for the Agency to initiate a case.
Norrbom Vinding assisted the municipality with the establishment of the reference register.
Norrbom Vinding notes
- that the opinion of the Data Protection Agency generally confirms that reference registers can be established in the context of the GDPR – also in the public sector; but
- employers looking to establish a reference register must always ensure to define the content, use and technical set-up of the register in accordance with the GDPR and other relevant regulations; and
- that Norrbom Vinding is also experiencing interest from other public authorities seeking advice on the framework for establishing reference registers. If you have any questions in this regard, please contact Søren Skjerbek.
The content of the above is not, and should not be a substitute for legal advice.
Forfattere