Danish Authority Clarifies When Suppliers May Share Employee Data to Show Labor Clause Compliance

Key Takeaways

• Balancing-of-Interests Basis: The Danish Data Protection Authority says suppliers must generally rely on GDPR Article 6(1)(f) when disclosing employee data to contracting authorities for labor-clause compliance.
• Article 6(1)(e) Not Available: Even when public bodies are legally required to include employment clauses, suppliers cannot use Article 6(1)(e) because the legal obligation does not apply to them.
• Documentation Must Be Limited: Only information strictly necessary to show compliance, such as pay slips, time sheets, or employment contracts, should be disclosed.
• Employee Rights Still Matter: Disclosures must not override employees’ rights or freedoms, but the purpose of labor clauses typically supports the legitimacy of the processing.
• No Legal Duty to Disclose: The Authority notes it is not aware of any legislation or collective agreements that require suppliers to provide such employee data, meaning Section 12(1) of the Danish Data Protection Act does not apply.

Deep Dive

The Danish Data Protection Authority has stepped into a debate over how far suppliers can go when asked to hand over employee information as proof that they’re complying with employment clauses in public and private contracts. A new guidance statement, issued in response to a request from Accura Advokatpartnerselskab, lays out the Authority’s view on the data protection rules that govern these disclosures, and confirms that many suppliers have been right to question the legal footing.

Employment clauses have become a common feature of contracts in Denmark, used by both public bodies and private companies to ensure fair wages and working conditions and to prevent social dumping. To verify compliance, contracting authorities often ask suppliers for documentation tied directly to individual workers, including pay slips, time sheets, and employment contracts. But that scrutiny has created uncertainty about whether suppliers actually have a lawful basis to share that information.

According to the regulator, they do, but only under the General Data Protection Regulation's (GDPR) balancing-of-interests provision. The Authority concludes that Article 6(1)(f) of the GDPR is the appropriate foundation for disclosure in most cases, noting that the overall purpose of employment clauses carries “weighty legitimate interests” both for suppliers seeking to fulfill their contracts and for contracting authorities responsible for monitoring compliance. Those interests, the Authority says, will generally justify disclosing personal data unless specific circumstances argue otherwise.

Why Other Legal Bases Don’t Apply

The Authority’s analysis also addresses a point that has confused suppliers: whether they can rely on Article 6(1)(e), which allows processing necessary for tasks carried out in the public interest. Some contracting authorities are legally obliged to include employment clauses in their agreements, but that obligation does not extend to suppliers themselves. Because Article 6(1)(e) requires a legal mandate under EU or national law that applies to the controller (in this case the supplier) it cannot serve as the basis for sharing employee data.

A similar question arises under Denmark’s Data Protection Act. Section 12(2), another balancing-of-interests provision tied specifically to employment relationships, could in theory apply where a contracting authority has a legal duty to enforce employment clauses. But here again, the Authority finds that applying Section 12(2) would not meaningfully change the outcome compared with using GDPR Article 6(1)(f).

The Authority also notes that it is not aware of any existing laws or collective agreements that directly require suppliers to send employee information to contracting authorities. Because of that, it did not consider whether Section 12(1), which applies when processing is legally required, could ever be used in such situations.

What Suppliers Need to Keep in Mind

Although the opinion supports the view that suppliers generally can disclose employee data when needed to document compliance, the Authority stresses that these disclosures must remain proportionate. Only information that is strictly necessary should be shared, and suppliers must ensure that employees’ rights and freedoms are not outweighed in the balancing exercise.

Still, the Authority emphasizes that the purpose behind employment clauses, ensuring responsible labor practices and protecting workers’ pay and conditions, typically supports the conclusion that disclosure is legitimate. In most cases, there will be sufficient grounds under Article 6(1)(f) unless specific, exceptional circumstances tilt the balance the other way.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.