You are here: Information Security Data protection General information Use of personal data in an employment relationship

Use of personal data in an employment relationship

The purpose of this information is to notify you of the data which Aarhus University registers and processes in connection with your employment, as well as how the data is processed and your rights in this respect.

The data protection officer (DPO) at Aarhus University is Michal Lund Kristensen. The task of the data protection officer is to oversee that Aarhus University’s processing of personal data is lawful. Read more about the DPO’s role and find contact details. 

As data controller, Aarhus University is responsible for all personal data collected, processed and recorded about you, irrespective of whether the university itself processes data or uses a subsupplier for the processing of the data.

 

Purpose of data processing

Aarhus University processes personal data concerning you for use in the payment of your salary and other administration of your employment, as well as the data generated as a consequence of your functions, e.g. PURE, email address, website and minutes of meetings. The legal basis for processing this data is Article 6(1) (b) and (c) and Article 9(2) (b) of the General Data Protection Regulation. 

Types of employee data

Some types of data are related to the payment of your salary, and other types of data concern access to IT systems and physical access to buildings, while other data is more related to the tasks that you perform, such as meeting minutes or your email address.

The types of data registered by the university concerning you are: Name, civil. reg. no., address, salary seniority, collective agreement, employment contract, job advertisement, application with attachments (including curriculum vitae), written agreements from SDD dialogues, holiday taken/remaining, special holidays and any childcare days, minutes from salary negotiations, citizenship, days of absence due to illness, access cards, electronic equipment, keys, physical location and parking permits.

The types of data which the university may have registered about you in cases where this is or becomes relevant are: Lists of publications, maternity/paternity leave, adoption and parental leave, childcare days, absence due to illness in connection with reimbursement, minutes from any sickness absence interviews, minutes from any disciplinary meetings and any disciplinary sanctions, work permits, special offices (positions of trust), shift scheduling, any record of working hours, free-choice pension scheme, senior staff scheme, increased tax rate, mileage allowance, free telephone, withholding of pay by the Danish Customs and Tax Administration (SKAT), booking of a house in the Holiday Fund, psychologist counselling scheme, course registrations, size of work clothes and shoes and identification photograph. 

Disclosure of personal data

Aarhus University only discloses personal data in cases where there is a legal basis for doing so.

This may include, for example, disclosure of income information to the Danish Customs and Tax Administration (SKAT), as well as information about absence due to illness, on applying for municipal salary reimbursement. The legal basis for the disclosure of personal data to government agencies and institutions is Article 6(1) (e) of the General Data Protection Regulation.

The university will disclose the required personal data to the union organisation authorised to negotiate (union representative) in connection with pay negotiations. The legal basis for this disclosure is Article 6(1) (c) of the General Data Protection Regulation.

Your civil. reg. no. and special (sensitive) personal data will not be disclosed to the union organisation/union representative authorised to negotiate without your explicit consent. In such case, the legal basis for this disclosure is Articles 6(1) (a) and 9(2) (a) of the General Data Protection Regulation.

Disclosure of personal data concerning you to private companies will only take place with your explicit consent. This might include personality test data, for example.

The university obtains data from you directly, from the Danish National Registration Office and from the Danish Customs and Tax Administration (SKAT). 

Access to your personal data

At Aarhus University, the following groups of employees will have access to the personal data processed by HR:

  • HR employees and employees who undertake personnel administration
  • Your management

The following employees at Aarhus University will receive the necessary data:

  • Employees in AU Finance concerning salary data
  • In special cases, data is sent to other government agencies and institutions, if this is necessary due to, for example, cooperation agreements with the Central Denmark Region, reimbursements in connection with EU projects, or concerning ministries, foundations or the police.
  • The union representative/union organisation authorised to negotiate

Not all employee groups have access to all types of personal data. The more sensitive the data, the fewer employees will have access. The employees who have access may only view the data to the extent that the data is relevant for the tasks performed.

 

Archiving and deletion

For as long as you are still employed by Aarhus University, data concerning your employment is saved.

If you resign and are then re-employed within a period of five years, information from your previous employment will not be deleted.

Documents relating to your employment will be stored in Aarhus University’s IT systems.

As a general rule, the data concerning you as an employee registered by the university will be deleted five years after your employment has ended and the data has been submitted to the State Archives, to the extent that the data is subject to the duty to submit to the State Archives.

This means that you must take particular care to save your own employment documents and any other documents relating to your employment that you assess that you might need at a later time, since as a general rule it will not be possible to obtain the documents later than five years after your resignation.

The information concerning you that will not be deleted five years after your resignation is:

  • Details of any occupational injuries/occupational accidents.
  • Information of significance to any pending civil or legal employment or legal collective agreement proceedings/arbitration proceedings for which the time limit for appeal has not expired.
  • Information concerning work with carcinogenic substances.
  • Information for use in any subsequent payment of a civil servant’s pension.

This data will not be deleted until there is no longer any legal basis for its continued storage.

Your rights

You have a number of rights that can be fulfilled by request concerning your employment details. You must contact the HR unit that manages your employment. If you are in any doubt about which unit you can contact, please contact your immediate manager.

1. Access

  • You can request access to the data that AU has registered about you concerning your employment. As a general rule, you have a right of access to all data which the university has registered about you. The university must meet your request for access as soon as possible and, as far as possible, within one month.

2. Rectification

  • You have the right to rectification of any personal data concerning you which is factually incorrect.

3. Deletion

  • You have the right to request the deletion of personal data that is no longer required in order to fulfil the processing purpose, or if the processing of this data is unlawful. It should be noted that the university’s interest in documenting your employment history will often mean that the data will not be deleted during your employment.

4. Limitation

  • AU is not entitled to process data that is not necessary for the administration of your employment.

5. Objection

You may object to the processing of your personal data, if you:

  • believe that the data is processed unlawfully
  • for personal reasons do not wish personal data to be processed and these reasons outweigh the university’s data processing purpose. 

6. Possibility of appeal to the Danish Data Protection Agency.

  • You may appeal to the Danish Data Protection Agency if you believe that the university processes data concerning your employment unlawfully.  

Portrait photo

The university wishes to have photos of employees on its website. You are not obliged to agree to have your photo on AU’s website. If you do not wish to have your photo on the website, this decision will have no consequences for your employment.

1443654 / i40