“Research-based public sector consultancy is an umbrella term for a variety of services universities perform for the Danish state and others. The services range from research within a certain field to specific emergency-response and consultancy tasks.
Research-based public sector consultancy could be:
When you are involved in public sector consultancy, you should be aware that, depending on the assignment, it may include personal data. It is not always straightforward to assess whether this is the case. Therefore, ask yourself the following questions to find out whether you will be processing personal data when you perform a public sector consultancy task:
When you process personal data in connection with research-based public sector consultancy, you must have a legal basis for such processing. Basically, the University Act allows AU to conduct public sector consultancy. This authority is exercised through a number of specific agreements with ministries and their agencies. Therefore, when AU provides research-based public sector consultancy, it is part of AU's work as a university and thus exercising its authority.
When determining your basis for processing, you should consider the following:
When you have determined AU’s role, you can decide whether AU has an independent basis for processing. If AU is the data controller, you will have to ensure, on behalf of AU, that AU has independent legal authority for the processing. However, if AU is the data processor, the processing will be based on the authority's (the ministry’s or agency’s) basis for processing.
If AU is the data controller, you must know the types of personal data in order to assess what possible bases for processing there are. Finally, you must know whether you are solely processing personal data for the public sector consultancy task, or whether you are also processing personal data for other purposes, e.g. research. If you have multiple purposes, you must ensure a basis for processing for each of your purposes.
Examples of a basis for processing of personal data in connection with research-based public sector consultancy:
Note that this depends on the specific circumstances for the processing.