AU's use of personal data in an employment relationship

The purpose of this letter is to provide you with information about what data Aarhus University registers and processes in connection with your employment, as well as how the data is processed and your rights in this respect.

The data protection officer (DPO) at Aarhus University can be found on the website. The task of the data protection officer is to oversee that Aarhus University’s processing of personal data is lawful.

The data protection officer can be contacted by email at: dpo@au.dk.

As data controller, Aarhus University is responsible for all personal data collected, processed and recorded about you, regardless of whether the university itself processes data or uses a subsupplier for the processing of the data.

 

Purpose of data processing

Aarhus University processes personal data concerning you for use in the payment of your salary and other administrative processes related to your employment, as well as the data generated as a consequence of your job functions, e.g. PURE, email address, website and minutes of meetings.

The legal basis for processing this data is Article 6(1) (b) and (c) and Article 9(2) (b) of the General Data Protection Regulation and Section 7 of the Danish Data Protection Act.

Types of employee data

Some types of data are related to the payment of your salary, and other types of data concern access to IT systems and physical access to buildings, while other data is more related to the tasks that you perform, such as meeting minutes or your email address.

The types of data registered by the university concerning you are:
Name, civil registration number, address, salary seniority, collective agreement, employment contract, job advertisement, application with attachments (including curriculum vitae and diplomas/exam certificates), written agreements from SDD dialogues, holiday taken/remaining, special holidays, minutes from salary negotiations, citizenship, days of absence due to illness, access cards, electronic equipment, keys, physical location.

The types of data which the university may have registered about you in cases in which this is or will become relevant are:
Lists of publications, teaching portfolio, references, maternity/paternity leave, adoption and parental leave, childcare days, any agreements concerning transfer of holidays, absence due to illness in connection with reimbursement, minutes from any sick leave absence interviews, minutes from any disciplinary meetings and any disciplinary sanctions, work permit, special offices (positions of trust), shift scheduling, any registration of working hours, use of the Danish Confederation of Professional Associations’ (AC organisation) free-choice scheme, free-choice pension scheme, senior staff scheme, increased tax rate, mileage allowance, free telephone, withholding of pay by SKAT (the Danish Customs and Tax Administration), parking permits, booking of houses through the Holiday Fund, psychological counselling by referral, course registrations, size of work clothes and shoes, identification photograph, information about which tools and equipment you have been provided with, contact information for your nearest relatives. The list is not exhaustive.

Disclosure of personal data

 

Aarhus University only discloses personal data in cases in which there is a legal basis for doing so.

This may include disclosure of income information to the Danish Customs and Tax Administration (SKAT), information about absence due to illness in connection with applications for municipal salary reimbursement, or to the Royal Danish Library for the purpose of new user creation and access to the library’s printed and digital collections. The disclosure of personal data to government agencies and institutions takes place on the legal basis of Article 6(1) (e) of the General Data Protection Regulation and Section 11(1) of the Danish Data Protection Act.

In special cases, data is sent to other government agencies and institutions, if this is necessary due to, for example, cooperation agreements with Central Denmark Region, reimbursements in connection with EU projects, or concerning ministries, foundations or the police.

The university will disclose necessary personal data to the union organisation (union representative) authorised to negotiate in connection with pay negotiations.  The legal basis for such disclosure is Article 6(1) (c) of the General Data Protection Regulation and Section 12(1) or (2) of the Danish Data Protection Act.

Your civil. registration number and special (sensitive) personal data will not be disclosed to the union organisation/union representative authorised to negotiate without your explicit consent. In the event that you consent to such disclosure, the legal basis for this disclosure is Articles 6(1) (a) and 9(2) (a) of the General Data Protection Regulation and Section 12(3) of the Danish Data Protection Act.

Disclosure of personal data concerning you to private companies will only take place with your explicit consent. This might include personality test data, for example. Such disclosure has its legal basis in Section 12(3) of the Danish Data Protection Act.

The university collects and receives data from you and from government agencies and institutions such as The National Registration Office and The Danish Customs and Tax Administration (SKAT).

Access to your personal data processed by HR

At Aarhus University, the following groups of employees will have access to the personal data processed by HR:

  • HR employees and employees who undertake payroll, personnel and financial administration
  • Your management

Not all employee groups have access to all types of personal data. The more sensitive the data, the fewer employees will have access. The employees who have access may only process the data to the extent that the data is relevant for the tasks performed.

 

Archiving

For as long as you are employed by Aarhus University, data concerning your employment is saved.

Documents relating to your employment will be stored in Aarhus University’s IT systems.

The university has the authority to store most of the data registered by the university concerning you as an employee for five years after your resignation. The following data may be stored by the university for more than five years:

  • Master data
  • Details of any occupational injuries/occupational accidents
  • Information of significance to any pending civil or legal employment or legal collective agreement proceedings/arbitration proceedings for which the time limit for appeal has not expired.
  • Information concerning work with carcinogenic substances
  • Information for use in any subsequent payment of a civil servant’s pension

The university submits employee data to the Danish State Archives to the extent required in accordance with the rules in the Danish Archives Act and in the ministerial order concerning public archives and the activities of public archives, cf. Section 14 of the Danish Data Protection Act.

It is your responsibility to save the documents relating to your employment.

Your rights

You have a number of rights to information about your employment details that you can exercise by submitting a request. You should contact the HR unit that administers your employment conditions. If you are in any doubt about which unit you can contact, please contact your immediate supervisor.    

1. Inspection of data 

  • You can submit a request to inspect the data that AU has registered about you concerning your employment. As a general rule, you have a right to inspect all data which the university has registered about you. The university must meet your request to inspect such data as soon as possible and, as far as possible, within one month.    

2. Rectification

  • You have the right to rectification of any personal data concerning you which is factually incorrect.

3. Deletion

  • You have the right to have personal data deleted that is no longer required in order to fulfil the processing purpose, or if the processing of this data is unlawful. 
    Note that the university’s interest in documenting your employment history means that the data will not be deleted during your employment.  

4. Limitation

  • AU is not entitled to process data that is not necessary for the administration of your employment.

5. Objection

You may object to the processing of your personal data, if you:

  • Believe that the data is processed unlawfull 
  • In some cases, for personal reasons do not wish personal data to be processed and these reasons outweigh the university’s data processing purpose.

6. How to make a complaint

  • You can make a complaint to the university’s Data Protection Officer (dpo@au.dk) or to the Danish Data Protection Agency if you believe that the university is processing data concerning your employment unlawfully.    

Portrait photo

The university wishes to have photos of employees on its website. You are not obliged to agree to have your photo on AU’s website. If you want to have your photo on the website, you must upload it yourself.

If you do not wish to have your photo on the website, this decision will have no consequences for your employment.

Use of personal data on AU's websites

The university wishes to present employees on AU’s websites. The following employee details are therefore published on a number of different AU websites:

  • Name
  • Organisational affiliation
  • Work contact details
  • Physical location
  • Content registered in Pure.

With the exception of the aforementioned employee details and research publications (see more below), registration of content in Pure is voluntary and is either undertaken directly by the individual employee or by an editor at the request of the individual employee. Any such content may be deleted at any time, either by the individual employee or by an editor at the request of the individual employee.

Examples of voluntary content are:

  • Employee photo
  • CV
  • Registration of activities/conferences/press cuttings/projects
  • Graphic illustrations on the website of the person’s relations at AU and of the places in the world where the person has attended conferences.

Registration of research publications prepared by researchers affiliated with AU is not voluntary and this content may not be deleted. In addition to the individual employee or an editor, publications may also be registered by AU Library, the Royal Danish Library.

When content is registered in Pure, the individual employee accepts that this content may be presented on AU’s websites.

Read more about the display of data from Pure. 

If you have any questions about employee information on AU’s websites, please contact Head of Web Steffen Longfors, AU IT.