Privacy policy for employees at CBS
CBS' duty of disclosure: CBS' Data Protection policy gives you, as a subject, an overview of the personal data obtained by CBS, why CBS obtain the data and how CBS use the data.
1. The Data Controller
Copenhagen Business School
Solbjerg Plads 3
2000 Frederiksberg, Denmark
E-mail: cbs@cbs.dk
Company registry no. (CVR-nr.): 19596915
2. Exercising your rights
If you want to exercise your rights under the General Data Protection Regulation, please contact CBS or CBS' Data Protection Officer Jesper Smedegaard Madsen (contact information below).
You can read about your rights under the General Data Protection Regulation below.
3. CBS' Data Protection Officer
Stougaard & Bech Advokater
E-mail: jsm@cbs.dk
4. The legal basis for processing personal data
HR-administration
CBS processes your personal data in order to be able to enter into and complete the employment contract, which has been entered into between you and CBS.
Whistleblower setup
CBS processes your personal data as a part of exercising CBS’ role as a public authority.
Video surveillance
CBS processes your personal data as a part of exercising CBS’ role as a public authority.
Logging of activity on CBS’ systems and CBS’ networks
CBS processes your personal data as a part of exercising CBS’ role as a public authority.
5. The purpose of processing your personal data
HR-administration
The purpose of processing is administration of employees, including case work in connection with appointments.
Whistleblower setup
The purpose of processing is to process report of violations or suspected violations of a serious nature, e.g. financial crime, material breaches of work place security, violence towards an employee or sexual assaults on an employee.
Video surveillance
The purpose of processing your personal data is to support security and crime preventive considerations connected to the operation of the buildings, which CBS use, that to a wide extent are publicly available.
Logging of activity on CBS’ systems and CBS’ networks
The purpose of processing your personal data is to ensure the continuous operation of CBS’ systems and networks and to prevent abuse of the systems, which CBS make available to employees and students at CBS.
6. The period for processing your personal data
HR-administration
- Personal data, which is processed in connection with the administration of the employment, will be deleted no later than 20 years after the termination of the employment.
- Personal data regarding applicants will be deleted no later than 5 years after the application process has ended.
- Personal data will continuously be transferred to the Danish National Archives according to the Danish Archives Act and the rules set out by the Danish National Archives.
Whistleblower setup
- Personal data, which is processed in connection with the administration of the whistleblower setup, will, if the case is reported to the police or another authority, be deleted after the case is closed with the police or the authority.
Video surveillance
- Recordings from video surveillance at CBS properties will be deleted 30 days after the recording has been made, unless the recording is required to settle a specific dispute or for crime preventive purposes, the recording may be stored for a longer period of time.
Logging of activity on CBS’ systems and CBS’ networks
- Logging of activity on CBS’ systems and CBS’ networks is stored for as long as it is necessary to ensure the continuous operation as well as prevent abuse of the systems, which CBS make available.
7. Categories of personal data
HR-administration
Regular personal data
- Identification information, e.g. name and address
- Information regarding your employment needed for administration, e.g. position, salary information, education and absence due to illness
Special categories of personal data (sensitive personal data)
- Health information
- Union membership
- Sexual orientation
Social security number (CPR-no.)
Information on criminal offenses
- Criminal record
- Information on potential criminal offenses made in connection with the employment at CBS.
Whistleblower setup
Regular personal data
- Identification information
Information on criminal offenses
- Information on potential criminal offenses made in connection with the employment at CBS.
Video surveillance
Regular personal data
- Picture
Information on criminal offenses
- Information on potential criminal offenses made in connection with being at CBS’ premises
Logging of activity on CBS’ systems and CBS’ networks
Regular personal data
- Identification information, e.g. user name, IP number.
- Activity in systems and on networks
Information on criminal offenses
- Information on potential criminal offenses made in connection with the use of CBS’ systems and networks.
8. Receivers of personal data
CBS may in certain situations pass personal data on to the following external institutions and it will either be based on a legal obligation set out in law or your prior consent:
- The Danish tax authorities
- Arbejdsmarkedets Tillægspension (ATP)
- Arbejdsmarkedets Feriefond og Feriekonto
- Statistics Denmark
- Agency for Modernisation
- Pensionsfund
- Banks and insurance companies
- Employee representative and trade unions
- Labour Market Insurance
- Arbejdsmarkedets Elevrefusion
- The Danish Agency for Labour Market and Recruitment
- Municipalities
- Barselsfonden
- CBS’ external auditors
- The Danish Police
Furthermore, the information may, in some cases, be transferred to data processors who process data on behalf of CBS – for example, partners or suppliers.
The transfer may occur in connection with, among other things, the operation of IT solutions, marketing, or research.
The transfers will always be based on an agreement, and the processing will be carried out in accordance with an accompanying instruction.
9. The subject's rights under the General Data Protection Regulation
9.1. Right to access
As a subject, you have the right to, access to the personal data that CBS process about you.
The right to access means that you have the right to get some general information on the processing of your personal data at CBS.
You have the right to one copy of your personal data being processed by CBS. For further copies, CBS is allowed to obtain a reasonable payment in accordance with the administrative costs.
9.2. Right to rectification
As a subject, you have the right to have inaccurate personal data, which is processed by CBS, rectified.
The right to rectification implies that you can have your personal data rectified if the personal data CBS is processing is no longer accurate.
9.3. Right to erasure
As a subject, you have the right to erasure of the personal data about you that CBS is processing.
The right to erasure implies that you can have personal data erased, which is no longer necessary for CBS as an organisation, if you have withdrawn your consent, if the personal data is being processed illegally or if CBS in accordance with the law is obligated to delete the personal information.
9.4. Right to restrict the processing personal data
As a subject, you have the right to restrict the processing of your personal data.
If you are of the opinion that CBS is processing inaccurate personal data about you, you have the right to have the processing restricted until it can be determined whether or not the personal data in question are accurate or not.
You have the right to have the processing of your personal data restricted if CBS is processing the personal data illegally, due to the fact, that the personal data is no longer necessary for the task, where the personal data is used, however, the personal data is necessary to you for later determining, defending or making a legal claim.
9.5. Right to data portability
The right to data portability implies that you can receive your personal data if you have provided the personal to CBS, if your personal data is being processed electronically, and if the personal data is processed on the basis of a consent or on the basis on a contract entered into between you and CBS.
9.6 The right to object to the public exercise of authority
As a subject, you have the right to object against processing of your personal data due to public exercise of authority.
9.7 Right lodge a complaint with the Danish Data Protection Agency (Datatilsynet)
As a subject, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), if you think that CBS does not comply with its obligations under the General Data Protection Regulation.
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Tlf. 33 19 32 00
dt@datatilsynet.dk