Privacy policy for whistleblower scheme
This privacy policy describes how Copenhagen Business School (hereinafter referred to as "CBS", ''we'' or ''us'') processes personal data of the whistleblower when an offence is reported thorough the scheme.
The personal data processing is described in detail below together with your rights if you use the whistleblower scheme to report an offence.
Please see other guidelines for the whistleblower scheme with descriptions of who can report, what can be reported, and the investigation process.
This policy solely concerns the processing and investigation of reports made to the whistleblower scheme and must therefore be seen in context with the HR personal data policy and other relevant policies and procedures.
The privacy policy does not deal with the processing of personal data about the person concerned. Due to the duty of confidentiality in section 25 of the Whistleblower Protection Act, CBS is not bound to fulfil the duty of disclosure under Article 14.5.d of GDPR, and exempts the affected person from the right of access pursuant to the Data Protection Act § 22, paragraph. 3, cf. section 35 of the Public Access to Information Act.
1. Data controller
The legal entity responsible for processing your personal data is:
Copenhagen Business School
CVR-number 19596915
Solbjerg Plads 3
2000 Frederiksberg
E-mail: cbs@cbs.dk
Phone: 3815 3815
Contact information on our Data Protection Officer:
Stougaard & Bech Advokater
2. Process description
Purpose (Panel content)
Processing and investigating reports made to the whistleblower scheme about:
- the person who has reported an offence (the whistleblower)
If a deliberate false reporting is suspected, this also includes investigations of the person who has made the report.
Categories (Panel content)
We can process the following categories of personal data about you provided that you choose not to make an anonymous report:
Ordinary personal data
- Name, e-mail, telephone number
- The content of your report
- Additional information from the persons mentioned under "Sources” in cases where a deliberate false report is suspected.
As a rule, sensitive information and information about offences and convictions about you will not be part of the processing of the whistleblower report unless you choose to provide such information about yourself in the report.
However, information about offences or possible offences may be included in the processing if a deliberate false report is suspected.
Sources (Panel content)
We can collect data from the following sources:
- Employees, future and former
- Members of Senior Management
- Members of the CBS Board of Directors
- Suppliers
- Collaborative partners
- Volunteers
- Trainees
- Self-employed people with a working connection to CBS
- Other persons, affiliated with CBS
The legal basis for processing (Panel content)
As described above we process your personal data on the following legal basis:
- Article 6.1.c and 6.1.e (necessary to process in compliance with a legal obligation and perform a task in the public interest or under public exercise of authority)
- Article 9.2.g (necessary for essential public interests)
- The Danish Data Protection Act s. 8 pertaining to information about criminal offences and convictions
- The Danish Data Protection Act s. 11 pertaining to civil registration number (CPR)
Sharing information (Panel content)
We can share your information with persons outside the whistleblower unit only with your consent.
We can share your information with public authorities when the disclosure is made to address violations or judicial proceedings, including with a view to safeguarding the rights of defence of the person concerned.
You will be notified prior to this disclosure, unless the notification will jeopardize related investigations or judicial proceedings.
Storage (Panel content)
We will retain personal data as long as it is necessary for the purposes mentioned.
- The information is retained for the entire duration of the investigation. The retention period thereafter will depend on a specific assessment of whether the retention of investigated reports is still necessary and proportionate.
- If a report is made to the police or other authority, the information will be stored for at least as long as the investigation is ongoing with the police / authority.
- If, on the basis of the information collected, a disciplinary sanction is imposed on the person who made the report, or if there are other reasons why it is objective and necessary to continue to store the information about the person who made the report, the information is stored in the person's personnel file.
- In other situations, it is assessed concretely whether there are objective reasons for storing the information and, if so, for how long.
- As CBS is covered by the Public Access to Information Act, the information is stored at least until the case has been handed over to the National Archives.
3. Consequences of the processing
A report to or an investigation of a report to the whistleblower scheme will not have consequences for whistleblowers, provided that the whistleblower at the time of the report has reasonable grounds to believe that the information reported is correct and that the information in question falls within the material scope of the whistleblower scheme.
A report to the whistleblower scheme may have significant consequences for the whistleblower who has deliberately reported wrong or misleading information. Such reports are fined unless a higher penalty is due under applicable legislation.
4. Transfers to countries outside the EU/EEA
Your personal data is not transferred to countries outside the EU/EEA.
5. Your general rights
You have the following rights:
- You have the right to request access to and rectification or deletion of your personal data.
- You also have the right to object to the processing of your personal data and have the processing of your personal data restricted.
- In general, you have an unconditional right to object to the processing of your personal data for direct marketing purposes.
- If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent.
- You have the right to receive your personal data in a structured, commonly used and machine-readable format (data portability).
- You may always file a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency.
In addition, you have the right to object to our processing of your personal data:
- If our processing of your personal data is based on article 6.1.e (public interest or in the exercise of official authority) or article 6.1.f (balancing of interests), see above under legal basis, you may at any time object to our processing of your personal data for reasons that concern your specific situation.
There may be conditions or limitations to these rights and it is therefore not certain that you have the right to have your personal data deleted in the specific case as it will depend on the specific circumstances of the processing activity.
You can take steps to exercise your rights by contacting CBS Legal at legal@cbs.dk.
6. Right to a judicial review
If employment proceedings are taken against you as a result of a report and subsequent investigation, you are entitled to bring the matter before the court.
7. Danish Data Protection Agency
As a data subject, you have the right to lodge a complaint with Datatilsynet if you think that CBS does not comply with its obligations under the General Data Protection Regulation.
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Tlf.: 33 19 32 00
E-mail: dt@datatilsynet.dk