New Requirement for large and listed Companies to report on their Data Ethics Policies

What are Data Ethics?

The term “data ethics” is not defined by law, but may according to the legislative history be defined as follows:

 “Data ethics is generally understood as the ethical dimension of the relationship between technology on the one hand and the citizens’ fundamental rights, legal rights and fundamental social values on the other hand, which the technological development gives rise to consider.”

 Data ethics is related to the company’s ethical considerations when implementing new technologies, and when the amount of data processed is increased.

 Data ethics does not only refer to the handling of personal data, and as such the policies for data ethics has a broader scope than the personal data protection regulation. The data ethics also refers to how companies use data in a broader perspective, including for example how the company approaches and considers the use of algorithms and implementation of new technologies (see more examples below).

What should a Data Ethics Policy contain?

The data ethics policy should contain information regarding the company’s international data ethical guidelines and requirements and also any planned or executed steps taken in order to secure data ethical behavior.

As an example, the policy could include a description of the kind of data the company is handling and how such data is obtained and utilized. This includes data on customers, production and other behavioral data, elaborations on whether the company is handling data provided by external sources like social media or purchases data from other companies and/or data brokers.

The policy could also include a description of how the company utilizes and chooses to implement new technologies. Particularly relevant considerations would be how artificial intelligence or machine learning is incorporated in any development work and which ethical considerations management has had regarding the supply of new products and services incorporating such technologies. The use of artificial intelligence in pricing and optimizing of the production, making decisions etc., would also be relevant to elaborate on.

Moreover, the company may, if relevant, describe how the company trains algorithms used by the company, based on a data foundation which is representative for the target users of the company’s goods or services. In addition, considerations could be included regarding any measures implemented to avoid any bias.

The policy can further include information on how the company educates its employees in data ethics, and if any ongoing tests or evaluations are performed.

The “comply or explain” Principle

The reporting obligation is based on the principle of “comply or explain” which is known from the Danish Act on Financial Statements (in Danish: Årsregnskabsloven). Companies that have data ethics policies in place should include a description of the policies and elaborate on their efforts and results from working with data ethics in general.

Companies that have not implemented any data ethics policies nor begun their work with data ethics are obligated to elaborate on the reasoning for not having such policies in place. It will not be considered sufficient to merely refer to the size of the company, the industry standards or similar broad explanations. An explanation for the decision not to implement a data ethics policy or for not having begun any general data ethics work could for example be that the company does not make use of algorithms for data analysis, or that data is not a part of the company’s strategy and activities. The specific explanations must, however, be tailormade and based on each individual company to secure that the management of each company is forced to actively take part in the company’s work with data ethical standards.

The purpose of this reporting obligation is to secure that the top management of the company is involved in making decisions regarding the company’s work with data ethics.

Exception for Subsidiaries

Subsidiaries are exempt from the requirement to report on data ethics policies provided that the parent company reports on data ethics. A parent company can report on the data ethics for the entire group. A subsidiary must, however, include references to their parent company’s report on data ethics in its own annual report.

Our Recommendations

We recommend that all large or listed companies begin their work with data ethics in due time before the next annual report is due and that the top management is involved in the execution and planning of the company’s work with data ethical behavior.



The above does not constitute legal counselling and Moalem Weitemeyer does not warrant the accuracy of the information. With the above text, Moalem Weitemeyer has not assumed responsibility of any kind as a consequence of any reader’s use of the above as a basis for decisions or considerations.

This news piece has been produced in the English language only. Are you a client or a prospective client, and should you require a Danish version, please send us an email at news@moalemweitemeyer.com with a link to the article you would request to receive a Danish translation of, and we will attend to your request without undue delay.