1. ------IND- 2020 0458 DK- EN- ------ 20200813 --- --- PROJET
DRAFT 10 July 2020
of
Proposal
to
amend the Act on Digital Post from public senders
(Transfer of Digital Post controllership, strategic ownership, and decision-making
powers to the Agency for Digitisation, establishment of viewing clients, and
relocation of citizen and enterprise post)
§1
The Act on Digital Post from public senders (see Consolidation Act No 801 of 13
June 2016 as amended by § 29 of Act No 503 of 23 May 2018) is amended as follows:
1. § 2 is to be worded as follows:
Ҥ 2. The Minister for Finance designates one digital postal solution,
which is called Digital Post, and it is covered by the provisions of the Act.
Paragraph 2. The Minister for Finance appoints the Agency for Digitisation
to ensure the development, operation, maintenance, and administration of
the postal solution.
Paragraph 3. The Agency for Digitisation may appoint public authorities or
legal entities to carry out tasks pursuant to paragraph 2 on behalf of the
Agency for Digitisation.”
2. After § 2, the following is inserted as a heading:
“Controllership”.
3. After § 2, the following is inserted after the heading and before § 3:
Ҥ 2a. The Agency for Digitisation is the data controller for Digital Post
(see § 2). The Agency for Digitisation processes personal data in the form
of personal identification numbers, Central Business Register numbers,
email, and telephone numbers, etc. in connection with the operation,
maintenance, and administration of the postal solution, including
identification and notification of natural persons and legal entities
connected to Digital Post pursuant to §§ 3 and 4.
Paragraph 2. The provision in Article 21 of Regulation (EU) 2016/679 of
the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal
data and on the free movement of such data does not apply to the
processing of personal identification numbers pursuant to paragraph 1.
Page 2 of 49
Paragraph 3. Public senders are data controllers of the content of the messages
they send via Digital Post. The Agency for Digitisation is the data processor
of public senders’ sending of messages in the postal solution.
Paragraph 4. The Minister for Finance may lay down rules on
responsibilities, tasks, and supervision in relation to the Agency for
Digitisation’s processing of personal data in the postal solution on behalf
of the data controllers (see paragraph 3).
Paragraph 5. Enterprises are data controllers of the content of their own
messages that are sent via Digital Post and stored therein. The Agency for
Digitisation is the data processor for the sending of messages by the data
controller enterprises in the postal solution.
Paragraph 6. The Minister for Finance may lay down rules on
responsibilities, tasks, and supervision in relation to the Agency for
Digitisation’s processing of personal data in the postal solution on behalf
of the data controllers (see paragraph 5).”
4. Throughout the Act “Danish Minister for Business and Growth” is
changed to: “the Minister for Industry, Business and Financial Affairs”.
5. In § 4, paragraph 1, point 1 and § 4, paragraph 2, point 1, “a digital signature”
is changed to: “an electronic ID”.
6. In § 4, paragraph 2, points 2 and 3, “Until § 3, paragraph 1 enters into force,
the party in question may choose to cancel their connection to the postal
solution. Once § 3, paragraph 1 has entered into force, the connection is
binding, unless the party in question is exempted from connection.” is
changed to: “The connection is binding, unless the party in question is
exempted from it.”
Point 4 shall subsequently become point 3.
7. § 4, paragraphs 3 and 4 are repealed.
8. In § 6, paragraph 1, point 2, “Authorisation is granted by specifying, in the
postal solution, who shall have read access” is changed to: “Authorisation is
granted by using rights management to specify who shall have read access”.
9. In § 10, “which” is changed to: “that”.
10. The following is inserted after § 10:
Ҥ 10a. The Agency for Digitisation may authorise and, under specific
conditions, conclude agreements with public authorities to use the postal
solution per § 2, paragraph 1 to convey Digital Post from public senders
in a public viewing client to natural persons and/or legal entities.
Page 3 of 49
Paragraph 2. The Minister for Finance may lay down detailed rules on the
authorisation scheme for public authorities as providers of public viewing
clients (see paragraph 1).”
§ 10b. The Agency for Digitisation may authorise and, under specific
conditions, conclude agreements with private actors to use the postal
solution per § 2, paragraph 1 to convey Digital Post from public senders
in a commercial viewing client to natural persons and/or legal entities.
Paragraph 2. For the purposes of this Act, “private actors” are legal entities
that are not subject to § 7 nor are they public viewing clients (see § 10a).
Paragraph 3. Natural persons and legal entities may choose to use
commercial viewing clients to access their messages in the postal solution.
Paragraph 4. The Minister for Finance may lay down detailed rules on the
authorisation scheme for private actors as providers of commercial
viewing clients (see paragraph 1).”
11. After § 10b the following is inserted after the heading and before § 11:
Ҥ 10c. The Minister for Finance may lay down rules on the relocation of
messages from natural persons and legal entities in the postal solution,
including content data and administrative data, from one provider to
another, which then stores the digital post. The rules may, as further
specified, also cover messages sent by a public sender during a period in
which the sender did not have the status of public sender, but which
previously was or later became a public sender.
§2
The Act shall enter into force on 1 January 2021 (except as provided for in
paragraph 2).
Paragraph 2. The Minister for Finance sets the entry into force date for § 1, Nos 1,
2, 3, 8, and 9.
Page 4 of 49
Remarks on the Bill
General remarks
Table of contents
1. Introduction.................................................................................... 6
2. The main points of the draft Act ................................................... 8
2.1. Development, operation, maintenance, and administration of
Digital Post.............................................................................................. 8
2.1.1. Legislation currently in force ..................................................... 8
2.1.2. The considerations of the Ministry of Finance and the
proposed scheme ......................................................................... 8
2.2. Controllership ......................................................................................... 9
2.2.1. Legislation currently in force ..................................................... 9
2.2.2. The considerations of the Ministry of Finance and the
proposed scheme ......................................................................... 9
2.3. Viewing clients ...................................................................................... 10
2.3.1. Legislation currently in force ................................................... 10
2.3.2. The considerations of the Ministry of Finance and the
proposed scheme ....................................................................... 10
2.4. Relocation of post ................................................................................ 11
2.4.1. Legislation currently in force ................................................... 11
2.4.2. The considerations of the Ministry of Finance and the
proposed scheme ....................................................................... 11
3. Economic and implementation impact on the public sector. ... 13
3.1. Table of the proposal’s economic impact on the public sector .... 21
Page 5 of 49
4. Financial and administrative impact on trade and industry, etc.
....................................................................................................... 22
5. Administrative impact on citizens. ............................................. 27
6. The environmental impact. ......................................................... 28
7. Relationship to EU law ............................................................... 29
8. Consulted government authorities/agencies and organisations,
etc. ................................................................................................. 30
9. Summary table .............................................................................. 31
Comments on the Bill’s individual provisions.......................................... 32
Annex 1 43
The Bill compared to legislation currently in force.................................... 43
Page 6 of 49
1. Introduction
Digital Post is a public IT solution that enables public authorities to
communicate securely and digitally with citizens and enterprises.
As part of the implementation of the joint public digitisation strategy
2011-2015, the Danish Parliament adopted the Act on Public Digital Post
in June 2012 (title amended on 2016-06-08 to the Act on Digital Post
from public senders by Act No 633 amending the Act on Public Digital
Post). The principal act is referred to below as the Digital Post Act. The
Act meant that it became mandatory for citizens and enterprises to be
connected to Digital Post and thereby have a digital letter box for use in
receiving digital post from public senders.
The Digital Post Act gives the authorities the right to digitally send
messages, documents, etc. to citizens and enterprises with legal effect for
the addressee. The citizen or enterprise is thereby obligated to read their
digital post from public senders.
Another focus area in the joint public digitisation strategy 2016-2020 is
that the digital solutions shall be user-friendly, up-to-date, and of good
quality, and that enterprises and citizens shall be able digitally to receive all
relevant, digitisable post from the public sector.
As per legal requirements, Digital Post was put out to tender in order to
ensure a solution that is the best on the market in terms of price and quality.
The upcoming postal solution underpins a more simple, up-to-date, and
user-friendly distribution of digital post from public senders to citizens
and enterprises, which at the same time reinforces coherence with other
public digital infrastructure solutions.
The intention with the Bill is that in the upcoming solution, system
responsibility for the postal solution will be transferred back to the
Agency for Digitisation. The Agency for Digitisation, as system owner,
will then have the strategic ownership, and thereby decision-making
powers, to keep the postal solution up and running. This means that the
Agency for Digitisation will gain greater independence and flexibility than
has hitherto been possible due to the postal solution’s association with a
private provider. Such greater independence and flexibility is important, as
the postal solution is part of the joint public digital infrastructure, which is
just as socially critical as physical infrastructure.
The Bill makes it possible for public authorities and private actors to
provide user interfaces, so-called viewing clients, by which citizens and
enterprises can access their digital post.
Page 7 of 49
The Bill creates a legal basis for relocating citizens’ and enterprises’
existing post into future postal solutions. Digital post that is in the existing
postal solution before entry into force of this Act will be moved to the
postal solution covered by § 2, paragraph 1. This ensures that citizens and
enterprises will continue to be able to see their existing digital post.
The upcoming postal solution gives citizens and enterprises the
opportunity to:
Be better able to see the sender and topic of post
More easily act on the basis of the post
More simply find out to whom in the public sector they shall write
Autonomously choose where they want to read their digital post
from public senders.
Page 8 of 49
2. The main points of the draft Act
2.1. Development, operation, maintenance, and administration of Digital Post
2.1.1. Legislation currently in force
e-Boks A/S currently performs the tasks of developing, operating,
maintaining, and administrating (providing end-user support) the current
postal solution. The current Act states that the Minister for Finance
appoints a system administrator for the task of running Digital Post (see
§ 2, paragraph 2, point 1). The explanatory notes for the original § 2 of the
Act state that the digital postal solution, which is run by e-Boks A/S, is
subject to the Act. e-Boks A/S is thus the system administrator appointed
by the Minister for Finance for the task of running the postal solution.
2.1.2. The considerations of the Ministry of Finance and the proposed scheme
On the basis of a tender, the Agency for Digitisation has contracted
Netcompany Group A/S to provide a new postal solution to replace the
existing postal solution. In this connection, the intention is for the Digital
Post system responsibility to be transferred back to the Agency for
Digitisation. It is therefore proposed to establish that the Minister for
Finance appoints the Agency for Digitisation to ensure going forward the
development, operation, maintenance, and administration of the postal
solution. In addition, this Act will henceforth no longer use the term
system administrator, as it can be confused with data controller (see
section 2.2. below). The Agency for Digitisation, as system owner, will
now have the strategic ownership, and thereby decision-making powers, to
maintain the postal solution and perform the changes, updates, and
adaptations to it that shall take place on an ongoing basis.
It is also proposed that the Agency for Digitisation shall be authorised to at
any time appoint a public authority or private enterprise to perform on behalf
of the Agency for Digitisation the tasks of developing, operating, maintaining,
and administrating the postal solution. Administration involves, inter alia,
providing support in the form of technical advice and guidance to end users,
i.e. both citizens and enterprises that use the postal solution.
The Bill foresees the postal solution’s end-user support being initially covered
by Det Samlede Supporttilbud (comprehensive support tender), which was
adopted in initiative 1.4. of the joint public digitisation strategy 2016–2020, in
which it was decided that citizens and enterprises shall have a single,
comprehensive support service across joint public infrastructure solutions.
Page 9 of 49
2.2. Controllership
2.2.1. Legislation currently in force
It follows from current legislation that e-Boks A/S is the data controller for
administration of Digital Post. As the postal solution was tendered and a new
provider shall establish, operate, and maintain the solution, the controllership
shall be revised accordingly. The legislation currently in force remains
applicable for citizens and enterprises, which means that received messages
are only accessible to the addressee, who then has the right of disposal of the
messages. It is therefore also the addressee who can decide whether a
message shall subsequently be deleted, forwarded, saved, exported, etc.
2.2.2. The considerations of the Ministry of Finance and the proposed scheme
On the basis of a tender, the Agency for Digitisation has contracted
Netcompany Group A/S as provider of the upcoming postal solution, and
it has therefore been necessary to establish controllership accordingly.
With the proposed legal basis, the Agency for Digitisation will be the data
controller for the postal solution, as the Agency for Digitisation
determines the purpose of and tools with which personal data may be
proposed in the postal solution. This applies both in relation to the
development, operation, and maintenance of the solution, including in
relation to determination of the technical and organisational security
measures for the upcoming postal solution, for which Netcompany Group
A/S will thus become the data processor.
It is proposed that public authorities continue to be data controllers for the
content of the messages they send via the postal solution and that the Agency
for Digitisation becomes the data processor for the sending of messages in
the postal solution. It is proposed that the Minister for Finance shall be
authorised to issue rules on data processing and the division of controllership
between the public senders and the Agency for Digitisation.
The proposed provision in § 2a for citizens, and particularly paragraphs 5 and
6 for enterprises, is a continuation of legislation currently in force. Citizens’
digital post will be stored in the postal solution, and the citizens have sole
rights of ownership and disposal of their own digital post. As citizens do not
fall within the scope of the General Data Protection Regulation (see Article 2,
subparagraph 2c of Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection
Regulation) and Article 2, No 3a of Directive (EU) 2016/680 of the
European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data by
competent authorities for the purposes of the prevention, investigation,
detection or prosecution of criminal offences or the execution of criminal
Page 10 of 49
penalties, and on the free movement of such data, and repealing Council
Framework Decision 2008/977/JHA (the Law Enforcement Directive)),
there is no issue of a data processor configuration. In the legal sense of data
protection, citizens are thus not data controllers for the digital post in their
own digital letter boxes, even if such post may contain personal data of third
parties. The Agency for Digitisation will therefore not be the data processor
for the storage of post in citizens’ own digital letter boxes. An enterprise, on
the other hand, is the data controller for personal data – from the processing
of personal data about their customers or employees – which are contained in
messages stored in the enterprise’s digital letter box. The storage is handled
by the Agency for Digitisation as data processor (see § 2a, paragraph 5).
In the proposed paragraph 6, the Minister for Finance may lay down
detailed rules on the data processing by the Agency for Digitisation for the
storage of enterprises’ messages in the postal solution.
2.3. Viewing clients
2.3.1. Legislation currently in force
§ 2, paragraph 1 of the Digital Post Act states that the Minister for Finance
designates one postal solution for communication between public senders
and citizens and enterprises (see § 1 of the Act). The solution is called Digital
Post and is covered by the provisions of the Act, such that the postal solution
can be used with the legal effects established in the Act. Additionally,
pursuant to § 2, paragraph 2 of the Digital Post Act, the Minister for Finance
has appointed a system administrator for the task of running Digital Post.
The existing joint digital postal solution now in operation, encompassing post
from public senders, is currently run by e-Boks A/S.
It is mandatory for citizens and enterprises to be connected to Digital Post
(see § 3, paragraph 1 and paragraph 2, respectively, of the Digital Post
Act), unless they are exempted under § 5, paragraph 1 or paragraph 3,
respectively, of the Act.
2.3.2. The considerations of the Ministry of Finance and the proposed scheme
Adoption of this Bill would make the Agency for Digitisation the system
owner of Digital Post, which is one of the main purposes of the Bill, as
Digital Post is part of the joint public digital infrastructure, which is just as
socially critical as physical infrastructure.
One effect of the new postal solution is that citizens and enterprises can
access their digital post from public senders via user interfaces, which are
called viewing clients. Public authorities can establish public viewing clients,
which are made available to citizens and enterprises. In addition, private
actors can apply and be approved to establish and run user interfaces, which
are called commercial viewing clients. Thus, this enables the establishment of
a market for the provision of commercial viewing clients. Potential purposes
Page 11 of 49
of these are e.g. that the addressee can view their post from public senders
along with their post from private senders.
The public viewing clients are established and run by the Agency for
Digitisation and the Danish Business Authority on borger.dk and Virk,
respectively, via web browser access and associated mobile applications.
Other public authorities may also conclude connection agreements with
the Agency for Digitisation to establish public viewing clients. In addition,
providers in the form of private actors have the opportunity to convey
Digital Post through commercial viewing clients. The viewing clients shall
conclude a connection agreement with the Agency for Digitisation in
which the detailed requirements are laid down.
For the addressee, the legal effect of digital post from public senders will
be the same regardless of the type of viewing client chosen, as public and
commercial viewing clients are legally equivalent under this Bill. The
receipt time of a message, as under the current regulation, is thus
considered to be the moment at which a message is available to the
addressee in the viewing client used by the party in question (see the
special explanatory notes on No 9).
It is also proposed that the Minister for Finance shall be authorised to lay
down detailed rules on the authorisation schemes for viewing clients.
2.4. Relocation of post
2.4.1. Legislation currently in force
It is clear from the drafting history of the Digital Post Act that the
proposed rules would also apply to future postal solution providers.
However, neither the drafting history nor the provisions of the Act took a
position on the relocation of citizen and enterprise digital post from one
provider to another future provider of the postal solution.
2.4.2. The considerations of the Ministry of Finance and the proposed scheme
In order to create the necessary legal basis for relocation of citizen and
enterprise digital post from one provider to another provider of the postal
solution, it is proposed that the Minister for Finance shall be given
authorisation to issue rules on the matter.
Issuing rules on the relocation of Digital Post in the form of an Order
ensures that citizens and enterprises will be informed about the relocation of
their digital post. The issuing of rules in the form of an Order thus
contributes to transparency and aims to secure the trust of citizens and
enterprises by regulating and informing them that the Agency for Digitisation
takes care of the relocation and storage of their digital post. Likewise, postal
Page 12 of 49
solution providers will be outlined with the general framework for storage
and transferring the postal solution to one or several future providers.
In order to ensure that citizens and enterprises have access to their
existing digital post from public senders upon the switching of providers,
it is proposed that the Minister for Finance shall be authorised to lay
down detailed rules on the relocation of citizen and enterprise digital post.
This involves the relocation of content data and administration data in the
postal solution from one provider to one or several future providers. If
the letter box of a citizen or enterprise contains messages from public
senders which at the time of sending did not have the status of public
sender, but which previously were or later became public senders, such
messages are covered by the relocation.
The proposed amendment to the Act will thus create a legal basis to issue
rules on the relocation of citizen and enterprise digital post for both the
current and future postal solutions.
Page 13 of 49
3. Economic and implementation impact on the public sector.
Organisational, transitional, and operational impact
Development and operation of the upcoming postal solution will have an
economic impact on the public sector. Funding for development and
operation is joint public, which was most recently adopted in the
Agreement on municipal and regional finances for 2020 (ØA).
The total project costs for tendering and developing the solution are
expected to amount to DKK 267.1 million in the period of 2015–2022, of
which DKK 83.5 million will be in 2015–2019. Operation of the postal
solution is expected to cost approximately DKK 40–50 million annually
once it is fully commissioned. However, the costs depend to some extent
on the number and size of messages in the solution.
The new solution entails changes for authorities, such as adjusting and
adapting their IT systems in order to support the upcoming postal
solution. The transition means, inter alia, that authorities are required to
have a so-called receiving system that can retrieve and receive post sent to
the authority by citizens and enterprises.
The technical transition to the upcoming solution is expected to cost between
DKK 100 and 275 million for the public sector as a whole. This estimate is
still uncertain and the Agency for Digitisation is currently performing further
analyses. It was agreed in connection with ØA (agreement on municipal and
regional finances for 2020) that transition costs – including technical,
organisational, and other transition costs – will be borne locally.
Funding for operating costs is joint public. Prior to introduction of the
Bill, the solution has had additional development costs of DKK 84 million
excluding interest (calculated at the end of 2019).
Implementation of the upcoming postal solution will bring a number of
improvements and simplifications for authorities as well as citizens and
enterprises:
It will be simpler for authorities to administer and set up systems and
contact structures. In addition, it will be easier for authorities to access
statistics and reports concerning, inter alia, events in the solution.
Authorities will also be better able to ensure that enquiries via Digital Post
end up with the correct authority employee.
For citizens and enterprises, it will be simpler to see who post is from,
who it concerns, and what it is about. The user will be clearly presented
with important information, e.g. a deadline or an agreement. It will be
simpler for the user to read and navigate attachments and easier to find
Page 14 of 49
the recipient when one is to write to an authority. In addition, the user
gets a better overview of correspondence with public authorities. Overall,
the solution also reinforces coherence with other public solutions and thus
ensures a more coherent user experience.
More than 500 authorities are facing a reorganisation that requires major
or minor efforts, depending on the complexity and choices of the
individual authority. The Agency for Digitisation is helping the authorities
transition to the new solution by means of a comprehensive
implementation concept. The concept consists of, inter alia, a number of
materials and tools to support the transition to the upcoming Digital Post.
The concept has been tested with a number of pilot authorities to ensure
the best possible basis for the authorities’ transitions.
In order to support the authorities’ transition to the upcoming postal
solution, the Agency for Digitisation provides a task management tool for
authorities called “Implementation Overview of the Agency for
Digitisation”, abbreviated DIO. The tool is used to give the individual
authorities an overview of their own tasks related to the transition, as
described in the task packages. In addition, it constitutes a direct
communication channel from the individual authorities to the Agency for
Digitisation's implementation team. It should be noted that in order to
minimise the complexity of the task management tool, it is nearly identical
to the KLIK solution which is currently used by KOMBIT in connection
with the roll-out of systems to municipalities.
In order to detect and rectify any errors in the authorities’ integration with
the upcoming postal solution, interface connection tests have been
enabled in the first partial delivery tests and in the takeover test. The
purpose of the connection test is to give authorities and enterprises the
opportunity to test their integration with Digital Post. In consultation with
the Agency for Digitisation and on an ongoing basis, the provider will
keep up the test cases, which will develop over time as new integration
requirements arise, or risk areas are identified, that are to be addressed.
The tests will thus ensure properly functioning interaction between the
authorities’ systems and Digital Post.
IT support, IT governance, and risks
The Bill creates a legal basis that enables a future Digital Post IT solution
to be put into operation. The section above – Organisational, transitional,
and operational impact – already detailed how commissioning has a
number of impacts on the authorities in relation to their connection to the
solution. That section also describes how the Agency for Digitisation will
prevent and tackle the authorities’ potential challenges in the period
leading up to connection and commissioning. It can also be mentioned
that the postal solution shall be part of a larger joint public system
Page 15 of 49
landscape and it is linked to the joint public identity and security solutions
NemLog-in (easy log-in) and the upcoming MitID (my ID) as well as the
web solutions borger.dk (citizen portal) and Virk (business portal), which
is why it is necessary to integrate Digital Post with these other systems.
Data protection
Citizens’ data will be properly handled and processed and will comply with
the personal data legislation in force at any given time in Denmark, which
is currently Regulation (EU) 2016/679 of the European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of
such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) and Act No 410 of 27 April 2017 on the processing of
personal data by law enforcement authorities (the Law Enforcement Act),
as subsequently amended. Furthermore, the handling and processing of
data will comply with Danish legislation supplementary to the General
Data Protection Regulation and rules issued pursuant thereto – currently
and in particular Act No 502 of 23 May 2018 (the Data Protection Act) –
and it will adhere to the content of guidance papers on the personal data
legislation issued by relevant authorities and/or supervisory bodies.
An assessment has also found that there will be processing of personal
data which, due to their nature or scope, entails a national security risk,
and which is therefore subject to § 3, paragraph 9 of the Data Protection
Act and provisions issued pursuant thereto. These circumstances mean
that critical parts of the postal solution may not be stored outside of
Denmark’s borders. Non-critical parts of the solution that are not crucial
to its confidentiality, integrity, and availability may be located outside of
the country’s borders if an appropriate level of security is ensured in
accordance with Article 32 of the General Data Protection Regulation and
if they have data protection by design as per Article 25 using e.g.
encryption that at all times meets the requirements for strong encryption
in accordance with recognized standards and good practice and the
provider otherwise meets the established contingency requirements.
Significance for citizens
The Bill directly affects citizens, as pursuant to § 3 of the current Digital Post
Act on mandatory connection, there is statutory authority to connect citizens
to Digital Post, and according to § 10 there is statutory authority to regard
digital messages in the postal solution as having legal effect upon receipt.
The proposed amending Act does not change the exemption provisions of
§ 5 of the Digital Post Act and the associated Order, according to which
citizens can request exemption and have the possibility to be exempted if
one of the grounds for exemption listed in the order applies to them.
Page 16 of 49
Furthermore, the postal solution complies with current legislation and
web accessibility standards. Web accessibility concerns the principles and
techniques that shall be observed in the development of websites, mobile
applications, and other technical solutions so that they can be used by
everyone, including users with disabilities.
User interfaces are established in the form of public viewing clients for the
upcoming postal solution. They are run by the Agency for Digitisation and
the Danish Business Authority on borger.dk and Virk and provide citizens
and enterprises, respectively, with web access to Digital Post via browsers
and mobile apps. Other public authorities may also conclude connection
agreements to establish public viewing clients.
In addition, private enterprises may apply to convey Digital Post via
commercial viewing clients. A potential purpose of this, among others, is
to enable citizens to view both their public and private digital post in one
consolidated letter box.
The Bill makes equivalent the legal effect of digital post viewed in public
and commercial viewing clients in order to ensure the legal certainty of
citizens and to create a uniform legal situation for their benefit. A citizen’s
legal position will thus be the same regardless of whether they access their
digital post from public senders via a public or commercial viewing client.
Furthermore, the Bill creates a legal basis for the possibility to relocate
citizens’ post, including content data and administration data, to a future
postal solution, such that there will continue to be access to existing digital
post from public senders.
Seven principles for digital-ready legislation
What follows below is an assessment of how the Bill lives up to the
principles of digital-ready legislation and focuses in particular on the
principles of digital communication, reuse of data, safe and secure data
management, and public infrastructure use.
Principle 1: Simple and clear rules
The purpose of developing the upcoming postal solution is to underpin a
more simple, up-to-date, and user-friendly distribution of digital post from
public senders to citizens and enterprises, and from citizens and enterprises to
the authorities. At the same time, it reinforces coherence with other public
solutions, which shall provide citizens and enterprises with a more coherent
user experience. In addition, there will be a beneficial impact for the
authorities in relation to their use of the postal solution, as it will be improved
in a number of areas as compared to the current solution. As regards end
users, the upcoming postal solution has an increased focus on ensuring a high
degree of user-friendliness and accessibility, and UX designers will work on a
Page 17 of 49
user-centric design for the solution, which includes involving users in its
development. The project is underpinned by a user-centric design process of,
inter alia, the user interface, with the involvement of many users on an
ongoing basis, which ensures improved user-friendliness.
The Bill explains the legal situation for citizens and enterprises when they
use public and commercial viewing clients, respectively, which is a
distinction that is clarified in the text of the Act and its explanatory notes.
The legal situation will be the same for citizens and enterprises, regardless
of the type of viewing client they opt to use for access to their digital post.
In addition, some corrections are made to update terminology such that e.g.
digital signature is removed in favour of electronic ID; the explanatory notes
on this explain that there is a forthcoming solution in the form of MitID.
The rules and the solution itself thus comply with the principle of
simplicity and clarity.
Principle 2: Digital communication
The legislation shall underpin the ability of public authorities to digitally
communicate, in writing, with citizens and enterprises. This Act, the Digital
Post Act and its amending legislation and administrative provisions, deals
with regulation of Digital Post, which is the authoritative communication
channel between public senders and citizens and enterprises. This Bill is thus
in compliance with principle 2, as the postal solution itself constitutes the
main channel of communication in the public digital infrastructure.
Pursuant to § 3 of the current Digital Post Act on mandatory connection,
there is statutory authority to connect citizens and enterprises to Digital
Post, and according to § 10 there is statutory authority to regard messages
to the addressees as having legal effect upon receipt.
The Bill’s updated provisions on citizen and enterprise access to the postal
solution state that instead of using a digital signature, users shall now
authenticate themselves with an electronic ID with, inter alia, a well-defined
assurance level determined in accordance with legislation or public standards,
e.g. NSIS, and which is connected to the Danish national eID infrastructure.
NSIS is a National Standard for Identity Assurance Levels with the aim of
creating a common framework for trust in digital identities and digital identity
services. The NSIS standard defines various assurance levels for identity
assurance and authentication. The standard shall create greater flexibility for
identification in various self-service solutions (several assurance levels). NSIS
also improves synergy between solutions across the public sector. The
explanatory notes on the Bill further elaborate that use of the Danish national
eID solution, MitID, is expected to be enacted by law in 2021, and thereby
going forward it shall be used as electronic identification in order to gain access
Page 18 of 49
to the postal solution. Thus, the proposed amendment to the legislative
provision is suited to accommodate future technological developments.
The amending Act underpins the fact that the upcoming postal solution
takes into account that users use different technologies in different
situations, and it accordingly enables the use of different technological
tools to access Digital Post and be notified of new post. Viewing clients
are being developed for the solution which make Digital Post from public
senders available to citizens and enterprises via both web browser and
mobile application user interfaces. In the upcoming postal solution,
notifications of new messages are set up to go to two telephone numbers
as text messages and to five email addresses.
In addition, one of the purposes of the solution is that a greater number of
enterprises are expected to download their digital post from public senders
into their own enterprise email systems. Then, improved labelling options for
digital post can enable automated distribution to the internal inboxes of an
enterprise in its respective departments. Thus, enterprises can reduce the
amount of time they spend on the distribution and handling of their digital
post. This improvement also applies to public authorities, which similarly
download their digital post into their own systems.
The upcoming postal solution complies with the rules on web
accessibility. Thus, the Next Generation Digital Post contract includes a
number of requirements for the provider to comply with current
legislation and web accessibility standards in their development of the
solution. Using the established tests and trials of the solution, the Agency
for Digitisation monitors compliance with the contract requirements. As
part of the development of the solution, a number of user tests will also
be performed in which, inter alia, there will be a focus on persons with
visual impairments and/or other functional limitations.
Lastly, a major implementation initiative will be carried out in conjunction
with the transition to the upcoming postal solution. It will be organised in
collaboration with the Agency for Digitisation’s nationwide digitisation
network, the Network for Digital Inclusion, with more than 50
organisations representing various social groups that may experience
challenges with IT and digitisation. The implementation initiative will also
include the launching of a nationwide information campaign to ensure a
comfortable transition to the new solution, including for persons with
visual impairments or other functional limitations.
In compliance with the principle of digital communication, accessibility for all
Danish citizens and enterprises is thus taken into account in the Bill.
Page 19 of 49
Principle 3: Possibility of automated case processing
This principle involves taking considerations into account in authorities’
automated case processing, e.g. in decisions, including whether a proposal
supports the use of objective criteria in administration of the legislation.
This is deemed irrelevant in this context.
Principle 4: Consistency across authorities – uniform concepts and reuse of data
The new Digital Post solution uses existing personal data from the Civil
Registration System while handling data security in a safe and sound
manner and within the framework of the data protection legislation.
Similarly, Central Business Register numbers are used for enterprises. The
postal solution shall be part of a larger joint public system landscape and it
is linked to the joint public identity and security solutions NemLog-in
(easy log-in) and the upcoming MitID (my ID) as well as the web
solutions borger.dk (citizen portal) and Virk (business portal).
The solution will be future-proof and have the features that characterise
transferable and reusable IT services. It will also ensure efficient
interaction between the solution and the other joint public solutions as
well as the other IT solutions of authorities, enterprises, and the market
such that the diverse needs of users can be met collectively.
In order to achieve the desired flexibility and future-proofing, the solution
will be put together as modules, which can be assembled and replaced on
a regular basis; like building blocks. On the whole, this results in an
efficient digital infrastructure that can be further developed on an ongoing
basis. As the needs of users evolve, modules can be replaced as needed or
used in other public digital solutions.
Additionally, the Bill stipulates that it shall be possible to relocate citizens’ and
enterprises’ existing digital post from public senders to the upcoming postal
solution and to future solutions. This creates a legal basis for a flexible and
future-proofed handling of the digital post while accommodating users’ needs
for archive access to their own digital post. The Bill is thereby in compliance
with the principle of consistency across public administration.
Principle 5: Safe and secure data handling
The Digital Post Act enables written digital communication between
authorities and citizens or enterprises.
The postal solution underpins the joint public digitisation strategy’s
initiative 1.3., whereby citizens and enterprises can get an overview of
their communications with public authorities.
Page 20 of 49
The Bill lays down controllership in the new postal solution such that
there are clear rules concerning the processing of data and who the data
controllers are for the various processes in the solution, including when a
message is sent from an authority to the postal solution, when a message
is stored in the solution, and when a message is displayed to an addressee.
The solution will comply with the General Data Protection Regulation,
including Article 25: Data protection by design and by default as well as
data minimisation.
Principle 6: Use of public infrastructure
Digital Post in an inherently critical element of the joint public
infrastructure. The upcoming postal solution shall be part of a larger joint
public system landscape and the solution is linked to the joint public
identity and security solutions NemLog-in (easy log-in) and the upcoming
MitID (my ID) as well as the web solutions borger.dk (citizen portal) and
Virk (business portal). It is ensured in the development of the solution
that on the whole it is established as a user-friendly, secure and – in
relation to other digital infrastructure – coherent solution.
Principle 7: Prevention of fraud and errors
Principle 7 is deemed irrelevant to the Bill.
Based on a comprehensive review of the seven principles for digital-ready
legislation, the Bill is deemed to meet the requirements for digital-ready
legislation.
Page 21 of 49
3.1. Table of the proposal’s economic impact on the public sector
Potentially FFL
2020 2021 2022 2023 2024
Increased/decreased The State 26.8 26.9 27.2
expenditures in relation to
the former
scheme (DKK millions) Municipalities
and regions
Compensatory The State -16 -16 -16
savings/consumption of
reserves/increased Municipalities -38 -38 -38
revenue (DKK millions) and regions
Change in State personnel 5 5 5
requirements (net FTE)
Note: The table above only includes the ongoing operational costs and savings that result from the
upcoming postal solution. Transition costs and potential administrative savings are excluded. The
compensatory savings instead consist of the postage costs that each authority currently pays, but
for which payment in the coming solution is centralised.
Page 22 of 49
4. Financial and administrative impact on trade and industry, etc.
As of 1 April 2020, there were 657 223 enterprises connected to Digital
Post from public senders, and those enterprises can thus access their post
via e-Boks or Virk. Those enterprises can also set up the solution such
that they can download public digital post into their own enterprise email
systems, if they have a secure email solution. The Bill and the upcoming
postal solution aim to, inter alia, encourage more enterprises to
automatically download post into their own systems, as doing so in the
new solution will streamline their internal post distribution. Furthermore,
the Bill introduces a possibility for private actors to apply to offer
commercial viewing clients for the purpose of displaying digital post in
combination with additional services.
Automatic receipt of post in enterprise email systems
The intention of the upcoming postal solution is for more enterprises to
receive their post directly in their enterprise email systems. Doing so
requires that an enterprise has a secure email solution, which is
characterised by encrypted communications and the enterprise’s digital
letter box being configured to automatically forward the post. The Agency
for Digitisation estimates that at least 10 000 to 50 000 enterprises have
secure email solutions, but do not know that they can have their post
forwarded to their own email system.
Estimates and calculations of burden reductions and transition costs in the
following text are based on the 2017 report from the Agency for
Digitisation and Ernst & Young, Måling af erhvervsøkonomiske konsekvenser
ved NemLog-in3, MitID og næste generation Digital Post (Measuring the
economic impact on trade and industry from NemLog-in3, MitID, and
Next Generation Digital Post).
It is estimated that the enterprises that transition to receiving digital post
directly in their own email systems will have ongoing administrative
burden reductions of approximately DKK 14 million annually as a result
of the reduced time spent for Digital Post log-ins. The estimated burden
reduction is based on an average of the range of the 10 000 to 50 000
enterprises, i.e. approximately 30 000 enterprises, making use of the
possibility to automatically download post into their own email systems,
an estimated 2 minutes of time saved per login, and that enterprises are
expected to log in at least once per week, corresponding to approximately
45 log-ins per year per enterprise. These reductions presuppose an
increased awareness among enterprises of the possibility to automatically
download post into their own systems.
(The burden reductions for 10 000 to 50 000 enterprises, respectively,
amount to between DKK 5.1 million and DKK 25.5 million)
Page 23 of 49
For these enterprises, there will be costs of approximately DKK 15 million
associated with the transition to henceforth receive digital post in their own
email systems. The transition costs consist of configuring a security certificate
and the technical execution of the system integration. The transition costs are
based on 30 000 enterprises making use of the possibility to automatically
receive digital post, and that the time spent on configuring a certificate and on
system integration is 1.5 hours per enterprise.
(The transition costs will range from DKK 3.4 to 34 million based on
between 1–2 hours used by each of the 10 000 to 50 000 enterprises.)
Faster distribution of digital post
In the upcoming postal solution, it will be possible for the public senders to
better label post, so that enterprises receive their messages with more useful
labels. This enables enterprises to configure distribution rules in their own
email systems by labelling messages so that post is automatically forwarded
from a main letterbox to specific inboxes, based on the labels. The Agency
for Digitisation anticipates that the 30 000 enterprises – presumed to
implement automatic forwarding – will also use automatic distribution.
It is estimated that the enterprises that will use automatic distribution will
have ongoing administrative burden reductions of approximately DKK
140 million annually by no longer having to forward digital post manually.
The estimated burden reduction is based on 800 minutes of time saved
annually per enterprise for the 30 000 new enterprises that can be
expected to make use of the possibility for automatic distribution as well
as the 930 enterprises that will continue to do so.
(The burden reductions for 10 000 to 50 000 enterprises, respectively,
amount to between DKK 45.3 million and DKK 226.6 million annually.)
Establishment of commercial viewing clients
The Bill provides a possibility for private actors to establish commercial
viewing clients. A potential purpose of these is e.g. that the addressee can
view their digital post from public senders along with their post from
private senders in one single solution. The Bill thus fosters a market for
providers of commercial viewing clients. This increased competition may
prompt more enterprises to take advantage of the possibility to actively
use secure digital post.
Configuring a new security certificate
In conjunction with the introduction of the upcoming postal solution,
enterprises that already receive digital post from the public sector in their own
systems shall configure a new security certificate in order to be able to
integrate the system into their own email system. The Agency for Digitisation
Page 24 of 49
is preparing a guidance paper for enterprise configurations. It is estimated
that approximately 930 enterprises shall configure the new security certificate
and that individual enterprises will consume approximately 1 hour in doing
so. The transition costs for configuring a new security certificate are thus
estimated at approximately DKK 0.3 million.
Summary of transition costs and burden reductions
Based on the above-mentioned information, it can thus be summarised
that enterprise transition costs for the new postal solution will be
approximately DKK 0.3 million for enterprises that already receive post in
their own systems and, respectively, approximately DKK 15 million for
the 30 000 enterprises that do not currently receive post in their own
systems but which are presumed to have a desire to begin doing so.
The resulting, ongoing, administrative burden reductions (benefits) will
total approximately DKK 154 million annually.
Nimble commercial regulations
The Digital Post legislation helps create an IT infrastructure in Denmark
that to a large extent is underpinned by the five principles of nimble
commercial legislation.
The upcoming solution for Digital Post will underpin more simple, up-to-
date, and user-friendly means of communication between public senders
and enterprises, while at the same time reinforcing coherence with other
public solutions. This is particularly true of the upcoming solutions for
NemLog-in and MitID (next generation NemID), which together with the
upcoming postal solution were initiated within the framework of the joint
public digitisation strategy 2016–2020.
The three new solutions will contain new functionalities, user interfaces,
and presuppose or enable new enterprise workflows.
Basically, enterprises are expected to experience both quantitative and
qualitative beneficial consequences from the new solutions, as everyday
work will be simpler and more efficient.
1. Enable the use of new business models
The Bill on the upcoming postal solution gives citizens and enterprises a
clear and secure legal position, lays down controllership, and enables
authorities and enterprises to communicate securely and digitally.
At the same time, it opens up an opportunity for competition in a new
market for digital post user interfaces via e.g. web browsers and apps. A
potential purpose of the commercial viewing clients is that the addressees can
view their post from public senders along with their post from private
senders in one single solution. Another business model for some enterprises
Page 25 of 49
may be to offer commercial viewing clients linked to their core products,
thereby adding value to their existing services by also giving their users access
to Digital Post and the resulting secondary functionalities. For example, an
ancillary service could be a payment solution for assisting end user payments
of invoices received in the postal solution.
2. Simpler and more purposeful
One of the intentions of the Bill is to give more enterprises a reason to
receive their digital post directly in their enterprise email systems. With the
help of labelling post, the solution enables more efficient and automated
distribution in the enterprise email systems. Making use of this option is
voluntary for enterprises, and the most essential requirement for
integrating with Digital Post is that an enterprise email system encrypts
messages and can thereby be considered secure.
The proposed amending Act also establishes the concept of viewing
clients, which is an expression of the user interfaces that give enterprises
access to the postal solution. In general, a distinction is made between the
public viewing client that will be made available to enterprises by Virk, and
commercial viewing clients that can be made available by private providers
once they have been approved by the Agency for Digitisation to convey
Digital Post. As end users of Digital Post, enterprises therefore have the
freedom to use the solution most appropriate for them to access and
manage their digital post.
For the private providers of commercial viewing clients, there will be a high
degree of methodological freedom in designing their viewing clients. UX is an
abbreviation for User Experience and only a few requirements will be
stipulated for it; a message shall state the sender, subject, date, attachments,
etc. The requirements will primarily be of a security and functional nature and
aim to ensure that users can use the solution appropriately. These
requirements will be stated in the connection agreement between the Agency
for Digitisation and the provider of a viewing client.
In addition and in parallel, a number of recommendations will be made on
the appearance and functionality of viewing clients to ensure
recognisability for the user, based on the design of Virk, e.g. regarding
accessibility, icons, and wording.
3. Technological neutrality
No provisions are laid down on the use of specific technologies in relation
to users’ utilisation of the new Digital Post solution. However, for
technical reasons, it will be necessary for enterprises that want to
transition to receiving digital post in their own email systems to integrate
their systems accordingly and install a security certificate.
Page 26 of 49
The Bill ensures, as far as possible, that the legislation is both
technologically neutral and at the same time ready to handle future
solutions, as the new solution will be divided to a greater extent into
several independent modules, which provides greater flexibility in further
developing and reusing them in other contexts. This should also help
ensure a more uniform user experience.
4. Integrated approach
The solution shall ensure better coherence with the other public guides
and self-service solutions on Virk and borger.dk, by which users will to a
greater extent experience communications with the public sector in one,
single, user-friendly nexus.
5. Ensure user-friendly digitisation
The new Digital Post solution aims to be more secure, user-friendly, and
future-proofed, based on a new IT architecture. The improved possibility
to distribute digital post to enterprise email systems will make it user-
friendly for those employees who can access their enterprise digital post
from public senders via their usual email access.
A user-centric design process shall ensure that it is made simpler for users to
see who post is from, who it concerns, and what it is about. The user will be
clearly presented with important information, e.g. a deadline or an agreement,
and it will be simpler for the user to read and navigate attachments.
Furthermore, it will be easier to find the recipient when one is to write to an
authority, and the user gets a better overview of their correspondence.
In addition to being accessible via web browsers, the solution will also
provide access to digital communication with the authorities via newly
developed apps, which the public sector makes available with access to the
user’s digital post from public senders. In addition, users can choose to
utilise the aforementioned commercial viewing clients that may be on the
market as their access to digital post from public senders, which can be
reached there along with e.g. digital post from private senders.
Page 27 of 49
5. Administrative impact on citizens.
The current solution is available to citizens on borger.dk and e-boks.dk as
well as via an e-Boks app. The new solution will be available on borger.dk,
via a borger.dk app, and through prospective commercial viewing clients.
Citizens shall familiarise themselves with how this new solution works,
which will not differ significantly from the current solution on borger.dk.
In addition, citizens can choose to install and log in to the associated
borger.dk app. This will not differ significantly from that to which citizens
are already accustomed with the hitherto e-Box app, but it will require a
download and installation.
Additionally, citizens can choose to utilise the commercial viewing clients that
may have been established so that they can e.g. access both digital post from
public senders and digital post from private senders in the same user interface.
Page 28 of 49
6. The environmental impact.
The proposal continues the ongoing reduction in resource consumption
that results from the increased digitisation of public authority
communications with citizens and enterprises. The Bill thus has a relevant
positive environmental impact by virtue of reduced paper consumption
and reduced transport, which leads to a smaller environmental footprint
and lower greenhouse gas emissions.
Page 29 of 49
7. Relationship to EU law
The Bill meet the requirements of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation) and Directive (EU) 2016/680 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data by competent
authorities for the purposes of the prevention, investigation, detection or
prosecution of criminal offences or the execution of criminal penalties, and
on the free movement of such data, and repealing Council Framework
Decision 2008/977/JHA (the Law Enforcement Directive).
This draft Act has been notified as a draft in accordance with
Directive 2015/1535/EU of the European Parliament and of the Council
on an information procedure in the field of technical regulations and of
rules on Information Society services (codification).
Page 30 of 49
8. Consulted government authorities/agencies and
organisations, etc.
A draft Bill was sent for consultation to the following government
authorities/agencies and organisations, etc. in the period from 4 June 2020
to 3 July 2020: the Ministry of Employment; Ministry of Children and
Education; Ministry of Industry, Business and Financial Affairs; Ministry
of Finance; the Ministry of Defence; Ministry of Justice; Ministry of
Ecclesiastical Affairs; Danish Ministry of Climate, Energy and Utilities;
Ministry of Culture Denmark; Ministry of Environment and Food of
Denmark; Ministry of Taxation; Ministry of Social Affairs and the Interior;
Ministry of Health; Ministry of Transport and Housing; Ministry of
Higher Education and Science; Ministry of Foreign Affairs; Ministry of
Immigration and Integration; ATP; the Danish Bar and Law Society; AE –
the Economic Council of the Labour Movement; BL – Danmarks almene
boliger; Statistics Denmark; Dansk IT; Danish Standards; Forum for
digital sikkerhed; the Association of Danish Law Firms; DI Digital,
DKCERT – Danish Computer Security Incident Response Team,
Disabled Peoples’ Organizations Denmark; the Confederation of Danish
Employers (DA); the Danish Construction Association; Confederation of
Danish Enterprise; the Confederation of Danish Industry; Danish
Regions; the Danish Data Protection Agency; the Association of Danish
Judges; the Danish Disability Counsel; the Danish Federation of Small and
Medium-Sized Enterprises; FDIH – Danish E-commerce Association;
Finance Denmark; Danish Financial Supervisory Authority; Danish
Consumer Council - Tænk; Foreningen Danske Revisorer; Insurance &
Pension Denmark; DaneAge; Landbrugsrådet; Landsforeningen for
førtidspensionister; IBIZ-center; IT-Brancheforeningen; the Danish
Institute for Human Rights; IT-Political Association of Denmark; KMD;
KL – Local Government Denmark; KOMBIT; Danish Competition and
Consumer Authority; the Danish Parliamentary Ombudsman; Prosa –
Forbundet af IT-Professionelle; LOS – De private Sociale tilbud;
Microsoft Danmark; Nationalbanken; Nets DanID A/S; Rådet for digital
sikkerhed; Rådet for Socialt Udsatte; Telekommunikationsindustrien i
Danmark; Psykiatrifonden; High Commissioner of Greenland; the High
Commissioner of the Faeroe Islands; and the Danish national audit office.
Page 31 of 49
9. Summary table
Positive impact/lower Negative impact/higher
costs costs
Financial impact on the Yes Yes
State, municipalities,
and regions
Implementation impact Yes Yes
on the State,
municipalities, and
regions
Financial impact on Yes Yes
trade and industry
Administrative impact Yes Yes
on trade and industry
Administrative impact No No
on citizens
Environmental impact No No
Relationship to EU law The Bill meets the requirements of the General Data
Protection Regulation and the Law Enforcement
Directive.
The Bill was notified in accordance with the
Information Procedure Directive.
Is in violation of the No No
five principles for
implementing
regulation directed at
businesses / goes
beyond minimum
requirements in EU
regulation (mark with
X)
Page 32 of 49
Comments on the Bill’s individual provisions
On § 1
On No 1
(§ 2)
The proposed wording of the provision in § 2 continues the legislation
currently in force by which it is still the Minister for Finance who
designates one digital postal solution, which is called Digital Post, and it is
covered by the provisions of the Act.
The new paragraph 2 of the provision states that it is the Agency for
Digitisation which shall ensure the development, operation, maintenance, and
administration of the solution. The purpose of this new wording is to transfer
system ownership, and thereby decision-making powers to keep the solution
up and running, so that going forward it is the Agency for Digitisation which
has the strategic ownership and responsibility for carrying out the specified
tasks. Administration of the solution includes user support in the form of
technical advice and guidance to the users of Digital Post, i.e. citizens and
enterprises. Assistance is also provided to the authorities in conjunction with
their transition to the upcoming postal solution in the form of a
comprehensive implementation concept consisting of materials and tools to
support the transition to the upcoming postal solution.
It is proposed with paragraph 3 that the Agency for Digitisation can at any
time appoint a public authority or private enterprise to perform on behalf
of the Agency the tasks of developing, operating, maintaining, and
administrating the postal solution. However, the Agency for Digitisation
will remain data controller for the postal solution (see the proposed § 2a,
paragraph 1).
Development, operation, and maintenance, and other tasks that are not
performed by the Agency for Digitisation, will be put out to tender and
can be handled by external providers.
The contract for development of the upcoming postal solution was
drafted such that it covers an operation period of five years with a
possibility for three individual extensions of one-year.
The operation part includes the establishment, operation, and
maintenance of the infrastructure. Infrastructure means the necessary
environments that include hardware, operating systems, capacity, storage,
networks, network components, security components, etc. In addition to,
inter alia, ensuring that the infrastructure has sufficient storage space and
other capacity and provides sufficient performance, data shall be handled
and covered by backup procedures.
Page 33 of 49
Maintenance means, inter alia, tasks which ensure that the postal solution,
including the infrastructure, is further developed and adapted as new
wants and needs arise. This also includes preventive maintenance and
updating of the postal solution to secure it against potential crashes,
software failures, and compliance with IT security requirements. This
ensures that weaknesses in IT security are addressed in the most
appropriate way to protect the data contained in the solution against a loss
of confidentiality, integrity, and availability.
According to the proposal, administration of the postal solution can also be
handled by parties other than the Agency for Digitisation. The basic ambition
for public digital solutions is to reduce the support needs of citizens and
enterprises by means of better digital solutions. When there is nevertheless a
need for support, the Comprehensive Support Tender shall make it easier for
citizens and enterprises to get help. The Comprehensive Support Tender was
formally established on 1 January 2020 by the Danish Business Authority.
The postal solution’s end-user support will be covered by the
Comprehensive Support Tender, which was adopted in initiative 1.4 of the
joint public digitisation strategy 2016–2020. It was decided in the
digitalisation strategy to ensure that citizens and enterprises receive
effective and uniform support if they experience problems with e.g.
Digital Post, MitID, or NemLog-in. Going forward, the current end-user
support for Digital Post on borger.dk and Virk will therefore be combined
into a single support unit so that citizens and enterprises can get help with
these solutions in one single place.
There are no changes in the scope of the tasks currently covered by the
support tenders and the existing delineations of the individual authorities’
support tenders is maintained. The new support tender shall thus not
handle inquiries related to cases and the authorities shall still be able to
answer questions about the joint public solutions.
The end-user support is expected to perform tasks related to users’ utilisation
of the postal solution, such as searches, guidance and technical assistance.
The Agency for Digitisation can transfer the support service back to itself
at any time as necessary.
End-user support in relation to commercial viewing clients is performed
by the individual provider of a commercial viewing client.
The previous provisions in § 2, paragraphs 2 and 3 are continued in
updated versions in § 2a on controllership.
Page 34 of 49
On No 3
(§ 2a)
The proposed wording of the provision in § 2a creates clarity regarding
controllership in the postal solution.
The proposed paragraph 1 stipulates that the Agency for Digitisation is
the data controller for the postal solution. The provisions establish that as
data controller, the Agency for Digitisation may processes personal data in
the form of personal identification numbers, Central Business Register
numbers for enterprises, email, and telephone numbers, etc. in connection
with identification and notification of digital post recipients. It is necessary
for the Agency for Digitisation to process such information in order for
messages to be delivered to the correct recipients.
Article 4, No 7 of the General Data Protection Regulation defines a data
controller as that “(...) which, alone or jointly with others, determines the
purposes and means of the processing of personal data”.
Article 24, paragraph 1 states that data controller responsibilities entail a “(...)
Taking into account the nature, scope, context and purposes of processing as
well as the risks of varying likelihood and severity for the rights and freedoms
of natural persons, the controller shall implement appropriate technical and
organisational measures to ensure and to be able to demonstrate that
processing is performed in accordance with this Regulation.”
The Agency for Digitisation’s legal basis for processing Central Business
Register numbers, email, and telephone numbers is Article 6, paragraph 1e
of the General Data Protection Regulation and the legal basis for
processing personal identification numbers is § 11, paragraph 1 of the
Data Protection Act.
The proposed paragraph 2 is a legal continuity. The provision is a derogation
from Article 21 of the General Data Protection Regulation, according to
which the data subject may object to their data being processed. The
reference in § 2a, paragraph 2 to Article 21 of the General Data Protection
Regulation has been retained, as a citizen objection to the processing of their
personal identification number being in conjunction with connection to and
operation of the postal solution will automatically be considered baseless.
Article 23 of the General Data Protection Regulation allows Member States
to restrict the obligations and rights provided for in Articles 12 to 22 of the
Regulation in so far as such a restriction respects, inter alia, the general public
interests of the Member State and is a necessary and proportionate measure
in a democratic society (see Article 23, paragraph 1e).
Page 35 of 49
Connection to the postal solution has been laid down by law and the
solution has previously been assessed by the Ministry of Finance as being
in the general public interest.
In relation to Article 23, paragraph 2 of the General Data Protection
Regulation, note that the proposal covers the processing of personal
identification numbers for the purpose of enabling ongoing operation and
development as well as connecting citizens to the postal solution (see
Article 23, paragraph 2, subparagraphs a–c and f).
Connection to and operation of the postal solution thus requires the
processing of personal identification numbers, as the solution is linked to
citizens’ personal identification numbers. The personal identification numbers
are used to ensure that authorities can communicate securely to a specific
personal identification number, in order to thereby ensure the identity of the
citizen with whom they are communicating. The reason for this is that the
postal solution is the primary digital infrastructure for secure written digital
communication between the public sector and citizens.
The proposed provision in paragraph 3 stipulates that public authorities are
data controllers for the content and conveyance of their messages in the
postal solution. The provision also stipulates that the Agency for Digitisation
is the data processor for public authorities’ conveyances in the solution.
The Agency for Digitisation thus has no control over when messages are
sent nor the content of the messages.
The proposed provision in paragraph 4 stipulates that the Minister for
Finance may lay down rules on responsibilities, tasks, and supervision in
relation to the Agency for Digitisation’s processing of personal data in the
postal solution on behalf of the data controller public senders. In the
upcoming postal solution, public authorities are required to have a
receiving system. The receiving solution means that the storage of digital
post with an authority takes place when the receiving solution of the
authority concerned has received the post. Thus, the Agency for
Digitisation does not store post to public authorities and the Agency for
Digitisation will therefore not be the data processor for the storage. The
rules are issued via an Order to clarify roles and the division of
responsibilities in the relationship between the Agency for Digitisation
and public senders. The Order will constitute a legally binding instrument
(see Article 28, paragraph 3 of the General Data Protection Regulation).
Page 36 of 49
The proposed provision in paragraph 5 stipulates that enterprises are data
controllers for messages and the personal data contained therein when the
messages are stored in the enterprise’s digital letter box. The Agency for
Digitisation is the data processor of the data controller enterprises’
sending of messages in the postal solution.
By virtue of the proposed provision in paragraph 6, the Minister for Finance
may lay down rules on responsibilities, tasks, and supervision in relation to the
Agency for Digitisation’s processing of personal data in the postal solution on
behalf of the data controller enterprises. The rules can be introduced in the
form of an Order to clarify roles and the division of responsibilities between
the Agency for Digitisation and enterprises in connection with the storage of
messages, and the personal data contained therein, in the enterprise’s digital
letter box. The Order constitutes a legally binding instrument (see Article 28,
paragraph 3 of the General Data Protection Regulation).
On No 4
The proposed change is a result of the name change from the Danish
Ministry of Business and Growth to the Ministry of Industry, Business
and Financial Affairs by the royal decree of 28 November 2016.
On No 5
(§ 4)
The Bill changes “a digital signature” to “an electronic ID”.
The prerequisite for accessing the digital letter box in the postal solution,
including for the purpose of registration, is that citizens and enterprises
can authenticate themselves with an electronic ID that provides secure
authentication. This electronic ID shall be either NemID, an electronic ID
from the Danish national identification scheme, or an electronic ID from
another electronic identification scheme with a well-defined assurance
level determined in accordance with legislation or public standards, e.g.
NSIS, which is connected to the Danish national eID infrastructure.
Use of the Danish national eID solution, MitID, is expected to enter into
force by law in 2021, and thereby going forward it shall be used as
electronic authentication in order to gain access to the postal solution.
However, it will still be possible to use NemID during a transitional
period until the NemID solution is ultimately phased out.
Page 37 of 49
On No 6
(§ 4)
The proposal to amend the transitional provision in paragraph 2 is a
consequence of the required entry into force of § 3 on mandatory
connection to Digital Post having occurred. Thus, there is no longer a
need to regulate up to the entry into force that has already taken place.
On No 7
(§ 4)
The proposal to amend the transitional provisions in paragraphs 3 and 4 is
a consequence of the required entry into force of § 3 on mandatory
connection to Digital Post having occurred. Thus, there is no longer a
need to regulate up to the entry into force that has already taken place.
On No 8
(§ 6)
It follows from § 6, paragraph 1 that natural persons and legal entities
connected to the postal solution may allow others to read messages sent
to or from them in the solution, unless this is precluded by other
legislation. It is proposed that the clause in point 2 of the provision shall
be changed from “Authorisation is granted by specifying, in the postal
solution, who shall have read access” to: “Authorisation is granted by
using rights management to specify who shall have read access”, as the
upcoming postal solution uses joint public infrastructure to administer
rights management, including read access.
On No 9
(§ 10)
It follows from § 10, No 1 of the Digital Post Act that messages sent
using Digital Post are considered to have arrived when they are available
to the addressee in the solution.
The Bill proposes changing “that” to “which” in the provision. This is
solely a linguistic amendment to the text of the Act, the aim of which in
the explanatory notes is to specify detailed guidelines as to which elements
the upcoming postal solution covers and what legal position they entail for
the addressees of digital post.
Page 38 of 49
The amendment opens up the possibility of introducing use of viewing
clients to convey Digital Post. The Agency for Digitisation is establishing
a viewing client on borger.dk and the Danish Business Authority is
establishing a viewing client on Virk. The viewing client constitutes a user
interface for both web browsers and mobile applications made available to
citizens and enterprises, through which they can access digital post from
public senders. It cannot be ruled out that other public authorities may
want to establish their own viewing clients in future. These public viewing
clients convey Digital Post to citizens and enterprises, respectively, and
figure as key players in the postal solution as a whole (see the proposed
§§ 10a and 10b). In addition to public viewing clients, providers in the
form of private actors have the opportunity to be approved to convey
Digital Post through commercial display clients. This can among other
ways be achieved in conjunction with other services that a provider
supplies to the market, e.g. digital post from private senders.
The proposed amendment continues the legislation currently in force. An
addressee’s legal position is the same regardless of whether they access their
digital post from public senders via a public viewing client or a commercial
viewing client. The legal effect for a citizen or enterprise is thus independent
of the type of viewing client used. In the event of problems related to the
postal solution over which the addressee has no control (crash, temporary
loss of capacity, etc.) which mean that a message is not or cannot be made
available to the addressee, a message to a citizen or enterprise cannot be
considered to have arrived until the obstacle has been eliminated.
Likewise, if a message from a citizen or an enterprise to a public authority
cannot be sent or does not reach the recipient as planned due to an obstacle
beyond the control of the sender, the citizen or enterprise does not bear
responsibility for the send failure until the obstacle has been eliminated.
The Bill does not change the legal position in cases where the addressee
finds that their own internet connection, computer, smartphone, or tablet
does not work or that they have lost their log-in code for the digital postal
solution or they have similar obstacles that are up to the addressee to
overcome. In such cases, as under the current regulation, a message is
considered to have arrived when it has reached a location in the solution
from which the addressee can produce it.
As regards mentions of viewing clients, please refer to the Bill’s general
explanatory notes in section 2.4 and the special explanatory notes on No 10.
A technical improvement in the new postal solution means that a citizen or
enterprise will be able to register up to five email addresses to which
notifications of new post will be sent. This is an increase from the hitherto
limit of two email addresses that could be registered for notifications. Citizens
Page 39 of 49
can also receive text message notifications by registering their mobile phone
numbers. However, it is still the responsibility of citizens and enterprises to
keep an eye on whether they have new post in the solution.
On No 10
(§ 10 a)
The proposed § 10a is new.
According to the proposed provision, public authorities can conclude a
connection agreement with the Agency for Digitisation to convey Digital
Post to citizens and enterprises, respectively, in public viewing clients.
These public viewing clients constitute, inter alia, user interfaces to
borger.dk and Virk, which show the digital post from public senders to
citizens and enterprises, respectively. Other public authorities that wish to
establish their own public viewing clients shall conclude a connection
agreement with the Agency for Digitisation to convey Digital Post from
public senders to citizens and/or enterprises.
As stated in the general explanatory notes in section 2.3, both public and
commercial viewing clients shall be seen as part of the postal solution.
For the addressee, the legal effect will be the same regardless of the type
of viewing client chosen, as public and commercial viewing clients are
legally equivalent under this Bill. The receipt time of a message, as under
the current regulation, is thus considered to be the moment at which a
message has reached a location in the postal solution from which the
addressee can produce it in their chosen viewing client (see the special
explanatory notes on No 9). The addressee is thus not obligated to access
their digital post via another viewing client while the public viewing client
used by the addressee happens to be down or offline.
Paragraph 2 of the provision proposes that the Minister for Finance shall
be authorised to lay down detailed rules on the authorisation scheme for
public viewing clients.
The proposed § 10b is new.
(§ 10b)
The upcoming postal solution opens up the possibility for private actors
to convey Digital Post from public senders to citizens and enterprises via
a commercial viewing client.
Page 40 of 49
A commercial viewing client is an IT system run by private actors on
commercial terms. The commercial viewing client shall conclude a
connection agreement with the Agency for Digitisation in which the
detailed requirements are laid down.
The proposed provision also creates a legal basis for the commercial
viewing clients to obtain citizen and enterprise data and rights
configurations in the postal solution in order to convey digital post to
citizens and enterprises. Rights configuration means how citizens and
enterprises may have granted rights to other persons, e.g. read access for
their post in the solution.
User data will only be disclosed within the requirements stated in the
connection agreement. This will also be stated in the terms of use, to
which the end user agrees in order to use a given commercial viewing
client. Providers of commercial viewing clients can thus be approved by
the Agency for Digitisation to convey Digital Post to citizens and
enterprises, e.g. in conjunction with other services.
The approval scheme for providers of commercial viewing clients has also
been notified to the EU Commission in accordance with
Directive 2015/1535/EU of the European Parliament and of the Council
on an information procedure in the field of technical regulations and of
rules on Information Society services (codification).
The proposed provision in paragraph 2 defines “private actors” as legal
entities that are not subject to § 7 nor are they are public viewing clients
(see § 10a).
By virtue of the proposed provision in paragraph 3, citizens and
enterprises may choose to use a commercial viewing client for their digital
post. For the addressee, the legal effect will be the same regardless of the
type of viewing client chosen, as public and commercial viewing clients are
legally equivalent under this Bill. The receipt time of a message, as under
the current regulation, is thus considered to be the moment at which a
message is available to the addressee in the viewing client that the party in
question has chosen to utilise (see the special explanatory notes on No 9).
In the event of a viewing client experiencing downtime, the citizen or
enterprise will thus not be obligated to access their digital post via other
viewing clients, even if doing so may be possible.
Paragraph 4 of the provision proposes that the Minister for Finance shall
be authorised to lay down detailed rules on the authorisation scheme. The
envisaged scheme will mean that all enterprises that can provide a viewing
client which meets the stipulated requirements can obtain authorisation.
Page 41 of 49
On No 11
(§ 10c)
The proposed § 10c is new.
The proposed provision ensures that citizens and enterprises always have
access to their existing digital post from public senders in the event of a
switch in providers.
The proposed provision in § 10c states that the Minister for Finance is
authorised to lay down detailed rules allowing the task of storing citizen
and enterprise digital post to be shifted from one provider to another
provider. Thus, in practice, the provision gives the Minister a legal basis to
lay down general rules, in the form of an Order, on how the relocation of
citizen and enterprise digital post from one postal solution to another
postal solution is to take place, e.g. as a result of an EU tender, where a
new provider is to develop and/or run the solution.
The provision is introduced to ensure that in conjunction with a switch in
providers, both now and in future, there is a legal basis for data migration, i.e.
to relocate the existing digital post of citizens and enterprises. Relocation
includes both content data in the form of messages and attachments, etc., as
well as administration data in the form of e.g. metadata and master data,
which together enable the postal solution to remain fully functional after a
relocation. The relocation itself can take place within a specified period of
time determined by the Minister for Finance.
The provision also clarifies that citizen and enterprise digital post from
public senders, which at the time of sending were not public senders, is
covered by the relocation from one provider to another provider.
The enabling provision means that the relocation of digital post in the
event of a switch in providers affects citizens’ and enterprises’ access to
their digital post as little as possible. Thus, regardless of which provider
has been selected for the postal solution, citizens and enterprises will have
access to existing digital post.
The issuing of rules by virtue of the enabling provision ensures
transparency for citizens and enterprises, as it makes it clearer as to how
the relocation of digital post and its storage takes place in the event of a
switch in providers.
Page 42 of 49
On § 2
(§ 12)
It is proposed in paragraph 1 that the Act enter into force on 1 January
2021, except as provided for in paragraph 2.
Paragraph 2 also proposes that the Minister for Finance sets an entry into
force date for § 1, Nos 1, 2, 3, 8, and 9 of the Bill. The reason is that the
provisions therein are dependent upon the commissioning date of the
upcoming postal solution.
Page 43 of 49
Annex 1
The Bill compared to legislation currently in force
Current wording The draft act
The Act on Digital Post from public
senders (see Consolidation Act No 801
of 13 June 2016 as amended by § 29 of
Act No 503 of 23 May 2018) is amended
as follows:
§ 2. The Minister for Finance is 1. § 2 is to be worded as follows:
authorised to designate one digital Ҥ 2. The Minister for Finance
postal solution, which is called Digital designates one digital postal
Post, and it is covered by the solution, which is called Digital
provisions of the Act. Post, and it is covered by the
provisions of the Act.
Paragraph 2. The Minister for Finance
appoints a system administrator for the Paragraph 2. The Minister for
task of running Digital Post. A public Finance appoints the Agency for
authority or a private enterprise can be Digitisation to ensure the
appointed as system administrator. development, operation,
The system administrator can process maintenance, and administration
personal identification numbers for the of the postal solution.
purpose of being able to connect
citizens in accordance with §§ 3 and 4 Paragraph 3. The Agency for
and to enable ongoing operation of the Digitisation may appoint public
postal solution. authorities or legal entities to
carry out tasks pursuant to
Paragraph 3. The provision in § 35 of paragraph 2 on behalf of the
the Act on the processing of personal Agency for Digitisation.”
data does not apply to the processing
of personal identification numbers 2. After § 2, the following is
pursuant to paragraph 2. inserted as a heading:
“Controllership”.
3. After § 2, the following is
inserted after the heading and
before § 3:
Ҥ 2a. The Agency for
Digitisation is the data controller
for Digital Post (see § 2). The
Agency for Digitisation processes
personal data in the form of
personal identification numbers,
Page 44 of 49
Central Business Register
numbers, email, and telephone
numbers, etc. in connection with
the operation, maintenance, and
administration of the postal
solution, including identification
and notification of natural
persons and legal entities
connected to Digital Post
pursuant to §§ 3 and 4.
Paragraph 2. The provision in
Article 21 of Regulation (EU)
2016/679 of the European
Parliament and of the Council of
27 April 2016 on the protection
of natural persons with regard to
the processing of personal data
and on the free movement of
such data does not apply to the
processing of personal
identification numbers pursuant
to paragraph 1.
Paragraph 3. Public senders are
data controllers of the content of
the messages they send via
Digital Post. The Agency for
Digitisation is the data processor
of public senders’ sending of
messages in the postal solution.
Paragraph 4. The Minister for
Finance may lay down rules on
responsibilities, tasks, and
supervision in relation to the
Agency for Digitisation’s
processing of personal data in the
postal solution on behalf of the
data controllers (see paragraph 3).
Paragraph 5. Enterprises are data
controllers of the content of their
own messages that are sent via
Digital Post and stored therein.
The Agency for Digitisation is
the data processor of the data
Page 45 of 49
controller enterprises’ sending of
messages in the postal solution.
Paragraph 6. The Minister for
Finance may lay down rules on
responsibilities, tasks, and
supervision in relation to the
Agency for Digitisation’s
processing of personal data in
the postal solution on behalf of
the data controllers (see
paragraph 5).”
4. Throughout the Act “Danish
Minister for Business and
Growth” is changed to: “the
Minister for Industry, Business
and Financial Affairs”.
5. In § 4, paragraph 1, point 1 and § 4,
paragraph 2, point 1, “a digital
signature” is changed to: “an
electronic ID”.
§ 4. Natural persons and legal entities
that are exempted from mandatory
connection to the digital post solution
(see § 5) may voluntarily connect the
postal solution with the legal effects
that follow from § 10, if they are in
possession of a digital signature that
provides access to the postal solution.
§ 5 and rules issued in pursuance
thereto shall apply mutatis mutandis in
the assessment of whether the party in
question can be exempted from
connection.
Paragraph 2. Natural persons who are
15 years of age or older and whom do
not have a fixed domicile or residence
in Denmark may voluntarily connect
to the postal solution with the legal
effects that follow from § 10, if they
have been assigned a personal
identification number and are in
possession of a digital signature that
provides access to the postal solution.
Page 46 of 49
Until § 3, paragraph 1 enters into
force, the party in question may
choose to cancel their connection to
the postal solution. Once § 3,
paragraph 1 has entered into force, the
connection is binding, unless the party
in question is exempted from
connection. § 5 and rules issued in
pursuance thereto shall apply mutatis
mutandis in the assessment of whether
the party in question can be exempted
from connection.
Paragraphs 3-4. ---
§ 4. --- 6. In § 4, paragraph 2, points 2 and 3,
“Until § 3, paragraph 1 enters
Paragraph 2. Natural persons who are into force, the party in question
15 years of age or older and whom do may choose to cancel their
not have a fixed domicile or residence connection to the postal solution.
in Denmark may voluntarily connect Once § 3, paragraph 1 has
to the postal solution with the legal entered into force, the
effects that follow from § 10, if they connection is binding, unless the
have been assigned a personal party in question is exempted
identification number and are in from connection.” is changed to:
possession of a digital signature that “The connection is binding,
provides access to the postal solution. unless the party in question is
Until § 3, paragraph 1 enters into exempted from it.”
force, the party in question may
choose to cancel their connection to Point 4 shall subsequently
the postal solution. Once § 3, become point 3.
paragraph 1 has entered into force, the
connection is binding, unless the party
in question is exempted from
connection. § 5 and rules issued in
pursuance thereto shall apply mutatis
mutandis in the assessment of whether
the party in question can be exempted
from connection.
Paragraphs 3-4. ---
Page 47 of 49
§ 4. --- 7. § 4, paragraphs 3 and 4 are
repealed.
Paragraph 2. ---
Paragraph 3. Until connection to Digital
Post (§ 3, paragraph 1) becomes
mandatory, a natural person who is
covered by said provision may
voluntarily connect the postal solution
with the legal effects that follow from
§ 10, if they are in possession of a
digital signature that provides access to
the postal solution. The party in
question may cancel their voluntary
connection to the postal solution until
§ 3, paragraph 1 enters into force.
Once § 3, paragraph 1 enters into
force, the party in question becomes
subject to mandatory connection,
unless the party in question is
exempted from connection. § 5 and
rules issued in pursuance thereto shall
apply mutatis mutandis in the
assessment of whether the party in
question can be exempted from
connection.
Paragraph 4. Until connection to Digital
Post (§ 3, paragraph 2) becomes
mandatory, a legal entity that is
covered by said provision may
voluntarily connect the postal solution
with the legal effects that follow from
§ 10, if it is in possession of a digital
signature that provides access to the
postal solution. The party in question
may cancel their voluntary connection
to the postal solution until § 3,
paragraph 2 enters into force. Once
§ 3, paragraph 2 enters into force, the
party in question becomes subject to
mandatory connection, unless the
party in question is exempted from
connection. § 5 and rules issued in
pursuance thereto shall apply mutatis
mutandis in the assessment of whether
Page 48 of 49
the party in question can be exempted
from connection.
§ 6. Natural persons and legal entities
connected to Digital Post may allow 8. In § 6, paragraph 1, point 2,
others to read messages sent to or “Authorisation is granted by
from them in the postal solution, specifying, in the postal solution,
unless this is precluded by other who shall have read access” is
legislation. Authorisation is granted in changed to: “Authorisation is
the postal solution to specify who shall granted by using rights
have read access. management to specify who shall
have read access”.
Paragraph 2. ---
§ 10. Messages sent using Digital Post
are considered to have [...] 9. In § 10, “which” is changed to:
“that”.
10. The following is inserted after
§ 10:
Ҥ 10a. The Agency for
Digitisation may authorise and,
under specific conditions,
conclude agreements with public
authorities to use the postal
solution per § 2, paragraph 1 to
convey Digital Post from public
senders in a public viewing client
to natural persons and/or legal
entities.
Paragraph 2. The Minister for
Finance may lay down detailed
rules on the authorisation scheme
for public authorities as providers
of public viewing clients (see
paragraph 1).
§ 10b. The Agency for
Digitisation may authorise and,
under specific conditions,
conclude agreements with private
actors to use the postal solution
per § 2, paragraph 1 to convey
Digital Post from public senders
in a commercial viewing client to
natural persons and/or legal
entities.
Page 49 of 49
Paragraph 2. For the purposes of
this Act, “private actors” are legal
entities that are not subject to § 7
nor are they public viewing
clients (see § 10a).
Paragraph 3. Natural persons and
legal entities may choose to use
commercial viewing clients to
access their messages in the
postal solution.
Paragraph 4. The Minister for
Finance may lay down detailed
rules on the authorisation scheme
for private actors as providers of
commercial viewing clients (see
paragraph 1).”
11. After § 10b the following is
inserted after the heading and
before § 11:
Ҥ 10c. The Minister for Finance
may lay down rules on the
relocation of natural persons’ and
legal entities’ messages in the
postal solution, including content
data and administrative data from
one provider to another, which
then stores the digital post. The
rules may, as further specified,
also cover messages sent by a
public sender during a period in
which the sender did not have
the status of public sender, but
which previously was or later
became a public sender.”
§2
The Act shall enter into force on
1 January 2021 (except as
provided for in paragraph 2).
Paragraph 2. The Minister for
Finance sets the entry into force
date for § 1, Nos 1, 2, 3, 8, and 9.
Maret Ots
Saatja: Karl Stern <
[email protected]>
Saatmisaeg: teisipäev, 6. oktoober 2020 16:27
Adressaat: Marie Allikmaa; Mart Laas; Maret Ots
Teema: teatis
Manused: 2020458DK.docx
Tere
Saadan Taani teatise 458 „Eelnõu, millega muudetakse seadust avalike saatjate tehtavate digitaalpostituste kohta
(digitaalpostituste kontrolli, strateegilise omandiõiguse ja otsustusõiguse üleandmine digitaliseerimisametile,
kuvamisklientide turu loomine ning kodanike ja ettevõtte postituste ümberpaigutamine)“. Ooteaeg lõpeb juba
19.10.
Karl
Tutvustus. Eelnõu ning sellega seotud määrused ja liitumislepingud tulenevad avaliku digitaalse postisüsteemi, mille
nimi on Digital Post, uuest seadistusest seoses süsteemi üleminekuga Digital Post 2-lt Next Generation Digital
Postile.
Eelnõu eesmärk on eelseisvas lahenduses kanda süsteemi vastutus postilahenduse eest tagasi
digitaliseerimisametile. Kavandatud õigusliku alusega saab digitaliseerimisametist postilahenduse haldamise eest
vastutav töötleja. Vt eelnõu paragrahvid 2 ja 2a.
Kui ettevõtted ja riigiasutused kasutavad postilahendust, on nad ise andmekaitse üldmääruse tähenduses
vastutavad töötlejad. See tagab õigusliku järjepidevuse. Digitaliseerimisamet on ettevõtetete ja riigiasutuste
andmete töötleja, kui nad saadavad ja potentsiaalselt säilitavad isikuandmeid postilahenduses. Digitaliseerimisameti
andmekontrollerite nimel toimuvat andmetöötlust reguleeritakse kahes eelseisvas määruses, mis antakse välja
seaduseelnõu õiguslikul alusel. Vt eelnõu paragrahvi 2a lõikeid 3–6.
Digital Post 2-lt Next Generation Digital Postile ülemineku osana viiakse olemasolevad digitaalpostitused vanast
süsteemist üle uude süsteemi. Selleks et luua vajalik õiguslik alus kodanike ja ettevõtete digitaalpostituste üle
viimiseks ühelt postilahenduse pakkujalt teisele, tuleb rahandusministrit volitada selles küsimuses välja andma
eeskirju. Selline volitus antakse eelseisvas korralduses. Vt eelnõu paragrahv 10c.
Uus seadistus hõlmab ka muudatusi regulatsioonis, mis reguleerib kodanike ja ettevõtete juurdepääsu avalike
saatjate tehtavatele digitaalpostitustele. Seega võimaldab see luua turu kommertslikele kuvamisklientidele, st
erasektori tegutsejatele, kes on taotlenud ja saanud loa luua ja hallata kasutajaliideseid avalike saatjate tehtavate
digitaalpostituste kuvamiseks.
Kommertslikud kuvamiskliendid peavad digitaliseerimisametiga sõlmima liitumislepingu, milles on sätestatud
nõuded tehnilistele, turva- ja kommertsaspektidele. Liitumisleping võib sisaldada võimalust maksta kommertslikele
kuvamisklientidele neil olla võivate avaliku teenindamise kohustuste eest hüvitist. Vt eelnõu paragrahvid 10a ja 10b.
Põhjendus. Üldjuhul ei kuulu avalike saatjate tehtud digitaalpostituste kuvamiseks mõeldud kasutajaliidesed Next
Generation Digital Posti süsteemi alla. Seetõttu töötavad need välja riigiasutused ja erasektorid, kes teevad need
kodanikele ja ettevõtetele kättesaadavaks. Liitumislepingu - mis vastavalt kavandatud paragrahvidele 10a ja 10b
sõlmitakse digitaliseerimisametiga - eesmärk on tagada, et avalikud ja kommertslikud kuvamiskliendid saaksid
vastavalt täita turvalisuse, juurdepääsetavuse ja terviklikkuse nõudeid.
Turvanõuded on sätestatud võttes nõuetekohaselt arvesse asjaolu, et Next Generation Digital Posti süsteem töötleb
kõigi vähemalt 15-aastaste Taani kodanike isikuandmeid, sealhulgas tundlikke isikuandmeid, samuti teavet kõigi
äriregistri numbritega juriidiliste isikute kohta, sealhulgas võimalikke ärisaladusi. Enne Next Generation Digital Posti
süsteemiga liitumist peavad kommertslikud kuvamiskliendid tõendama vastavust tehnilistele ja turvanõuetele.
Juurdepääsetavuse ja terviklikkuse nõuded on seatud, võttes nõuetekohaselt arvesse asjaolu, et Next Generation
Digital Posti süsteem on sotsiaalse tähtsusega digitaalne taristu ja riigiasutuste peamine suhtlusvahend Taani
kodanike ja ettevõtetega.
1