Processing of your personal data

The purpose of processing personal data in My Purchases

The purpose of the collection and subsequent processing of personal data is to create more knowledge about the importance of shopping habits for health and disease. Researchers at the Statens Serum Institut (SSI) and possibly other institutions will use the information collected to investigate the connections between our health and the things we eat, drink, use as moisturizers, inhale and otherwise are exposed to throughout our lives. We can only investigate such correlations or patterns by linking information on shopping habits with information on health and diseases from the Danish registries or from other research projects.

The solid knowledge we have about the importance of lifestyle for our health is largely based on questionnaire data regarding diet, exercise, smoking, alcohol, etc. In My Purchases, we believe that we can learn even more by using information about purchase instead of information from questionnaires.

Purchase data can be collected automatically over time, without taking up your time, and contains information that is in many ways more accurate than questionnaire data. Questionnaires typically take a long time to complete and it is easy to forget small, but perhaps significant details. In addition, it can be difficult to remember exactly which products you have previously purchased. Statens Serum Institut is the data controller for the personal data processed in the My Purchases research project. It is thus the Statens Serum Institut that must ensure that rules on the processing of personal data are complied with and that the processing of personal data takes place under the observance of appropriate security.

Categories of data subjects and of personal data processed

The information comes from people who choose to participate in the research project, and includes general personal data such as name, e-mail and telephone number as well as sensitive personal data such as health information from the Danish registries, other research projects and My Purchases' registration form. In addition, information on social security number is processed to be able to uniquely identify the individuals participating in the project and to be able to link data from different Danish registries. The information processed about registered individuals thus originates either from Danish registries or is submitted directly by the registered person when he/she signs up for the project. Personal information from the mentioned registries is pseudonymised before researchers have access to the information. This means that researchers who process the information will not be able to identify the participating individuals from the project information alone.

Your information will be used exclusively for research

Your information will be stored on a secure server at Statens Serum Institut and will only be used to carry out scientific and statistical studies of significant importance for society.

The information can, for example, be used for research into the connection between purchase and the risk of contracting or experiencing an increase in the severity of diseases such as salmonella, sclerosis or diabetes.

A project with exclusively commercial purposes, which for example focusses on how to sell more protein powders, will thus not be covered by My Purchases' purpose and will therefore not be granted access to data from My Purchases. A project that looks at diet and lifestyle and how they affect older people's ability to regain muscle strength will on the other hand be able have access to data from My Purchases, as such a research purpose falls under My Purchases' overall purpose.

Participation is voluntary

Participation in My Purchases is voluntary and you can always unsubscribe if you no longer wish to participate.

Withdrawal

If you choose to unsubscribe from My Purchases, this means that you withdraw the consent you gave to Storebox to pass on your purchase information to Statens Serum Institut. Furthermore, Statens Serum Institut will no longer collect new information about you from the registries or pass on the information we have collected about you to other researchers.

Information that is already included in the research project will not be deleted, because SSI as a government authority may be obliged to hand over the information to the National Archives (Rigsarkivet). When the information is handed over to the National Archives, the information is covered by the rules of the Archives Act.
Information that has already been disclosed to research projects will continue to be included in such projects, as SSI had your permission to process your data at that time.

Authorization for processing personal data

Disclosure of purchase information from Storebox ApS to Statens Serum Institut is based on your consent. The authority for processing your information is thus the Danish data protection regulation article 9, subsection 2, letter a in relation to sensitive personal data and article 6, paragraph 1, letter a in relation to general personal data. When you register for My Purchases your consent covers the disclosure of data from Storebox to Statens Serum Institut.

Statens Serum Institut's processing of personal data about you from Danish registries or other research projects takes place on the basis of the Data Protection Regulation, Article 6, paragraph 1, letter 1 as the processing is necessary for the performance of a task in the interest of society.

The processing of sensitive personal data takes place pursuant to Article 9, subsection of the Data Protection Regulation, article 2, letter j, together with article 10, paragraph 1, as it is necessary to process the information for scientific research purposes. All information included in the research project is used exclusively for scientific and statistical purposes and cannot be used later for other purposes, cf. article 10, paragraph 2 of the Danish Data Protection Act.

The Statens Serum Institut processes your CPR number pursuant to article 11, paragraph 1 of the Data Protection Act.

The above means that you do not have to give consent when personal data about you from Danish registries or other research projects is processed.

However, My Purchases has chosen to give you the opportunity to indicate whether you wish to participate in one or more specific sub-projects only, or whether you wish to participate in all projects under My Purchases. My Purchases will also limit the use of information about you if you no longer wish to participate in My Purchases (read more under "Unsubscribe" above).

It is expected that results from the research project will be published as scientific articles. In the published articles it will never be possible to recognize individuals.

Your rights as a registered participant

When personal data is processed exclusively for scientific and statistical purposes, a number of significant exceptions to the data subject's rights apply. This means that you, among other things, basically do not have the right to gain insight into, to rectify of, to restrict, to object to or erase personal data about you that is part of the research project. The limitation in your rights is described in article 22, paragraph 5 of the Data Protection Act and the General Data Protection Regulation, article 17, paragraph 3, letter d.

The Statens Serum Institut has, however, out of consideration for openness and transparency, decided that you can request insight into your own personal data in My Purchases, request that incorrect personal data is rectified and request a restriction of the data processing.

If you wish to change your information or permissions after registration, this can be done by filling in the registration form again. The information previously provided will continue to be stored, but it will be marked to show that the information has been replaced by updated information.

If you have questions about your rights, please contact us via the Danish digital mail system. You can read more about the contact procedure here: 'Secure communication with Statens Serum Institut'.

Collection of personal data

Purchasing data is collected from the private company Storebox ApS for use in the research project. In order to participate, you must therefore register with Storebox.

If you have registered for Storebox, we ask you to provide us with the e-mail and telephone number that you used when registering for Storebox.

If you are not already registered with Storebox, you can read more about their personal data policy on their website.
You can register for Storebox via this link: https://en.storebox.com/#/privacy.

Storebox is the data controller for the processing of personal data at www.storebox.dk. In order to participate in My Purchases, it is important that, in connection with the registration, you give your consent that Storebox may pass on (disclose) your personal data to Statens Serum Institut for use in the research project. Storebox is the data controller for this disclosure.

Storage period

Your personal data is stored by Statens Serum Institut for as long as is necessary to fulfil the purpose of the processing. Storage will therefore initially take place until 2049 in order to give researchers the opportunity to investigate diseases that occur late in life. In the period up to 2049, Statens Serum Institut will continuously assess the project's legal and technical conditions, in connection with the annual review of active research projects, which is handled by the Department for Data Protection and Information Security at Statens Serum Institut.

If you have chosen to participate exclusively in specific sub-projects, Statens Serum Institut will, when such sub-projects have been completed, invite y consent to participate in other sub-projects, should you be interested.

The Statens Serum Institut will report and possibly hand over data from My Purchases to the National Archives in accordance with the rules of the Archives Act.

Disclosure of personal data

Statens Serum Institut can pass on information about you from My Purchases to other Danish and European research institutions, as long as the data disclosed will be used for the purposes of scientific and statistical studies of significant societal importance. Such disclosure will in certain cases require permission from the Danish Data Protection Authority.

Disclosure will only take place via secure connections, e.g. to the Research Service at Statistics Denmark, the Forskermaskinen at the Health Data Agency, Computerome at the Technical University of Denmark or equivalent supercomputers within the EU/EEA or via other transfer methods that are recognised as safe. If you have indicated that you only wish to participate in one or several specific sub-projects in connection with your registration, we will only pass on your information to the projects in question.

Complaint to the Danish Data Protection Authority

As a participant in the research project, you have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with the processing of your personal data. You can read more about your rights at www.datatilsynet.dk, where you can find the Datatilsynet's contact information.

If you have questions about My Purchases' processing of personal data, you can contact:

Statens Serum Institut's legal department

If you have questions about how Statens Serum Institut processes personal data about you, you are always welcome to contact Statens Serum Institut's legal department.
E-mail : compliance@ssi.dk
Telephone number : 4046 0083
Address: Artillerivej 5, 2300 Copenhagen S

Data Protection Officer (DPO)

You are also welcome to contact the Ministry of Health and the Elderly's joint data protection advisor (DPO), Helle Ginnerup Nielsen. Among other tasks, the DPO has the task of advising the ministry and the agencies on data protection.
E-mail: dataprotection@sum.dk
Address: Holbergsgade 6, 1057 Copenhagen K, att. "Data Protection Advisor"