CBAM - Send guarantee

If you have any questions regarding our processing of your data, please feel free to contact our data protection officer.

You can contact our Data Protection Officer in the following ways:

By e-mail: dpo@em.dk

By telephone: + 45 33 92 33 50

By letter: Ministry of Business, Industry and Financial Affairs, Att.: Data Protection Officer, Slotsholmsgade 10-12, 1216 Copenhagen K, Denmark

We process your personal data for the following purposes:

The Act on Supplementary Provisions to the Regulation on the Introduction of a Carbon Border Adjustment Mechanism (CBAM) designates the Minister for Climate, Energy and Utilities as the competent authority. The CBAM Executive Order assigns the Minister for Industry, Business and Financial Affairs responsibility for part of the functions and tasks of the competent authority, including authorisation and transactions related to the sale, surrender, and repurchase of CBAM certificates. As part of the role as competent authority, your personal data are processed for the following purposes:

Approval of CBAM declarants, including:

• processing of applications submitted through the CBAM Registry,

• processing of additional information submitted, such as criminal record certificates,

• where applicable, processing of security or guarantees,

• risk analysis, and

• ongoing monitoring of compliance with the conditions for approval.

Consultation of other Member States and the European Commission in connection with the expected approval of CBAM declarants.

The basis in law for our processing of your personal data ensues from:

Article 6(1)(e) of the General Data Protection Regulation (GDPR), in conjunction with the CBAM Executive Order, Executive Order on Supplementary Provisions to the Regulation on the Introduction of a Carbon Border Adjustment Mechanism (CBAM), Executive Order No. 1500 of 10 December 2024, section 4.Categories of personal data

We process the following categories of personal data about you:

• Ordinary personal data, including financial information as well as name and address.

• Confidential personal data, including civil registration number (CPR number) and information on criminal offences.

We disclose your personal data or make it available to the following recipients:

• The Danish Energy Agency.

• The Danish Customs Agency.

• The Danish National Archives.

• Relevant appeals bodies, including the Danish Business Appeals Board and the Energy Board of Appeal.

• The European Commission.

• Competent authorities for CBAM in other EU and EEA countries.

We collect, record and process personal data from, among others:

• the CBAM Register

• the Danish Energy Agency

• the Danish Customs Agency

• the Danish Debt Collection Agency

• the Danish Tax Agency

• the Danish National Police

• the Civil Registration System (CPR)

• the Central Business Register (CVR)

• competent authorities for CBAM in other EU and EEA countries

We storage your personal data for up to 7 years.

We employ automatic assessments, in our case processing, pursuant to section 10(2) of the Act on Supplementary Provisions to the Regulation introducing a Carbon Border Adjustment Mechanism (CBAM). Our case management system uses a risk model and recommends applications for approval or for manual processing. The risk model may use data from the application and/or data from the entities listed in section 6. The parameters for profiling/risk assessment will be adjusted as needed. Machine learning may be used in the processing.

Adverse decisions will always be handled manually. This includes refusals of authorisation as well as revocations of authorisation.

We may, among other things, use the following data for profiling:

• The applicant’s information on expected imports, including product category, quantity and value.

• The applicant’s accounting data, including turnover/revenue and profit.

• Information on beneficial owners.

• Information from other supervisory/control areas within and outside the Danish Business Authority.

If personal information about you has been submitted, you have the right to withdraw your consent at any time. This can be done by contacting us.

If you choose to withdraw your consent, it does not affect the lawfulness of our processing of your personal data based on your previously given consent and up to the time of the withdrawal. Therefore, if you withdraw your consent, it will only take effect from this time.

Pursuant to the General Data Protection Regulation, you have several rights in relation to our processing of data concerning you. If you wish to exercise your rights, you must contact us.

Right of access

• You have the right to obtain access to the data we process concerning you, together with a number of other data.

Right to rectification (correction)

• You have the right to have incorrect data concerning you rectified.

Right to erasure

• In special cases, you have the right to have data concerning you erased before the time of our ordinary general erasure.

Right to restriction of processing

• In certain cases, you have the right to restrict the extent to which we process your personal data. If you have the right to restrict processing, we will henceforth only process information with your consent – with the exception of storage – or if a legal claim can be established, exercised or defended, or to protect a person or important public interests.

Right to object

• In certain cases, you have the right to object to our processing of your personal data.

Right to transmit data (data portability)

• In certain cases, you are entitled to receive your personal data in a structured, commonly used and machine-readable format, and to have this personal data transmitted from one data controller to another without hindrance.

You can read more about your rights in the Danish Data Protection Agency's guidance on rights of data subjects, available at www.datatilsynet.dk.

You have the right to complain to the Danish Data Protection Agency if you are not satisfied with the way in which we process your personal data. The contact details of the Danish Data Protection Agency are available at www.datatilsynet.dk.