OECD Peer Review of E-Government in Denmark - ePractice.eu

modernisation process, especially in a quickly changing environment. However, while eDay and
eDay2 created internal capacity and removed obstacles impeding digital communication, they did not
remove existing barriers linked to the application of ICT to specific government processes (e.g.
taxation).
Key point 3.1
Denmark has undertaken significant work to ensure that the legislative and regulatory environment does not
present unnecessary barriers to the development of e-government. While many laws and regulations either still
remain to be updated or have been deemed impossible to change, the major elements of an “e-enabled” legal
environment are now in place.
Despite this, Danish officials still report that they face e-government barriers in this area, citing problems related
to complexity of regulations, legal impediments to collaboration and lack of legal recognition of e-government
processes. Some of these problems arise from the fact that further work on removing legal impediments to
e-government is required. However, it appears that other aspects of this problem relate to officials having
inadequate awareness and understanding of the changes that have already occurred, lack of capacity to interpret
revised laws and regulations in innovative ways, and failure of organisations to accept responsibility for changing
their services and business processes in line with what is allowed by the altered legal environment.
Data protection
Danish legislation recognises two broad areas where laws and regulations are required to achieve
security and privacy of public information: 1) technical security of information systems and data
communications; and 2) protection of personal data. A third area – identification of providers and
users of information (i.e. authentication) – is an area of ongoing legal challenge. Even digital
signatures do not guarantee identity, as it is possible for persons other then the signature holder to use
them. This is a pressing issue, which is not yet solved and will figure in ongoing work on digital
signatures.
Data and system security is, to a large extent, a technical and organisational challenge; it requires
information and communication systems that are technically secure from external attack and protected
from internal misuse by appropriate laws, policies, management practices, business processes,
organisational culture, staff skills and training. There is no specific law on IT security in Denmark.
However, security provisions are contained in a number of laws (i.e. laws on telecommunications and
data protection). State government responsibilities in this area are concentrated in the hands of few key
actors, especially the Danish IT and Telecom Agency (ITST) and the Council for IT Security (see Box
3.1).
Box 3.1 Main actors and responsibilities in the area of IT security
The Council for IT Security, established in 1995 as a successor to the National IT Security Council, is composed
of seven members appointed by the Minister of Science, Technology and Innovation. The Council acts as an
advisory board, focusing on: 1) promoting an informed public debate on IT security; 2) increasing awareness of
security risks; and 3) encouraging co-operation and knowledge sharing in connection with the development and
implementation of security policies and procedures.
The IT Security Division within the National IT and Telecom Agency has a key role in providing national
guidelines and instigating measures focused on strengthening IT security awareness and prevention, such as: 1)
defining integrated IT and telecommunications security emergency planning; 2) launching information campaigns
for both citizens and businesses; and 3) increasing research and training on IT security matters. It also has
responsibility for specifying rules and standards for IT security in the government sector, and for implementation
of electronic signatures. The IT Security Division acts as the secretariat for the Council for IT Security.
46