[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffIqdYEXncjLFl0BA-Tiew2KjUD217GBkjKVJMPGXJqw":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"0149667f-c078-4c82-92bc-12a7c9f5c19f","Datatilsynet (Denmark) - 09-07-2026","datatilsynet-denmark-09-07-2026-cb5d30","Sfl moved page Datatilsynet (Denmark) - 09-07-2026 to Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub) without leaving a redirect Two almost identical decisions which need to be separated New page {{DPAdecisionBOX |Jurisdiction=Denmark |DPA-BG-Color= |DPAlogo=LogoDK.png |DPA_Abbrevation=Datatilsynet |DPA_With_Country=Datatilsynet (Denmark) |Case_Number_Name=09-07-2026 |ECLI= |Original_Source_Name_1=Datatilsynet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.dk\u002Fafgoerelser\u002Ftilladelser\u002F2026\u002Fjul\u002Fac-horsens-faar-tilladelse-til-brug-af-automatisk-ansigtsgenkendelse |Original_Source_Language_1=Danish |Original_Source_Language__Code_1=DA |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Other |Outcome= |Date_Started= |Date_Decided= |Date_Published= |Year= |Fine= |Currency= |GDPR_Article_1=Article 9(1) GDPR |GDPR_Article_Link_1=Article 9 GDPR#1 |GDPR_Article_2=Article 9(2)(g) GDPR |GDPR_Article_Link_2=Article 9 GDPR#2g |GDPR_Article_3=Article 35 GDPR |GDPR_Article_Link_3=Article 35 GDPR |GDPR_Article_4=Article 36 GDPR |GDPR_Article_Link_4=Article 36 GDPR |GDPR_Article_5= |GDPR_Article_Link_5= |GDPR_Article_6= |GDPR_Article_Link_6= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=AC Horsens |Party_Link_1=https:\u002F\u002Fachorsens.dk\u002F |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=sf | }} The DPA gave the AC Horsens football club the permission to process biometric data through the use of automatic facial recognition in the conduct of football matches. == English Summary == === Facts === AC Horsens (the controller), pursuant to section 7(4) of the Danish Data Protection Act, sent an application to the DPA, asking for permission to process biometric data, and thus use automatic facial recognition during football matches. Processing such data would be done on the basis of [[Article 9 GDPR|Article 9(1) GDPR]] and Article 9(2)(g), that is, necessary for reasons of public interest. === Holding === The DPA granted the controller authorisation to process biometric data with the use of automatic facial recognition for the purpose of uniquely identifying natural persons. The DPA granted the authorisation under a number of conditions, requires notification of any changes, and reserves the right to review them. The conditions include, inter alia: * Authorisation only applies when the controller is in the Danish Super League. * Suspensions from matches must be imposed on an objective and proportionate manner following a violation of the controller’s stadium regulations and\u002For the Super League's code of conduct. * Personal data which does not concern an individual on the controller’s suspension list, persons of interest list or police’s suspension list may not be stored. * Personal data which concern one of those persons must be deleted after every match. The DPA emphasised that the GDPR and the Data Protection Act apply to the extent that the issue at hand is not regulated by the above conditions. The DPA stressed that a data protection impact assessment must be performed in accordance with [[Article 35 GDPR]]. If it results in a high risk the controller must seek prior consultation under [[Article 36 GDPR]]. The DPA also maintained its position in handling complaints. The DPA further clarified that the use of images from the surveillance to be covered by the national CCTV Surveillance Act. The DPA declared the controller’s communication and enforcement of the suspension list as, necessary for the purpose of processing a specific dispute following the Danish CCTV Surveillance Act. The DPA thus permits the controller to store the stadium’s security camera footage for longer than 30 days. The DPA emphasises that retention of this footage for longer than 30 days imposes a subsequent obligation on the controller to inform the data subject visible in the footage and allow them to request a copy of such. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details. Skip the main navigation Lyngby Boldklub Granted Permission to Use Automated Facial Recognition Date: July 9, 2026 Authorization: Private Companies Following an application from Lyngby Boldklub and AC Horsens, the Danish Data Protection Agency has granted authorization for the clubs to process biometric data and thereby use automatic facial recognition during soccer matches. The above processing involves the processing of biometric data covered by the prohibition in Article 9(1) of the General Data Protection Regulation. Pursuant to Article 9(2)(g) of the Regulation, the prohibition on the processing of sensitive information does not apply if the processing is necessary for reasons of substantial public interest. Pursuant to Section 7(4) of the Data Protection Act, the Danish Data Protection Agency must grant authorization for such processing when it is not carried out by a public authority. The Danish Data Protection Agency hereby grants LYNGBY BOLDKLUB A\u002FS Authorization to process biometric data pursuant to Section 7(4) of the Data Protection Act through the use of automated facial recognition at the LYNGBY BOLDKLUB A\u002FS stadium Authorization to process biometric data for the purpose of uniquely identifying a natural person, through the use of automated facial recognition, is granted under the following conditions: This authorization applies only when LYNGBY BOLDKLUB A\u002FS is the sole data controller for the processing of personal data with respect to the CCTV surveillance and the facial recognition system. This authorization applies only when LYNGBY BOLDKLUB A\u002FS is a member of the Superliga. In this context, the authorization applies to the conduct of soccer matches, including friendly matches, involving teams from the Superliga, the 1st and 2nd divisions, as well as soccer matches organized by UEFA. The imposition of a ban must be based on objective and proportionate grounds in relation to the violation committed of LYNGBY BOLDKLUB A\u002FS’s stadium regulations and\u002For the Superliga’s rules of conduct. Personal data processed as part of the facial recognition system that does not result in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s ban list and\u002For watchlist or 2) the police’s general ban list, may not be stored. Personal data processed as part of the facial recognition system that results in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s quarantine list and\u002For watchlist or 2) the police’s general quarantine list must be deleted immediately after each match. LYNGBY BOLDKLUB A\u002FS must comply with the duty to provide information when collecting personal data. LYNGBY BOLDKLUB A\u002FS must also, through signage or other clear means, provide information that access control is being conducted, including the processing of biometric data using an automated facial recognition system. Personal data processed as part of the facial recognition system must be transmitted to and stored in encrypted form on the server using up-to-date and widely recognized encryption algorithms. Surveillance cameras must be installed on a separate VLAN and must not be exposed to the internet. LYNGBY BOLDKLUB A\u002FS must implement access control using the facial recognition system, including ensuring that employees are authorized to operate the facial recognition software and logging manual lookups during the login process. Use of multi-factor authentication in the login process. 10. Any changes to the conditions covered by this authorization must be reported to the Danish Data Protection Agency. The above terms apply until further notice. The Danish Data Protection Agency reserves the right to review these terms should the need arise. The above terms are supplementary and clarifying in relation to the provisions of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act. It should be emphasized that the General Data Protection Regulation and the Data Protection Act thus apply to the extent that matters are involved that are not regulated by the terms and conditions above. The processing must therefore also be carried out in accordance with the rules regarding, among other things, the preparation of a data protection impact assessment, see Article 35 of the General Data Protection Regulation, including in particular Article 35(7) regarding the requirements for the content of a data protection impact assessment. The data protection impact assessment must be completed before processing begins. If the risk associated with the processing cannot be reduced to a level lower than “high,” LYNGBY BOLDKLUB A\u002FS must comply with the requirement for prior consultation set forth in Article 36 of the General Data Protection Regulation. The Danish Data Protection Agency further reserves the right to take a position in the event of a potential complaint. In addition, for the sake of good order, the Danish Data Protection Agency must draw LYNGBY BOLDKLUB A\u002FS’ that the use of images from surveillance cameras may be subject to Section 4c(4) and (5) of the Video Surveillance Act. This would be the case if the surveillance cameras at the stadium are installed for crime prevention purposes and if LYNGBY BOLDKLUB A\u002FS —rather than a template—uses, including in the facial recognition system, an actual image derived from the surveillance cameras at the stadium. It follows from Section 4c(4) of the CCTV Surveillance Act that recordings as mentioned in paragraph (1), i.e., video and audio recordings containing personal data that are made in connection with television surveillance for the purpose of crime prevention, must be deleted no later than 30 days after the recordings are made; see, however, subsection (5). The term “video and audio recordings” refers to both still images and moving images. In the opinion of the Danish Data Protection Agency, this means that images from the surveillance cameras at the stadium that are intended to be recorded in the automatic facial recognition system must, as a general rule, be deleted no later than 30 days after the recordings are made. This also applies to images that have been “transferred” to the facial recognition system. However, pursuant to Section 4c(5) of the Video Surveillance Act, recordings may be retained for a longer period than specified in paragraph (4) if necessary for the data controller’s handling of a specific dispute. If retention is necessary for the purpose of resolving a specific dispute, the data controller must, within the time limit specified in paragraph (4), notify the person involved in the dispute and, upon request, provide that person with a copy of the recording. In the opinion of the Danish Data Protection Agency, it is reasonable to consider LYNGBY BOLDKLUB A\u002FS’s notification and enforcement of a suspension as the handling of a specific dispute. Images—derived from the surveillance cameras at the stadium—may thus be stored for longer than 30 days. It is therefore the Danish Data Protection Agency’s assessment that Section 4c(4) of the Video Surveillance Act will not prevent LYNGBY BOLDKLUB A\u002FS from using images from surveillance cameras at the stadium as the basis for registering, in the automatic facial recognition system, individuals who violate the stadium regulations and\u002For the rules of conduct. The notification requirement in Section 4c(5), second sentence, of the CCTV Surveillance Act does not appear to contain any exceptions. Individuals appearing in an image captured by the stadium’s surveillance cameras that is retained for longer than 30 days must therefore be notified of this and may request a copy of the image. The Danish Data Protection Agency Carl Jacobsens Vej 35 2500 Valby Tel. 33 19 32 00 dt@datatilsynet.dk About Us About the Danish Data Protection AgencyPressWebsitePrivacy PolicyAccessibility Statement Quick Links Guide to the GDPRFile a Complaint with the Danish Data Protection AgencyCall UsNewsletterThe National Whistleblower Scheme Follow Us The Danish Data Protection Agency on LinkedIn SearchSearch Clear Load More Lyngby Boldklub Granted Permission to Use Automated Facial Recognition Date: July 9, 2026 Authorization for Private Companies Following an application from Lyngby Boldklub and AC Horsens, the Danish Data Protection Agency has granted authorization for the clubs to process biometric data and thus use automated facial recognition during soccer matches. The above processing involves the processing of biometric data covered by the prohibition in Article 9(1) of the General Data Protection Regulation. Pursuant to Article 9(2)(g) of the Regulation, the prohibition on the processing of sensitive personal data does not apply if the processing is necessary for reasons of substantial public interest. Pursuant to Section 7(4) of the Data Protection Act, the Danish Data Protection Agency must grant authorization for such processing when it is not carried out by a public authority. The Danish Data Protection Agency hereby grants LYNGBY BOLDKLUB A\u002FS Authorization to process biometric data pursuant to Section 7(4) of the Data Protection Act through the use of automated facial recognition at the LYNGBY BOLDKLUB A\u002FS stadium Authorization to process biometric data for the purpose of uniquely identifying a natural person through the use of automated facial recognition is granted under the following conditions: This authorization applies only when LYNGBY BOLDKLUB A\u002FS is the sole data controller for the processing of personal data with respect to the CCTV surveillance and the facial recognition system. This authorization applies only when LYNGBY BOLDKLUB A\u002FS is a member of the Superliga. In this context, the authorization applies to the conduct of soccer matches, including exhibition matches, involving teams from the Superliga, the 1st and 2nd divisions, as well as to soccer matches organized by UEFA. The imposition of a ban must be based on objective and proportionate grounds in relation to the violation committed of LYNGBY BOLDKLUB A\u002FS’s stadium regulations and\u002For the Superliga’s code of conduct. Personal data processed as part of the facial recognition system that does not result in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s ban list and\u002For watch list or 2) the police’s general ban list, may not be stored. Personal data processed as part of the facial recognition system that results in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s quarantine list and\u002For watchlist or 2) the police’s general quarantine list must be deleted immediately after each match. LYNGBY BOLDKLUB A\u002FS must comply with the duty to provide information when collecting personal data. LYNGBY BOLDKLUB A\u002FS must also provide information—via signage or in another clear manner—that access control is being conducted, including the processing of biometric data using an automated facial recognition system. Personal data processed as part of the facial recognition system must be transmitted to and stored on the server in encrypted form using up-to-date and widely recognized encryption algorithms. The surveillance cameras must be installed on a separate VLAN and must not be exposed to the internet. LYNGBY BOLDKLUB A\u002FS must implement access control using the facial recognition system, including ensuring that employees are authorized to operate the facial recognition software and logging manual lookups during the login process. Use of multi-factor authentication in the login process. 10. Any changes to the conditions covered by this authorization must be reported to the Danish Data Protection Agency. The above terms apply until further notice. The Danish Data Protection Agency reserves the right to review these terms should the need arise. The above terms are supplementary and clarifying in relation to the provisions of the General Data Protection Regulation and the Danish Data Protection Act. It should be emphasized that the General Data Protection Regulation and the Data Protection Act thus apply to the extent that matters are involved that are not regulated by the terms above. The processing must therefore also be carried out in accordance with the rules regarding, among other things, the preparation of a data protection impact assessment, see Article 35 of the General Data Protection Regulation (GDPR), including in particular Article 35(7) regarding the requirements for the content of a data protection impact assessment. The data protection impact assessment must be completed before processing begins. If the risk associated with the processing cannot be reduced to a level lower than “high,” LYNGBY BOLDKLUB A\u002FS must comply with the requirement for prior consultation set forth in Article 36 of the General Data Protection Regulation. The Danish Data Protection Agency further reserves the right to take a position in the event of a potential complaint. In addition, for the sake of good order, the Danish Data Protection Agency must draw LYNGBY BOLDKLUB A\u002FS’s that the use of images from surveillance cameras may be subject to Section 4c(4) and (5) of the Video Surveillance Act. This would be the case if the surveillance cameras at the stadium are installed for crime prevention purposes and if LYNGBY BOLDKLUB A\u002FS —rather than a template—uses, including in the facial recognition system, an actual image derived from the surveillance cameras at the stadium. It follows from Section 4c(4) of the CCTV Surveillance Act that recordings as mentioned in paragraph (1), i.e., video and audio recordings containing personal data that are made in connection with CCTV surveillance for the purpose of crime prevention, must be deleted no later than 30 days after the recordings are made; see, however, subsection (5). The term “video and audio recordings” refers to both still images and moving images. In the opinion of the Danish Data Protection Agency, this means that images from the surveillance cameras at the stadium that are intended to be registered in the automatic facial recognition system must, as a general rule, be deleted no later than 30 days after the recordings are made. This also applies to images that have been “transferred” to the facial recognition system. However, Section 4c(5) of the Video Surveillance Act provides that recordings may be retained for a longer period than specified in paragraph (4) if necessary for the data controller’s handling of a specific dispute. If retention is necessary for the purposes of a specific dispute, the data controller must, within the time limit specified in paragraph (4), notify the person involved in the dispute and, upon request, provide a copy of the recording to that person. In the opinion of the Danish Data Protection Agency, it is reasonable to consider LYNGBY BOLDKLUB A\u002FS’s notification and enforcement of a suspension as the handling of a specific dispute. Images—derived from the surveillance cameras at the stadium—may thus be retained for longer than 30 days. It is therefore the Danish Data Protection Agency’s assessment that Section 4c(4) of the Video Surveillance Act will not prevent LYNGBY BOLDKLUB A\u002FS from using images from surveillance cameras at the stadium as the basis for using the automatic facial recognition system to identify individuals who violate the stadium regulations and\u002For the rules of conduct. The notification requirement in Section 4c(5), second sentence, of the CCTV Surveillance Act is not deemed to contain any exceptions. Individuals appearing in an image captured by the stadium’s surveillance cameras that is retained for longer than 30 days must therefore be notified of this and may request a copy of the image.","The Danish Data Protection Agency (Datatilsynet) has granted AC Horsens football club permission to process biometric data using automatic facial recognition during football matches. This authorization is subject to several strict conditions, including limitations on data storage and usage, and requires the club to conduct data protection impact assessments. The decision also clarifies how the national CCTV Surveillance Act interacts with GDPR regarding data retention for dispute resolution.","Danish DPA authorizes AC Horsens football club to use facial recognition for match security.","Help Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub): Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit → Revision as of 06:54, 1 September 2026 view sourceSf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators33 editsmTags: Reverted Visual edit← Older edit Revision as of 07:14, 1 September 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators528 editsm Newer edit → (No difference) Revision as of 07:14, 1 September 2026 Datatilsynet - 09-07-2026 Authority: Datatilsynet (Denmark) Jurisdiction: Denmark Relevant Law: Article 9(1) GDPR Article 9(2)(g) GDPR Article 35 GDPR Article 36 GDPR Type: Other Outcome: n\u002Fa Started: Decided: Published: Fine: n\u002Fa Parties: AC Horsens National Case Number\u002FName: 09-07-2026 European Case Law Identifier: n\u002Fa Appeal: n\u002Fa Original Language(s): Danish Original Source: Datatilsynet (in DA) Initial Contributor: sf The DPA gave the AC Horsens football club the permission to process biometric data through the use of automatic facial recognition in the conduct of football matches. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts AC Horsens (the controller), pursuant to section 7(4) of the Danish Data Protection Act, sent an application to the DPA, asking for permission to process biometric data, and thus use automatic facial recognition during football matches. Processing such data would be done on the basis of Article 9(1) GDPR and Article 9(2)(g), that is, necessary for reasons of public interest. Holding The DPA granted the controller authorisation to process biometric data with the use of automatic facial recognition for the purpose of uniquely identifying natural persons. The DPA granted the authorisation under a number of conditions, requires notification of any changes, and reserves the right to review them. The conditions include, inter alia: Authorisation only applies when the controller is in the Danish Super League. Suspensions from matches must be imposed on an objective and proportionate manner following a violation of the controller’s stadium regulations and\u002For the Super League's code of conduct. Personal data which does not concern an individual on the controller’s suspension list, persons of interest list or police’s suspension list may not be stored. Personal data which concern one of those persons must be deleted after every match. The DPA emphasised that the GDPR and the Data Protection Act apply to the extent that the issue at hand is not regulated by the above conditions. The DPA stressed that a data protection impact assessment must be performed in accordance with Article 35 GDPR. If it results in a high risk the controller must seek prior consultation under Article 36 GDPR. The DPA also maintained its position in handling complaints. The DPA further clarified that the use of images from the surveillance to be covered by the national CCTV Surveillance Act. The DPA declared the controller’s communication and enforcement of the suspension list as, necessary for the purpose of processing a specific dispute following the Danish CCTV Surveillance Act. The DPA thus permits the controller to store the stadium’s security camera footage for longer than 30 days. The DPA emphasises that retention of this footage for longer than 30 days imposes a subsequent obligation on the controller to inform the data subject visible in the footage and allow them to request a copy of such. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details. Skip the main navigation Lyngby Boldklub Granted Permission to Use Automated Facial Recognition Date: July 9, 2026 Authorization: Private Companies Following an application from Lyngby Boldklub and AC Horsens, the Danish Data Protection Agency has granted authorization for the clubs to process biometric data and thereby use automatic facial recognition during soccer matches. The above processing involves the processing of biometric data covered by the prohibition in Article 9(1) of the General Data Protection Regulation. Pursuant to Article 9(2)(g) of the Regulation, the prohibition on the processing of sensitive information does not apply if the processing is necessary for reasons of substantial public interest. Pursuant to Section 7(4) of the Data Protection Act, the Danish Data Protection Agency must grant authorization for such processing when it is not carried out by a public authority. The Danish Data Protection Agency hereby grants LYNGBY BOLDKLUB A\u002FS Authorization to process biometric data pursuant to Section 7(4) of the Data Protection Act through the use of automated facial recognition at the LYNGBY BOLDKLUB A\u002FS stadium Authorization to process biometric data for the purpose of uniquely identifying a natural person, through the use of automated facial recognition, is granted under the following conditions: This authorization applies only when LYNGBY BOLDKLUB A\u002FS is the sole data controller for the processing of personal data with respect to the CCTV surveillance and the facial recognition system. This authorization applies only when LYNGBY BOLDKLUB A\u002FS is a member of the Superliga. In this context, the authorization applies to the conduct of soccer matches, including friendly matches, involving teams from the Superliga, the 1st and 2nd divisions, as well as soccer matches organized by UEFA. The imposition of a ban must be based on objective and proportionate grounds in relation to the violation committed of LYNGBY BOLDKLUB A\u002FS’s stadium regulations and\u002For the Superliga’s rules of conduct. Personal data processed as part of the facial recognition system that does not result in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s ban list and\u002For watchlist or 2) the police’s general ban list, may not be stored. Personal data processed as part of the facial recognition system that results in a match with information derived from 1) LYNGBY BOLDKLUB A\u002FS’s quarantine list and\u002For watchlist or 2) the police’s general quarantine list must be deleted immediately after each match. LYNGBY BOLDKLUB A\u002FS must comply with the duty to provide information when collecting personal data. LYNGBY BOLDKLUB A\u002FS must also, through signage or other clear means, provide information that access control is being conducted, including the processing of biometric data using an automated facial recognition system. Personal data processed as part of the facial recognition system must be transmitted to and stored in encrypted form on the server using up-to-date and widely recognized encryption algorithms. Surveillance cameras must be installed on a separate VLAN and must not be exposed to the internet. LYNGBY BOLDKLUB A\u002FS must implement access control using the facial recognition system, including ensuring that employees are authorized to operate the facial recognition software and logging manual lookups during the login process. Use of multi-factor authentication in the login process. 10. Any changes to the conditions covered by this authorization must be reported to the Danish Data Protection Agency. The above terms apply until further notice. The Danish Data Protection Agency reserves the right to review these terms should the need arise. The above terms are supplementary and clarifying in relation to the provisions of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act. It should be emphasized that the General Data Protection Regulation and the Data Protection Act thus apply to the extent that matters are involved that are not regulated by the terms and conditions above. The processing must therefore also be carried out in accordance with ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_09-07-2026&diff=52844&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fb2\u002FLogoDK.png","2026-09-01T07:14:02+00:00","2026-09-01T08:00:15.830238+00:00",7,[18,21,24,26,28,30],{"name":19,"type":20},"automatic facial recognition","product",{"name":22,"type":23},"Datatilsynet","vendor",{"name":25,"type":20},"CCTV Surveillance Act",{"name":27,"type":20},"Danish Data Protection Act",{"name":29,"type":20},"AC Horsens",{"name":31,"type":20},"Lyngby Boldklub","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":32,"icon":34,"name":35,"slug":36},null,"Policy","policy",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[]]