Datatilsynet (Denmark) - 2026-423-0075
Denmark's DPA reprimands municipality for inadequate AI monitoring risk assessment in nursing home.
Denmark's Datatilsynet reprimanded a municipality for implementing an AI-based monitoring system in a nursing home without an adequate risk assessment or a data protection impact assessment. The municipality claimed a risk assessment was done, but the DPA found it inadequate, failing to identify significant risks posed by the AI system.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Datatilsynet?
Get an email when a new story names Datatilsynet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDenmark's Datatilsynet found that a municipality deployed an AI-based monitoring system in a nursing home without conducting a thorough Data Protection Impact Assessment (DPIA), as required under GDPR Article 35. The municipality believed its risk assessment was sufficient, but the DPA determined it failed to identify the significant privacy risks inherent in AI surveillance of vulnerable individuals. This matters because AI systems processing sensitive personal data—especially in care settings involving elderly residents—carry elevated risks of harm, bias, and rights violations that only a rigorous DPIA can surface. Skipping or inadequately performing a DPIA before deployment leaves organisations legally exposed and, more critically, leaves data subjects unprotected.
What helps against this
How we list vendors- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.