[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI1q1vIg4XHc76Kr_n0d1grlE-OmhWayPILFCeq_fu8c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"544c7592-bd1c-48a6-a9c1-24f3f49befeb","municipality-reprimanded-for-deploying-ai-in-nursing-home-without-adequate-dpia","9dcd1c30-4cdc-4df6-8356-2b8bfe730f6d","Municipality Reprimanded for Deploying AI in Nursing Home Without Adequate DPIA","Denmark's Datatilsynet found that a municipality deployed an AI-based monitoring system in a nursing home without conducting a thorough Data Protection Impact Assessment (DPIA), as required under GDPR Article 35. The municipality believed its risk assessment was sufficient, but the DPA determined it failed to identify the significant privacy risks inherent in AI surveillance of vulnerable individuals. This matters because AI systems processing sensitive personal data—especially in care settings involving elderly residents—carry elevated risks of harm, bias, and rights violations that only a rigorous DPIA can surface. Skipping or inadequately performing a DPIA before deployment leaves organisations legally exposed and, more critically, leaves data subjects unprotected.","**Immediate actions:**\n- Conduct a full, documented DPIA before deploying any AI or automated monitoring system that processes personal data, especially for vulnerable populations.\n- Engage your Data Protection Officer (DPO) early in the procurement and design phase to review whether the planned system triggers mandatory impact assessment requirements.\n\n**Long-term improvements:**\n- Establish a formal AI governance policy that mandates risk and impact assessments as a gate before any AI system goes live.\n- Maintain a register of all AI and automated processing activities, including the associated DPIAs and their review dates.\n- Embed privacy-by-design principles into procurement contracts so vendors must demonstrate compliance prior to deployment.\n\n**Detection and review measures:**\n- Schedule periodic reviews of existing AI systems to reassess risks as technology, context, or data volumes change.\n- Define clear escalation criteria so that any new processing activity involving sensitive data or vulnerable persons is automatically flagged for DPA consultation.",[12,13,14,15,16],"GDPR Article 35","GDPR Article 25","ISO\u002FIEC 27001:2022 A.5.36: Compliance with policies, rules and standards for information security","NIST SP 800-53 RA-3: Risk Assessment","NIS2 Article 21(2)(a)",{"GDPR Article 25":18,"GDPR Article 35":19,"NIS2 Article 21(2)(a)":20,"NIST SP 800-53 RA-3: Risk Assessment":21,"ISO\u002FIEC 27001:2022 A.5.36: Compliance with policies, rules and standards for information security":22},"Article 25 requires data protection by design and by default, meaning privacy safeguards must be integrated before deployment rather than assessed after the fact, which did not happen here.","Article 35 explicitly requires a Data Protection Impact Assessment before processing likely to result in high risk—such as AI-based monitoring of vulnerable individuals in a care setting—which the municipality failed to perform adequately.","This point requires entities to have systematic risk analysis processes in place; had the municipality applied a rigorous risk analysis policy to the AI system, it would have identified the significant risks the DPA later cited.","RA-3 requires organisations to conduct thorough risk assessments that identify the likelihood and impact of privacy and security risks before systems are deployed, directly addressing the inadequate assessment found by the DPA.","This control requires organisations to ensure their processing activities comply with applicable legal and policy requirements, including mandatory impact assessments before high-risk data processing begins.","published","2026-11-11T12:22:06.172547+00:00","2026-11-11T12:22:06.148+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_2026-423-0075&diff=53684&oldid=53639","datatilsynet-denmark-2026-423-0075-ee0eb7","Datatilsynet (Denmark) - 2026-423-0075",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45],{"slug":46,"name":47,"problem":48},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]