The Danish data protection authority issued a severe criticism against a municipality for its use of an artificial intelligence system in a nursing home, conducted without a sufficiently specific impact assessment or risk evaluation.

Facts and context

The Danish data protection authority (Datatilsynet) published a decision issuing a severe criticism against the municipality of Faaborg-Midtfyn for breaches related to the use of an artificial intelligence (AI) system in a nursing home.

The case originated from an ex officio inspection initiated by the authority in January 2026, as part of its monitoring program on the use of AI for monitoring persons under care. The municipality had deployed, for a six-month trial period and with 18 residents, a surveillance system based on AI aimed at analyzing movement patterns via sensors and cameras to increase safety, prevent falls, and assist care staff.

Grounds for the decision

• Obligation to ensure a level of security appropriate to the risk (Article 32 of the GDPR, Article 5(1)(f), Article 5(2), and Article 24(1)): The authority found that the risk assessment carried out by the municipality was too general. It merely listed generic threats without analyzing the concrete risks that the processing by the AI solution posed to the rights and freedoms of the residents. Furthermore, the municipality classified all threats as presenting a "low risk" without providing justification, thus failing in its obligation to demonstrate that it had implemented a level of security appropriate to the actual risks of the processing.
• Obligation to carry out a data protection impact assessment (Article 35 of the GDPR): The authority judged that an impact assessment should have been conducted before the system was put into operation. It based its conclusion on the combination of several factors: the use of new technology (AI and video analysis), the processing of sensitive data (health information and lifestyle habits), and the fact that the data subjects were vulnerable persons. The temporary nature of the project (six-month trial period) does not exempt the controller from this prior obligation.
• Obligation to have an appropriate legal basis (Article 6 of the GDPR and Article 9 of the GDPR): The municipality invoked general provisions of the Social Services Act and the Elderly Act as a complementary national legal basis (Article 6(1)(e)). The authority considered that these general provisions were not sufficiently clear and precise to support such a specific and potentially intrusive processing. It noted that more specific legislation on welfare technologies serving safety existed but had not been considered by the municipality.

Decision of the authority

Consequently, the authority issued a severe criticism against the municipality of Faaborg-Midtfyn.

Lessons learned

This decision reminds that:

• A risk assessment must be concrete and specific to the processing envisaged, and not merely list generic threats; any classification of the risk level must be duly justified.
• The deployment of new technology to process sensitive data concerning vulnerable persons makes the carrying out of an impact assessment mandatory, including for a trial period or a limited pilot project.
• The legal basis for processing by a public authority, especially when it involves intrusive technologies such as AI, must be sufficiently clear and precise; general legal provisions relating to a public service mission may prove insufficient.