Danish DPA probes AI screening of tax staff and psychiatry risk tool

Datatilsynet, the Danish data protection authority,Retsinformation is investigating how two public authorities use artificial intelligence on personal dataDatatilsynet: Skatteforvaltningen, the tax administration, and Region MidtjyllandDatatilsynet. The investigations will test whether the authorities' processing of personal data in connection with two specific AI solutions complies with data protection rules.Datatilsynet

At Skatteforvaltningen, the solution under scrutiny selects employees within the Skatteministeriet group for internal checksDatatilsynet on whether they comply with skatte- og afgiftslovgivningen. An AI system thus helps decide which staff members face internal compliance control.Datatilsynet Datatilsynet opened this investigation on the basis of, among other things, a complaint it received.

The second case concerns Region Midtjylland's AI solution Fokuspatienter i Psykiatrien, used as decision support in psychiatry. The tool is meant to identify patients at elevated risk of bæltefiksering, so that treatment measures can be started with the aim of avoiding belt restraint as far as possible. Datatilsynet first learned of the solution through its 2023 mapping of public-sector AI use.

In both investigations Datatilsynet is examining whether the authorities prepared the required konsekvensanalyser vedrørende databeskyttelseDatatilsynet and how the rolle- og ansvarsfordeling is arranged between the actors involvedDatatilsynet — the controller and processor accountability question that decides who answers for lawful processing. In the Skatteforvaltningen case it is additionally examining questions concerning forbudt AI-praksis efter AI-forordningen.Datatilsynet

The cases form part of Datatilsynet's focus in recent years on how public authorities handle citizens' personal data when developing and using AI solutions, and are meant to illuminate how data protection rules are observed in public-sector AI use. The authority has published its høringsbreve to both bodies. For advisers and data protection officers the signal is that impact-assessment duties and a documented allocation of controller and processor roles are the first things the supervisor checks when it looks at a public-sector AI deploymentDatatilsynet — and that employee-screening uses may additionally attract scrutiny under the AI Act's prohibitionsDatatilsynet.

Legal basis: the data protection rules on impact assessments and controller accountability in databeskyttelsesforordningen (GDPR), and the prohibition of certain AI practices in AI-forordningen (forordning (EU) 2024/1689)Retsinformation, supervised nationally under Lov om supplerende bestemmelser til forordningen om kunstig intelligens §§ 2-4.