DenmarkDatatilsynet
Danish DPA issues serious criticism over AI monitoring in elderly care
Faaborg-Midtfyn's risk assessment was too general and no DPIA preceded camera-based monitoring of 18 nursing-home residents.
By Taxxa AI OyPublished 5 November 2026
Industry: Residential care activities · Public administration and defence; compulsory social security
Danish municipalities that deploy AI-based monitoring in residential care must complete concrete data-protection assessments before switching the system onDatatilsynet, and they cannot rely on general care duties as the legal basis
Datatilsynet. Datatilsynet has issued alvorlig kritik of Faaborg-Midtfyn Kommune
Datatilsynet for failing on both points when it used an AI monitoring solution in a plejehjem
Datatilsynet.
The municipality used a sensor unit in residents' accommodation that analyses movement patterns using AI and camera-based technology. The system gives insight into sleep quality, restlessness, breathing and movement patterns. According to the municipality, the camera was used only in short sequences and only in connection with potential falls. The stated purposes were to increase residents' tryghed, prevent falls and support care staff's professional assessments. Eighteen residents were covered during a defined six-month trial period. Datatilsynet opened the case on its own initiative in January 2026 as part of its supervision of AI used to monitor and check citizens in care.
The municipality had prepared a risikovurdering, but it did not address the concrete risks the AI processing created for the residentsDatatilsynet. The assessment listed only general threats and rated every threat as low risk without giving reasons. Datatilsynet found that the municipality had therefore not demonstrated a level of security appropriate to the risks of the processing for the residents concerned.
Datatilsynet
Datatilsynet further found that the municipality should have carried out a konsekvensanalyse before putting the solution into useDatatilsynet. It emphasised that the processing involved new technology and sensitive personal data relating to vulnerable persons. The fact that the solution was used only in a six-month trial period does not remove the duty to comply with data-protection rules from the start.
On legal basis, the municipality had pointed to the general provisions on help, support and care in serviceloven and ældreloven as the supplementary national legal basis for the processing. Datatilsynet found that those general provisions alone cannot carry this concrete processing through an AI solutionDatatilsynet. It pointed instead to the rules on tryghedsskabende velfærdsteknologi
Datatilsynet, which under closer conditions allow the technology to secure tryghed, værdighed and omsorg for persons with significant and permanently reduced mental functioning as a result of dementia or other acquired and progressive mental impairment
Datatilsynet. Those rules contain specific conditions for the use of AI, including that only necessary information is collected and that personal data collected with AI is not passed on for other purposes. The municipality had not included those rules in its legal-basis considerations.
Municipalities must therefore put the assessments in place before processing beginsDatatilsynet, with risk assessments that engage with the concrete risks to residents and impact assessments where the rules require them. The use of new technology can mean a different and more intrusive processing of citizens' personal data than processing without that technology.
Legal basis: the data-protection rules on risk assessment and impact assessment as applied in Datatilsynet's decision reported in its news item of 5 November 2026Datatilsynet, and the rules on tryghedsskabende velfærdsteknologi in Bekendtgørelse nr. 1412 af 5. december 2024
Retsinformation
Retsinformation, §§ 2 and 7
Retsinformation.
Before using AI monitoring in residential care, complete a concrete risk assessment and, where the use involves new technology and sensitive data, a data protection impact assessment, and verify the legal basis in the tryghedsskabende velfærdsteknologi rules.