Danish DPA criticises Faaborg-Midtfyn over AI monitoring of 18 residents

Denmark’s Data Protection Agency (Datatilsynet) has issued serious criticism of Faaborg-Midtfyn Kommune over its use of an AI-based monitoring system in a nursing home, according to a decision published on 5 November 2026. The municipality told the agency it had used the system on 18 residents during a limited six-month trial intended to improve safety, prevent falls and support care staff’s professional assessments.

Datatilsynet said municipalities must, before processing begins, carry out thorough assessments of whether data protection rules are being complied with, including specific risk assessments and impact assessments where required. A short trial does not remove those obligations, particularly where new technology processes sensitive data about vulnerable people.

What Datatilsynet found

Datatilsynet began the case on its own initiative in January 2026, as part of its focus on AI used to monitor and control people receiving care.

The system consists of a sensor unit in a resident’s accommodation. It uses AI and camera-based technology to analyse movement patterns and provide information about sleep quality, restlessness, breathing and movement. Faaborg-Midtfyn told the agency that the camera operated only in brief sequences and only when a potential fall was detected.

The municipality had prepared a risk assessment, but Datatilsynet found it too general. It listed general threats rather than the specific risks created by the AI processing for residents. It also rated every threat as low risk without providing a detailed justification.

As a result, the municipality had not demonstrated sufficiently that it had put in place a level of security appropriate to the processing risks.

The agency also concluded that the municipality should have carried out a data protection impact assessment before putting the system into operation. It relied on two features of the deployment: the use of new technology and the processing of sensitive personal data concerning vulnerable citizens.

Datatilsynet expressly rejected the relevance of the trial’s duration. The fact that the system was used for only six months did not change the municipality’s obligation to comply with data protection rules before processing began.

General care powers were not enough

Faaborg-Midtfyn had relied on general provisions in Denmark’s Social Services Act and Act on Older Persons concerning help, support and care as the supplementary national legal basis for the processing.

Datatilsynet found that those provisions could not, on their own, support the specific processing carried out through the AI system. The agency pointed instead to Denmark’s rules on security-enhancing welfare technology, which can permit technology to support safety, dignity and care for people with significant and permanently reduced mental functional ability caused by dementia or another acquired and progressive mental impairment.

Those rules include specific conditions for the use of AI. Datatilsynet said the municipality had not taken them into account when considering its legal basis.

The decision therefore leaves operators of care services with two separate tasks. A broad statutory duty to provide care is not enough by itself.

In its general guidance accompanying the decision, Datatilsynet said new technology may produce processing that is different from, and more intrusive than, processing without that technology. Municipalities must therefore assess compliance before processing starts, including the specific risks to citizens and whether an impact assessment is required.

Part of a wider AI focus

On 4 November, the agency announced inspections of the Danish Tax Administration and Region Midtjylland concerning their use of AI in personal-data processing. In October, it also responded to a draft bill on a general legal basis for certain public-authority AI processing. In a 16 September consultation, Denmark excluded fully automated decisions covered by Article 22 of the General Data Protection Regulation from the draft legal basis.

Atlas reads the Faaborg-Midtfyn decision as a warning against treating a limited pilot, human involvement or a safety-related purpose as substitutes for deployment-stage compliance work. The authority’s immediate message is that the risk analysis, impact assessment and legal basis must be settled before a resident’s data enters the system.