Datatilsynet (Denmark) - 09-07-2026
Danish DPA authorizes AC Horsens football club to use facial recognition for match security.
The Danish Data Protection Agency (Datatilsynet) has granted AC Horsens football club permission to process biometric data using automatic facial recognition during football matches. This authorization is subject to several strict conditions, including limitations on data storage and usage, and requires the club to conduct data protection impact assessments. The decision also clarifies how the national CCTV Surveillance Act interacts with GDPR regarding data retention for dispute resolution.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Datatilsynet?
Get an email when a new story names Datatilsynet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAC Horsens football club sought and received conditional authorization from Denmark's Datatilsynet to deploy facial recognition technology for biometric data processing at live events — one of the most privacy-sensitive use cases under GDPR. This case highlights that biometric data processing requires explicit regulatory approval, rigorous Data Protection Impact Assessments (DPIAs), and clearly defined data retention limits. The interaction between national CCTV surveillance law and GDPR creates compliance complexity that organizations must navigate carefully. Failure to obtain proper authorization or adhere to imposed conditions could result in significant fines and reputational damage. This case serves as a landmark reminder that technology adoption must be legally grounded before deployment, not after.