[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZVZOYinOC4ZutXHYV1QWZis38_FV3-ISbnBPE53ANYc":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"9dcd1c30-4cdc-4df6-8356-2b8bfe730f6d","Datatilsynet (Denmark) - 2026-423-0075","datatilsynet-denmark-2026-423-0075-ee0eb7","← Older revision Revision as of 11:16, 11 November 2026 Line 104: Line 104: }} }} The DPA reprimanded a controller for implementing an AI-based monitoring system in a nursing home without having conducted an adequate risk assessment and in complete absence of a data protection impact assessment. The DPA reprimanded a municipality for implementing an AI-based monitoring system in a nursing home without having conducted an adequate risk assessment and in absence of a data protection impact assessment. == English Summary == == English Summary ==","Denmark's Datatilsynet reprimanded a municipality for implementing an AI-based monitoring system in a nursing home without an adequate risk assessment or a data protection impact assessment. The municipality claimed a risk assessment was done, but the DPA found it inadequate, failing to identify significant risks posed by the AI system.","Denmark's DPA reprimands municipality for inadequate AI monitoring risk assessment in nursing home.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_2026-423-0075&diff=53684&oldid=53639","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fb2\u002FLogoDK.png","2026-11-11T11:16:36+00:00","2026-11-11T12:00:42.785267+00:00",7,[17,20,23],{"name":18,"type":19},"AI-based monitoring system","product",{"name":21,"type":22},"Datatilsynet","vendor",{"name":24,"type":25},"AI","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[],[21,18],{"controls":52,"vendors":78},[53],{"slug":46,"name":54,"problem":55,"products":56},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":74,"product_name":75,"url":76,"description":77},"boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",[],{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":89},"municipality-reprimanded-for-deploying-ai-in-nursing-home-without-adequate-dpia","Municipality Reprimanded for Deploying AI in Nursing Home Without Adequate DPIA","Denmark's Datatilsynet found that a municipality deployed an AI-based monitoring system in a nursing home without conducting a thorough Data Protection Impact Assessment (DPIA), as required under GDPR Article 35. The municipality believed its risk assessment was sufficient, but the DPA determined it failed to identify the significant privacy risks inherent in AI surveillance of vulnerable individuals. This matters because AI systems processing sensitive personal data—especially in care settings involving elderly residents—carry elevated risks of harm, bias, and rights violations that only a rigorous DPIA can surface. Skipping or inadequately performing a DPIA before deployment leaves organisations legally exposed and, more critically, leaves data subjects unprotected.",[84,85,86,87,88],"GDPR Article 35","GDPR Article 25","ISO\u002FIEC 27001:2022 A.5.36: Compliance with policies, rules and standards for information security","NIST SP 800-53 RA-3: Risk Assessment","NIS2 Article 21(2)(a)",{"GDPR Article 25":90,"GDPR Article 35":91,"NIS2 Article 21(2)(a)":92,"NIST SP 800-53 RA-3: Risk Assessment":93,"ISO\u002FIEC 27001:2022 A.5.36: Compliance with policies, rules and standards for information security":94},"Article 25 requires data protection by design and by default, meaning privacy safeguards must be integrated before deployment rather than assessed after the fact, which did not happen here.","Article 35 explicitly requires a Data Protection Impact Assessment before processing likely to result in high risk—such as AI-based monitoring of vulnerable individuals in a care setting—which the municipality failed to perform adequately.","This point requires entities to have systematic risk analysis processes in place; had the municipality applied a rigorous risk analysis policy to the AI system, it would have identified the significant risks the DPA later cited.","RA-3 requires organisations to conduct thorough risk assessments that identify the likelihood and impact of privacy and security risks before systems are deployed, directly addressing the inadequate assessment found by the DPA.","This control requires organisations to ensure their processing activities comply with applicable legal and policy requirements, including mandatory impact assessments before high-risk data processing begins."]