[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f85kt5gNQyigVKeiTkRjNGEEDHlxEBHLTo8s6hedWDqk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"37c3b129-744a-45d9-a41f-eaf7660d8550","danish-dpa-authorizes-biometric-facial-recognition-at-football-matches-under-strict-gdpr-conditions","0149667f-c078-4c82-92bc-12a7c9f5c19f","Danish DPA Authorizes Biometric Facial Recognition at Football Matches Under Strict GDPR Conditions","AC Horsens football club sought and received conditional authorization from Denmark's Datatilsynet to deploy facial recognition technology for biometric data processing at live events — one of the most privacy-sensitive use cases under GDPR. This case highlights that biometric data processing requires explicit regulatory approval, rigorous Data Protection Impact Assessments (DPIAs), and clearly defined data retention limits. The interaction between national CCTV surveillance law and GDPR creates compliance complexity that organizations must navigate carefully. Failure to obtain proper authorization or adhere to imposed conditions could result in significant fines and reputational damage. This case serves as a landmark reminder that technology adoption must be legally grounded before deployment, not after.","**Before Deployment:**\n- Conduct a full Data Protection Impact Assessment (DPIA) before implementing any biometric or facial recognition system.\n- Obtain explicit regulatory authorization from the relevant Data Protection Authority (DPA) when processing special category data under GDPR Article 9.\n- Map all applicable national laws (e.g., CCTV Acts) alongside GDPR to identify conflicting or complementary obligations.\n\n**Operational Controls:**\n- Define and enforce strict data retention schedules specific to each processing purpose (e.g., dispute resolution vs. security monitoring).\n- Implement technical access controls ensuring biometric data is accessible only to authorized personnel with a documented need.\n- Log all access to and processing of biometric data to support audit trails and accountability.\n\n**Long-term Governance:**\n- Establish a recurring review process to reassess DPIA findings as technology, usage, or legal frameworks evolve.\n- Appoint or consult a Data Protection Officer (DPO) for ongoing oversight of high-risk processing activities.\n- Train staff handling biometric systems on GDPR obligations, data minimization principles, and breach response procedures.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","GDPR Article 58 — Powers of supervisory authorities","GDPR Recital 51 — Biometric data as sensitive data","NIST SP 800-53 IA-3 — Device Identification and Authentication","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","NIST Privacy Framework PR.DS-P — Data Processing Policies","CIS Control 3 — Data Protection","CIS Control 6 — Access Control Management","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)","ITIL — Service Design: Privacy and Data Protection by Design",{},"published","2026-09-01T08:21:09.341221+00:00","2026-09-01T08:21:09.065+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_09-07-2026&diff=52844&oldid=0","datatilsynet-denmark-09-07-2026-cb5d30","Datatilsynet (Denmark) - 09-07-2026",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]