Danish Data Protection Agency digs into AI at the tax authority and in psychiatry

The Danish Data Protection Agency (Datatilsynet) has opened two inspections into how public authorities use artificial intelligence (AI). They concern one solution at the Danish Tax Administration and one at the Central Denmark Region. These are investigations, not rulings, and it is not stated whether any violations have been found.

Selection of tax employees

At the Tax Administration, the inspection concerns an AI solution used to select employees in the Ministry of Taxation's group for internal audits. The audits are meant to show whether the employees themselves comply with tax and duty legislation.

The inspection was opened in part based on a complaint that Datatilsynet received. It is not stated who filed the complaint or what it is about.

Datatilsynet is also examining matters concerning prohibited AI practices under the AI Act. In August 2025, Datatilsynet was designated as a market surveillance authority for two provisions in the regulation on prohibited forms of AI practices. The inspection therefore monitors whether they are being complied with.

Risk of restraint with straps

At the Central Denmark Region, the inspection concerns the AI solution Fokuspatienter i Psykiatrien (Focus Patients in Psychiatry). It is used as decision support in psychiatry and is meant to help identify patients at elevated risk of being strapped down in restraints. The goal is for staff to be able to start treatment measures so that restraint is avoided as far as possible.

Datatilsynet learned of the solution during its 2023 survey of the use of artificial intelligence in the public sector.

What is being examined

In both inspections, Datatilsynet is looking at, among other things, whether the authorities have carried out the necessary data protection impact assessments. An impact assessment evaluates what risks a new solution may pose to citizens' personal data. The inspection also examines how roles and responsibilities are divided among the parties involved.

In recent years, Datatilsynet has focused on how public authorities in particular handle citizens' personal data when they develop and use AI. The inspections are part of that work.

According to Datatilsynet, AI holds great potential in the public sector, but depending on how it is developed and used, it can pose risks to citizens' rights and data protection. According to the agency, responsible use is a prerequisite for public trust.

It is not stated when the inspections were opened or when they are expected to be completed. Responses from the Tax Administration and the Central Denmark Region are not included in Datatilsynet's announcement.