Municipality sharply criticized for inadequate risk assessment of AI sensors in nursing homes

Faaborg-Midtfyn Municipality has received a serious reprimand from the Danish Data Protection Agency (Datatilsynet) over its use of AI in elder care. The criticism is that the municipality's risk assessment was inadequate, and that it had not carried out an impact assessment at all before the technology was put into use.

Sensor with camera and AI

The solution consists of a sensor unit in the care home unit. It uses AI and camera-based technology to analyze movement patterns, providing insight into residents' sleep quality, restlessness, breathing and movements.

According to the municipality, the solution was used on 18 residents at a nursing home during a limited six-month trial period. The aim was to increase residents' sense of security, prevent falls and support the care staff's professional judgment. The municipality has stated that the camera is used only in short sequences and only when a fall is potentially occurring.

The Danish Data Protection Agency opened the case on its own initiative in January 2026 as part of a focus on AI used for monitoring and controlling citizens in care.

Risk assessment without justification

The municipality had carried out a risk assessment. But according to the Danish Data Protection Agency, it did not adequately address the specific risks to residents from processing personal data in the AI solution. The assessment listed only general threats, and the municipality rated them all as low risk without further justification.

The agency therefore concludes that the municipality did not sufficiently demonstrate that the security level was appropriate to the risks.

The agency also believes the municipality should have carried out an impact assessment before the solution was used. This is partly because the technology was new and the data was sensitive information about vulnerable citizens. According to the Danish Data Protection Agency, the fact that the solution was in use for only six months does not change the obligation to comply with the rules.

Unclear legal basis

The municipality pointed to the general provisions on help, support and care in the Danish Social Services Act and the Elder Care Act as the basis for processing the data. According to the Danish Data Protection Agency, these alone cannot provide a basis for the specific use of the AI solution.

The agency points out that there are rules on welfare technology that promotes a sense of security. Under certain conditions, they permit technology intended to ensure security, dignity and care for people with significantly and permanently reduced mental functioning as a result of dementia or other acquired and progressive mental impairment. The rules include special conditions for the use of AI. According to the information provided, the municipality had not factored them into its considerations.

The Danish Data Protection Agency stresses in general that municipalities' use of new technology can mean more intrusive processing of citizens' personal data. Before processing begins, municipalities must assess whether data protection rules are being complied with, including through specific risk assessments and impact assessments where the rules require it.

The notice does not state which vendor or product is involved, or whether the municipality has been issued an order or a fine.