DPA case 2023-212-0015 – Violation Found (Denmark, 2023)

On 22 March 2023, the City of Copenhagen requested the Danish DPA to issue an opinion on whether they could lawfully develop and implement an AI tool to identify citizens in need of rehabilitation. In this request, the City submitted the following information in relation to the sources of data used, legal basis for processing and the purposes of processing: Firstly, the purpose of the algorithm was intended to help make rehabilitation services available to a wider demographic. It was not intended to deprive citizens who would normally be entitled to rehabilitation services, but rather to assist municipal staff in identifying which other citizens were in need of rehabilitative assistance. Secondly, the sources of data which the City wished to process were national patient medical records, these records included information such as patients’ social security number, age, date of birth, and gender. Thirdly, the City wished to rely on Articles 6(1)(e) and 9(1)(g) GDPR. Under Article 6(3) GDPR, reliance on Article 6(1)(e) GDPR as a legal basis for processing must be laid down by Union law or Member State law. As a result, the City of Copenhagen submitted that they were relying on [https://english.sm.dk/media/14900/consolidation-act-on-social-services.pdf section 86] of the Danish Social Services Act. Section 86 provides that the local council must offer rehabilitation services to residents who have physical impairment. The Danish DPA issued a negative opinion regarding the City’s plan to develop the AI tool, because the national law relied upon did not define the scope of the AI tool’s use. The DPA concluded that the use of the AI tool would constitute high-risk processing, as the AI tool would produce a decision-supporting prediction about an individual citizen, which would influence the citizen's access to health care services. Even though the AI tool was not intended to deprive residents of rehabilitation services and was intended to have positive consequences,