Danish DPA Responds to Revised Draft AI Authorization Act for Public Sector Data Processing

Key Takeaways

• The Danish Data Protection Agency (Datatilsynet) has submitted a consultation response on the revised draft of the AI Authorization Act, which would give public authorities a data protection legal basis to develop and use AI systems.
• While the Agency acknowledges improvements from the earlier draft, it stresses that a legal basis alone does not satisfy broader GDPR obligations, a critical reminder for compliance teams involved in public-sector AI deployment.

Deep Dive

The draft legislation, proposed by Denmark's Ministry of Science, Higher Education and Digitization, seeks to establish a general legal basis under data protection law enabling public authorities and bodies to develop and deploy AI systems when processing personal data in the course of their duties. Notably, the bill supports AI as a decision-support tool but explicitly does not authorize fully automated decision-making under Article 22 of the GDPR. This distinction is significant for compliance teams in public bodies, as it confines the scope of permissible AI use to assistive functions rather than autonomous determinations affecting individuals.

Datatilsynet's consultation response reiterates concerns previously raised, emphasizing that establishing a legal basis is only one component of GDPR compliance. The Agency specifically flagged outstanding requirements around security of processing, data subject rights, international data transfers to third countries, and purpose limitation/purpose-shift considerations. This signals that even once the legal basis is codified, public authorities must independently assess and document compliance with these additional GDPR obligations before processing personal data via AI systems.

No firm legislative timeline was provided; the bill remains in the consultation and drafting phase, with the Ministry expected to finalize the proposal based on stakeholder input, including Datatilsynet's comments. The consultation response itself is not yet public but will likely be available via Denmark's Consultation Portal once the bill is formally presented to parliament. Compliance professionals in Danish public-sector entities, as well as vendors supplying AI systems to the public sector, should monitor the Consultation Portal and subsequent parliamentary proceedings for updates.

For compliance teams, the recommended course of action is to begin gap-assessing existing or planned AI initiatives against GDPR's broader requirements now, rather than waiting for the Act's passage. Datatilsynet draws a direct parallel to challenges already identified in cloud computing deployments, encouraging organizations to leverage existing agency guidance on both AI development and cloud services as a practical starting point. Given the structural similarity between AI and cloud risk profiles (third-party/service-based processing, cross-border transfer risk, security accountability), compliance teams should treat this as an extension of existing third-party risk management frameworks.

From a risk perspective, organizations operating in or supplying AI to the Danish public sector face moderate near-term regulatory risk, as the law is still evolving and final requirements may shift. However, the clear signal from the regulator is that legal basis alone will not be a safe harbor — organizations must proactively address security, data subject rights, and cross-border transfer compliance in parallel. Failure to do so once the Act passes could expose public authorities and their AI vendors to enforcement risk, reputational harm, and potential GDPR penalties.

Source: Datatilsynet (The Danish Data Protection Agency)