When AI shows up in the news next to words like "criticism" and "nursing home", it is easy to feel uneasy. So let's start with the reassuring part: the criticism is not about the technology itself, which was meant to help. It is about doing the groundwork properly before you start, and that makes it a useful example of how AI can be introduced with care.
On 5 November, Denmark's data protection agency, Datatilsynet, expressed serious criticism of a Danish municipality over how it prepared a six-month AI trial.
What happened
Faaborg-Midtfyn Municipality tested an AI-based monitoring system with 18 residents of a nursing home. A small sensor in each resident's home used AI and camera technology to notice movement, giving staff insight into sleep, restlessness, breathing and movement. The aims were good ones: help residents feel safe, prevent falls and support the staff's own judgement. According to the municipality, the camera was only used in short sequences, and only when a fall might be happening.
The agency looked at the case on its own initiative. Its criticism was about the paperwork and preparation, not about the idea:
- The risk assessment was too general. It listed general threats and rated them all as low risk without explaining why, instead of looking at what could go wrong for these residents with this system.
- The privacy impact assessment came too late. Because the technology was new and the data was sensitive, the agency said a full assessment should have been done before the trial began. Being a six-month pilot did not change that.
- The legal basis was too broad. General care rules were not enough on their own. The agency pointed to specific Danish rules on safety technology that, under certain conditions, allow it to be used for people with dementia or similar conditions, with special conditions for AI.
Why it matters
In our view, this is good news for anyone who wants AI to be trusted. The rules are not there to stop useful technology. They are there to make sure people are protected while it is used, and the agency itself pointed to rules that can allow systems like this one under the right conditions. A test is real use, so the safeguards belong in place from day one.
How we think AI should be used
Most of the AI people hear about today is chatbots. Those are built on large language models (LLMs): AI trained on huge amounts of text to understand and write language. In our work, it helps to think of LLMs in different roles:
- The brain. Some models are excellent at reasoning, planning and making sense of messy information. Where facts matter, we never let them work alone. They run inside a harness: clear guardrails, automatic fact-checking against trusted sources, and a person who reviews the result before it counts.
- The workhorse. Other models are fast and affordable, and great at high-volume, well-defined jobs such as sorting, summarising or tidying up data, where the task is clear and the output is easy to check.
And LLMs are only one kind of AI. Systems that see (like the sensor in this story), understand speech, or predict what is likely to happen next are AI too, and each can be put to good use in its own way.
Whatever the type, the same principle holds: decide what the AI is for, protect the people it touches, and check its work where it matters. Done that way, AI is a powerful and positive tool.
What you can do
If your organization is about to try AI that involves people, check three things with whoever handles data protection for you, before you switch it on:
- A specific legal basis for exactly this use of personal data.
- A privacy impact assessment done first, especially when the technology is new, the data is sensitive (such as health information or camera images), or the people involved are vulnerable.
- A risk assessment that is specific: what could go wrong for these people with this system, and what you will do about it.
That groundwork protects the people in a pilot and makes it much easier to scale what works. Privacy by design is one of the principles we build on; read more on our Foundation page.