Denmark stands against critics of public sector AI plans | Computer Weekly

The Danish government has solved the perennial problem of European data protection compliance — which is that it involves asking permission — by simply drafting a bill that removes the asking. The legislation, soon to be tabled in parliament, would hand public bodies a blanket right to process personal data with AI in pursuit of their legislated service obligations, a phrase doing the sort of heavy lifting that would put a forklift out of business. Legislate yourself a service obligation and the data protection question answers itself. Neat, isn't it?

The bill goes further than reading files: it would let agencies build and train their own AI systems and use them to profile people. That is not a pilot project, that is infrastructure. Against which the legal campaign group IT-Pol has raised the sort of objection that reads as quaint in ministerial corridors — that a blanket legal basis lacks sufficient limits and safeguards, and fails EU law's requirement that such intrusions be precisely defined. Precisely defined. In a bill whose central mechanism is a blanket. One is tempted to ask whether anyone in the ministry has read those two words side by side.

Compare and contrast New Jersey's effort last week, which at least asked developers to describe their safety procedures and pretended that constituted oversight. Denmark's version skips the describing. Build the system, train it on the citizenry, profile away — it is all in service of a service obligation, so it is fine. The bill has not even been tabled yet, which is the loveliest detail: an instrument still in draft, already promising to be maximally permissive on contact. Somewhere a data protection officer is being informed that their job title is now 'enabler', and that the paperwork will be handled by the algorithm.