# Datatilsynet (Denmark) - 09-07-2026 (AC Horsens)

- Type: Enforcement
- Source: Datatilsynet (Denmark)
- Date: 2026-09-01
- Original: https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_09-07-2026_(AC_Horsens)
- Canonical: https://overview.legal/posts/353639
- Topics: Biometric Data, Personal Data, Biometric Data, Special Categories of Data, Types of Special Categories of Personal Data, AI Provider Transparency, Supervisory Authorities, Transparency

## Summary

Facts — AC Horsens (the controller), pursuant to section 7(4) of the Danish Data Protection Act, sent an application to the DPA, asking for permission use automatic facial recognition during football matches to process biometric data. Processing such data would be done on the basis of Article 9(1) GDPR and Article 9(2)(g) GDPR, that is, necessary for reasons of public interest. Holding — The DPA granted the controller authorisation to process biometric data with the use of automatic facial recognition for the purpose of uniquely identifying natural persons. The DPA granted the authorisation under a number of conditions, requires notification of any changes, and reserves the right to review them. The conditions include, inter alia: Authorisation only applies when the controller is in the Danish Super League. Suspensions from matches must be imposed on an objective and proportionate manner following a violation of the controller’s stadium regulations and/or the Super League's code of conduct. Personal data which does not concern an individual on the controller’s suspension list, persons of interest list or police’s suspension list may not be stored. Personal data which concern one of those persons must be deleted after every match. The DPA emphasised that the GDPR and the Data Protection Act apply to the extent that the issue at hand is not regulated by the above conditions. The DPA stressed that a data protection impact assessment must be performed in accordance with Article 35 GDPR. If it results in a high risk the controller must seek prior consultation under Article 36 GDPR. The DPA also maintained its position in handling complaints. The DPA further clarified that the use of images from the surveillance to be covered by the national CCTV Surveillance Act. The DPA declared the controller’s communication and enforcement of the suspension list as necessary for the purpose of processing a specific dispute following the Danish Surveillance Act. The DPA thus permits the controller to store the stadium’s security camera footage for longer than 30 days. The DPA emphasises that retention of this footage for longer than 30 days imposes a subsequent obligation on the controller to inform the data subject visible in the footage and allow them to request a copy of such.

## Full text

The Danish Data Protection Agency has – upon application from Lyngby Boldklub and AC Horsens – given permission for clubs to process biometric data and thus use automatic facial recognition in the conduct of football matches. The above processing involves the processing of biometric data covered by the prohibition in Article 9(1) of the General Data Protection Regulation. 1. Pursuant to Article 9(2)(g) of the Regulation, the prohibition of processing sensitive data shall not apply where the processing is necessary for reasons of essential public interest. Pursuant to section 7(4) of the Danish Data Protection Act, the Danish Data Protection Agency must give permission for such processing when it is not carried out by a public authority. The Danish Data Protection Agency hereby announces FOOTBALLIANCE AC HORSENS A/S Permission for the processing of biometric data pursuant to section 7(4) of the Danish Data Protection Act, using automatic facial recognition at the stadium of the FODBALL ALLAMENT AC HORSENS A/S The authorisation for the processing of biometric data for the purpose of uniquely identifying a natural person, using automatic facial recognition, shall be granted under the following conditions: The authorisation applies only when the FODBALLIAN ALLIANCE AC HORSENS A/S is independent data controller for the processing of personal data in respect of the television surveillance and facial recognition system. The authorisation applies only when THE FOOTBALL ALLIANCE AC HORSENS A/S is part of the Superliga. The permit shall apply in this connection by the conduct of football matches, including training matches, with the participation of teams from the Super League, 1st and 2nd Divisions, as well as at football matches under the auspices of UEFA. The notification of quarantine must be made on a factual and proportionate basis in relation to the violation of the Committed AllIANCE AC HORSENS A/S’ stadium regulations and/or the Superliga’s rules of procedure. Personal data processed as part of the facial recognition system that does not result in a match with information resulting from 1) FOOTBALLIANCE AC HORSENS A/S’ quarantine list and/or interest list or 2) the police’s general quarantine list, must not be stored. Personal data processed as part of the facial recognition system, which results in a match with information arising from 1) FOOTBALLIANCE AC HORSENS A/S’ quarantine list and/or interest list or 2) the police general quarantine list, must be deleted immediately after any match. THE FOOTBALL ALLIANCE AC HORSENS A/S must observe the obligation to provide information when collecting personal data. The FOOTBALL ALLIANCE AC HORSENS A/S must also, by signage or otherwise clearly indicate that access control is carried out, including the processing of biometric data using an automatic facial recognition system. Personal data processed as part of the facial recognition system shall be transported to and stored encrypted on the server with up-to-date and widely recognised encryption algorithms. The surveillance cameras must be installed on a separate VLAN and shall not be exposed to the Internet. THE FOOTBALL ALLIANCE AC HORSENS A/S must maintain access control of the facial recognition system, including safe Authorization of employees for serving the facial recognition software and logging manual listings in the log-in process. use of multi-factor authentication in the log-in process. 10. Any changes to the conditions covered by the authorisation must be notified to the Danish Data Protection Agency. The above conditions apply until further notice. The Danish Data Protection Agency reserves the right to review conditions in case of need to be considered. The above conditions are complementary and clarifying in relation to the rules of the General Data Protection Regulation and the Data Protection Act. It should be stressed that the General Data Protection Regulation and the Data Protection Act thus apply to the extent that these are matters that are not regulated in the above terms. The processing must therefore be carried out in accordance with the rules on, inter alia, the preparation of impact assessment on data protection, in accordance with Article 35 of the General Data Protection Regulation, including in particular Article 35(7) on the requirements for the content of an impact assessment. The impact assessment shall be completed before the start of treatment. If the risk of the processing cannot be reduced to a level lower than high, the FODBALL LIANCE AC HORSENS A/S must observe the requirement for prior consultation in Article 36 of the General Data Protection Regulation. The Danish Data Protection Agency must also reserve its position in the event of a possible complaint. In addition, for the sake of good measure, the Danish Data Protection Agency must draw the attention of the FODBALL ALLIANCE AC HORSENS A/S to the fact that the use of images from the surveillance cameras may be covered by section 4 (c) (4) and (5) of the Danish Television Surveillance Act. This will be the case if the surveillance cameras in the stadium are set up for crime prevention purposes and if the FOOTBALL ALLIANCE AC HORSENS A/S – rather than a template – uses an actual picture, including in the facial recognition system, which originates from the surveillance cameras in the stadium. Of section 4 (c), paragraph 4, of the Danish Television Surveillance Act, it follows that recordings as referred to in paragraph 1, i.e. image and audio recordings with personal data recorded in connection with television surveillance for crime prevention purposes, must be deleted, no later than 30 days after the recordings have been made, see. 5. Image and audio recordings mean both still images and moving images. In the Danish Data Protection Agency’s view, this implies that the images from the surveillance cameras in the stadium to be registered in the system for automatic facial recognition must, as a rule, be deleted within 30 days after the footage has been made. This also applies to images that are “transmitted” to the facial recognition system. However, it follows from section 4 (c)(5) of the Danish Television Surveillance Act that recordings may be kept for a longer period than referred to in paragraph 4, if necessary for the purposes of the processing of a specific dispute by the controller. Where storage is necessary for the purposes of a specific dispute, the controller shall, within the time limit specified in paragraph 4, inform the person to whom the dispute relates and, upon request, provide a copy of the recording to him. In the Danish Data Protection Agency’s opinion, it is obvious to consider the message of the FODBALL ALLIANCE AC HORSENS A/S and the enforcement of a quarantine as a handling of a specific dispute. Images – resulting from the security cameras in the stadium – will thus be able to be stored for longer than 30 days. It is therefore the Danish Data Protection Agency's assessment that section 4 (c)(4) of the Danish Television Surveillance Act will not prevent the FODBALLIAN LIGHTNING BY AC HORSENS A/S from using images from surveillance cameras at the stadium as a basis for in the system for automatic facial recognition to register persons who violate the stadium regulations and/or regulations. The notification obligation in section 4 (c), paragraph. 5, 2. paragraph, is not seen to contain exceptions. The persons appearing in an image held for longer than 30 days, resulting from the security cameras in the stadium, will therefore have to be informed thereof and will be able to request a copy of the image.

---
Generated by overview.legal · https://overview.legal/posts/353639 · 2026-09-03