Data protection authorities must in principle give complainants access to their data

What happened

Faaborg-Midtfyn municipality trialled an AI sensor with camera-based technology in the rooms of 18 nursing home residents for six months, analysing sleep, restlessness, breathing and movement, to make residents feel safer, prevent falls and support staff's assessments. It did no DPIA. Its risk assessment listed only generic threats and rated them all low, without reasons.

The authority's findings

In a case it opened itself, the authority expressed serious criticism, with no fine or order, for breaches of Article 5(2) read with Article 5(1)(f), Article 24(1) read with Article 32(1), and Article 35(1) GDPR. In this case, sensitive data on vulnerable residents and new technology made the processing high risk, so a DPIA was needed before use, trial or not. The assessment missed AI-specific risks: residents' data leaking if the underlying base model is trained on them, and automation bias, staff giving the system's assessment more weight than their own. The authority also found that general care provisions could not alone provide the supplementary national legal basis for this processing, and pointed to Denmark's specific welfare technology rules, which set conditions for AI.

What the document addresses

Session replay tools record what a visitor does on a site or app, including mouse movements, taps, clicks, scrolling and sometimes form entries, and replay it as video. They easily capture data the analysis does not need.

The CNIL's recommendations

The recommendation, adopted on 8 October and published on 5 November 2026, is addressed to tool providers and the publishers that use them:

1. These tools use trackers that read or write information on the user's device. Those operations fall under Article 82 of the French Data Protection Act, the French transposition of the ePrivacy rule on cookies, and neither of its exemptions applies, so prior consent is required. The CNIL recommends specific information about these tools at the first level of the consent interface.
2. Purposes should be fixed before deployment, not after collection.
3. Irrelevant data should be masked, and recorded sessions and identifiers limited.
4. Mouse movements should be masked in some areas so that authentication codes are not captured, and chatbot conversations should be maskable, since they may reveal sensitive data.

The same Article 82 consent rule underpinned the CNIL's Fnac fine on an app tracker, covered in issue 10.

What the document addresses

Reusing health data, including under the European Health Data Space, relies on secure processing environments, where users work on the data without getting a copy. They may run on third-party infrastructure, which blurs who is actually in control.

The guide's main positions

In a joint guide of 5 November 2026, the two authorities state that:

1. The entity providing the environment must keep real and effective control even when a third party supplies the infrastructure. Contracts and certifications are not enough without technical oversight and a genuine ability to audit.
2. Dependence on a single provider should be avoided where possible, as should concentration of technical control in one third party.
3. Controller, joint controller and processor roles must be assessed and documented. The EHDS assigns some roles itself; the rest belong in contracts or national law.
4. A DPIA is generally required. Under Article 35(3)(b) GDPR it is mandatory where secondary use under the European Health Data Space involves large-scale processing of health data.

What the document addresses

Complaints to the Hamburg supervisory authority (HmbBfDI) rose by 62% in 2025, to 4 220, without a matching rise in staff. Complaint files can hold sensitive data and information about third parties, so, in the authority's words, an AI assistant used on them needs careful design and a clearly defined scope.

The authority's practice

In a case study of 5 November 2026, the authority describes how it uses LLMoin, the Hamburg administration's chatbot built on an OpenAI model, in complaint handling:

1. Staff read the whole file and decide the outcome, the arguments and the type of letter themselves. LLMoin only helps to formulate and structure the letter, which staff then review.
2. Internal rules prohibit automated decision-making, and prompts are designed so that the system makes no legal assessment.
3. Currently, only data with standard confidentiality requirements may be entered. Complaints involving, for example, psychotherapy or criminal proceedings are generally handled by humans alone.
4. LLMoin's system-level safeguards, which the authority reviewed as sufficient, include an output filter, a content filter and rules in the system prompt.

The authority relies on Article 6(1)(e) GDPR, with Hamburg and federal data protection law, as the legal basis. This is its account of its own practice, not a statement of what the law requires.