Authorization for municipalities to use the AI profiling Summary The Danish Data Protection Agency’s The Danish Data Protection Authority (DPA) was asked decision by the Danish Agency for Labor Market and Recruitment The Danish DPA assessed that in connection with the (STAR) to evaluate the legal basis for municipalities, use of the Asta tool, the municipalities’ legal basis including job centers, to use an AI profiling tool called for processing personal data would be GDPR, Article Asta. 6(1)(e), which requires implementation in national Asta used statistical methods and machine learning legislation, and Article 9(2)(g) if special categories of analysis to determine the risk that a recently personal data are also processed, such as health data unemployed citizen’s contact with the job center would about the citizens in question. be prolonged. Based on anonymized historical data Our remarks on the most recent years’ unemployment benefits cases to construct personal characteristics and show • Valid consent requires that it is given voluntarily. In the correlation between approximately 50 variable a situation where a municipality (job center) is the characteristics and the duration of contact with the job data controller and an unemployed citizen is the center. data subject, the power imbalance between the The characteristics included information from the parties is considered too great for consent to be citizen’s CV, such as language skills and job history, as given voluntarily. well as details such as gender, age, interpreter need • The lawful use of a profiling tool such as Asta and previous contact processes. requires the existence of a legal basis under The Danish DPA examined whether citizens’ consent national or EU law that foresees the processing of under GDPR, Article 6(1)(a) could constitute a data subjects’ data. The requirements for clarity of lawful basis for processing when using the tool but this legal basis depend on the intrusiveness of the determined that this was not the case. Instead, the DPA tool. In addition, it is still possible that processing concluded that GDPR, Article 6(1)(e) which addressed based on such a legal basis would require the the use of public authority could constitute the lawful individual data subject’s consent for the tool to be basis for processing. However, this legal basis is subject used in his or her case. to several requirements, including that the processing must be foreseen in EU law or national law. The stricter requirements for a national legal basis apply to more intrusive the processing activities. Published: 18-05-2022 Journal number: 2022-212-3676 Tags: 01 Legal basis for processing and principles for processing 119