On July 10, 2024, the Danish data protection authority (Datatilsynet) published the results of its assessment of 53 municipalities' compliance with its decision in Case No. 2023-431-0001, where it ordered the municipalities to bring their processing into compliance with the General Data Protection Regulation (GDPR).

In particular, the Datatilsynet highlighted that the Local Government Denmark (KL) stated, on behalf of the 53 municipalities, that from August 1, 2024, they will no longer share children's personal data with Google. More specifically, the Datatilsynet outlined that there have been amendments to the contract between the municipalities and Google, ensuring that personal data will only be processed in accordance with the instructions of the municipality responsible for the data, subject to legal exceptions.

In addition, the Datatilsynet noted that the KL stated they will refrain from using services where the processing of personal data takes place in third countries where there is no essentially equivalent protection for data subjects' rights.

Finally, the Datatilsynet clarified that it has requested an opinion from the European Data Protection Supervisor (EDPS) on, among other things, the scope of the data controller's documentation obligations for the data processor's use of sub-processors. Only when the EDPS opinion is available, will the Datatilsynet make a final assessment of the 53 municipalities' use of Google products.

You can read the press release here and the KL letter here, both only available in Danish.