Exception for public institution

In addition to the conditions mentioned in Article 6 of the GDPR, the DPA states that public institutions may not rely on legitimate interest.

Children’s consent

In Denmark, the age at which a child can provide a valid consent is reduced to 13 years old (DPA Section 6(3)). If the child is under 13, the processing is lawful only if and to the extent the holder of parental responsibility for the child consents (DPA Section 6(3)).

Guidelines

The Data Protection Agency has published a guideline on consent (in Danish): https://www.datatilsynet.dk/media/6562/samtykke.pdf