Exception for public institution
In addition to the conditions mentioned in Article 6 of the GDPR, the DPA states that public institutions may not rely on legitimate interest.
In Denmark, the age at which a child can provide a valid consent is reduced to 13 years old (DPA Section 6(3)). If the child is under 13, the processing is lawful only if and to the extent the holder of parental responsibility for the child consents (DPA Section 6(3)).
The Data Protection Agency has published a guideline on consent (in Danish): https://www.datatilsynet.dk/media/6562/samtykke.pdf