The Danish Data Protection Agency has issued serious criticism of Copenhagen Municipality over its use of Microsoft Teams for schoolchildren, three years after a parent filed a complaint.
The agency, Datatilsynet, has now reached a decision in the case, DR reported on September 15, 2026. According to the decision, Copenhagen Municipality receives serious criticism, the formal wording used by the agency.
The case began in 2023, when Datatilsynet received a complaint from a parent of children at a public school in Copenhagen. As DR reports, the agency chose to take up the complaint and open the case.
The complaint concerned how pupil information was exposed on the platform. All pupils and staff in the municipality’s Children and Youth Administration could see children’s full names, school and year group on Teams. External users of the chat platform could also contact the children if they knew their username.
Threats sent through the school platform
At the time, DR reported on a nine-year-old boy at Guldberg Skole in Nørrebro who received threats of violence through the school’s Teams system. The messages came from an older pupil at a different school in Copenhagen.
The parent behind the complaint is Henrik Eskelund. He first contacted Copenhagen Municipality and then sent his complaint to Datatilsynet, and he told DR that he is glad a decision has finally been made.
Per DR’s reporting, Eskelund said it is regrettable that a parent has to contact Datatilsynet to close a gap that is obviously a security risk. He raised the issue with the municipality before turning to the authority.
In its decision, Datatilsynet also urges Copenhagen Municipality to review the portfolio of IT services used in its schools. The agency did not name specific replacements for the services now in use.
DR stated that it is working to obtain a comment from Jakob Næsager of the Conservative People’s Party, who is children and youth mayor in Copenhagen Municipality. The municipality had not commented on the decision in DR’s report.
Datatilsounet is the Danish authority that supervises compliance with data protection rules, including the EU’s General Data Protection Regulation. According to DR, the agency said it was not able to give an interview about the case.
The decision closes a case that ran for roughly three years, from the 2023 complaint to the ruling published in September 2026. Copenhagen Municipality’s Children and Youth Administration runs the public schools covered by the case.
Datatilsynet’s criticism is a formal reprimand and is not accompanied by a fine in the decision described by DR. The agency’s recommendation on reviewing school IT services applies to the municipality’s wider portfolio.
