A school in northern Sweden has conducted a pilot using facial recognition to keep track of students' attendance in school. The test run was conducted in one school class for a limited period of time.
The Swedish DPA concluded that the test violates several articles in GDPR and has imposed a fine on the municipality of approximately 20 000 euros. In Sweden public authorities can receive a maximum fine of 10 million SEK (approximately 1 million euros). This is the first fine issued by the Swedish DPA.
The school has processed sensitive biometric data unlawfully and failed to do an adequate impact assessment including seeking prior consultation with the Swedish DPA.
The school has based the processing on consent but the Swedish DPA considers that consent was not a valid legal basis given the clear imbalance between the data subject and the controller.
More news on this topic
-
Data protection officers point to problems applying GDPR
31 January 2023 -
Administrative fine against Klarna after investigation
31 March 2022 -
Administrative fine to the Swedish Customs for deficient routines
16 March 2022 -
Administrative fine against Region Uppsala for breaches in its security
18 February 2022
More news on this topic
-
Data protection officers point to problems applying GDPR
31 January 2023 -
Administrative fine against Klarna after investigation
31 March 2022 -
Administrative fine to the Swedish Customs for deficient routines
16 March 2022 -
Administrative fine against Region Uppsala for breaches in its security
18 February 2022