News in English

The Swedish Authority for Privacy Protection (IMY) issues an administrative fine of SEK 7,500,000 against Klarna Bank AB after an investigation has shown that the company has not complied with several of the rules in the GDPR.

The Swedish Authority for Privacy Protection (IMY) has investigated a personal data breach within the Swedish Customs and notes that the agency has had deficient routines and insufficient technical barriers, which has led to data from criminal investigations being transferred from staff mobile phones to a US cloud service.

IMY issues an administrative fine of in total SEK 1.9 million against Region Uppsala after finding that the region has not taken appropriate security measures in its handling of sensitive personal data.

The Swedish Authority for Privacy Protection (IMY) has investigated the use of camera surveillance at a number of fire stations in Östra Skaraborg and notes that 24/7 surveillance of the staff is too far-reaching.

The Swedish Authority for Privacy Protection (IMY) concludes that SL, who operate the public transport in Stockholm, has violated GDPR when equipping ticket inspectors with body cameras that record video and sound. The IMY issues an administrative fine against SL of SEK 16 million.

The Swedish Authority for Privacy Protection (IMY) has finalized its investigation of an incident where recorded phone calls to the medical consultation service, 1177, were available unprotected on the Internet.

The Swedish Authority for Privacy Protection finds that the Swedish Police Authority has processed personal data in breach of the Swedish Criminal Data Act when using Clearview AI to identify individuals.

Swedish Authority for Privacy Protection has issued an administrative fine of SEK 300,000 against a housing company for unlawful video surveillance in an apartment building.

Umeå University has processed special categories of personal data concerning sexual life and health through, amongst other, storage in a cloud service, without sufficiently protecting the data. Swedish Authority for Privacy Protection is therefore issuing a fine of SEK 550,000 against the university.

Swedish Authority for Privacy Protection has audited eight health care providers in how they govern and restrict personnel’s access to the main systems for electronic health records. The DPA has discovered insufficiencies that in seven of the eight cases lead to administrative fines of up to SEK 30 million.