IMY (Sweden) - DI-2018-21487

IMY (Sweden) - DI-2018-21487
Authority:	IMY (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1) GDPR Article 13 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	21.06.2021
Published:	21.06.2021
Fine:	16000000 SEK
Parties:	n/a
National Case Number/Name:	DI-2018-21487
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Swedish
Original Source:	Integritetsskydsmyndighetens webpage (in SV)
Initial Contributor:	Anton Almer

The Swedish DPA fined the Stockholm Public Transport (SL) €1,565,792 EUR (16 million SEK). It held that SL did not have lawful grounds for processing the personal data of public transport travelers through the use of employee body cameras. Information about data processing by the cameras was not provided to the public, and furthermore, the processing of data by the cameras violated the principle of data minimization.

English Summary

Facts

The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that Stockholm Public Transport (SL) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents, and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA to start an investigation of SL.

The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with Article 6 of the GDPR and if SL provided information about the processing in accordance with Article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with Article 5(1) GDPR.

SL found that the employee body cameras automatically record everything in one minute intervals and then automatically delete the recording afterwards, unless the employee presses the "record" button on the camera. The employees are instructed to keep the camera active during all working hours.

SL provides information about the fact that their employees have body cameras to the public but they do not inform travelers about the fact that, apart from video, the cameras also record sound.

Dispute

Did SL have lawful grounds for processing the personal data of public transport travelers?Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?

Holding

The Swedish DPA (IMY) accepted the stated purpose of the body cameras, but opined that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds.

It also found that the undisclosed recording of sound by the body cameras to be a serious violation because travelers cannot be expected to assume and accept continual eaves-dropping when they travel by public transport. This violation was considered severe because hundreds of thousands of people use the Stockholm public transport system every day.

Ultimately, the DPA (IMY) held that SL violated Article 5(1)(a) and 6(1) of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to Article 13 GDPR. IMY also held that SL violated article 5(1)(c) because they processed more personal data than necessary.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.