IMY (Sweden) - DI-2018-21487: Difference between revisions

Revision as of 13:08, 22 June 2021

IMY (Sweden) - DI-2018-21487

Authority:	IMY (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1) GDPR Article 13 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	21.06.2021
Published:	21.06.2021
Fine:	16000000 SEK
Parties:	n/a
National Case Number/Name:	DI-2018-21487
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Swedish
Original Source:	Integritetsskydsmyndighetens webpage (in SV)
Initial Contributor:	Anton Almer

The Swedish DPA fined Stockholm Public Transport (SL) €1,565,792 EUR (16 million SEK) because 1) they did not have lawful grounds for processing the personal data of public transport travelers which they obtained through the use of employee body cameras, 2) information about data processing by the cameras was not provided to the public, and 3) the processing of data by the cameras violated the principle of data minimization.

English Summary

Facts

The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that Stockholm Public Transport (SL) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents, and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA to start an investigation of SL.

The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with Article 6 of the GDPR and if SL provided information about the processing in accordance with Article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with Article 5(1) GDPR.

SL found that the employee body cameras automatically record everything in one minute intervals and then automatically delete the recording afterwards, unless the employee presses the "record" button on the camera. The employees are instructed to keep the camera active during all working hours.

SL provides information about the fact that their employees have body cameras to the public but they do not inform travelers about the fact that, apart from video, the cameras also record sound.

Dispute

Did SL have lawful grounds for processing the personal data of public transport travelers?Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?

Holding

The Swedish DPA (IMY) accepted the stated purpose of the body cameras, but opined that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds.

It also found that the undisclosed recording of sound by the body cameras to be a serious violation because travelers cannot be expected to assume and accept continual eaves-dropping when they travel by public transport. This violation was considered severe because hundreds of thousands of people use the Stockholm public transport system every day.

Ultimately, the DPA (IMY) held that SL violated Article 5(1)(a) and 6(1) of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to Article 13 GDPR. IMY also held that SL violated article 5(1)(c) because they processed more personal data than necessary.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

@@ Line 54: / Line 54: @@
 }}
-SL (Stockholm Public Transport) was fined 16 million SEK (1 565 792 EUR) by the Swedish DPA because the employees use of body cameras was without lawful ground for processing, and because the company did not provide enough information about the processing. SL was also found to violate the principle of data minimisation.
+The Swedish DPA fined Stockholm Public Transport (SL) €1,565,792 EUR (16 million SEK) because 1) they did not have lawful grounds for processing the personal data of public transport travelers which they obtained through the use of employee body cameras, 2) information about data processing by the cameras was not provided to the public, and 3) the processing of data by the cameras violated the principle of data minimization.
 == English Summary ==
 === Facts ===
-The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that SL (Stockholm Public Transport) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA starting an investigation against SL.
+The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that Stockholm Public Transport (SL) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents, and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA to start an investigation of SL.
-The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with article 6 of the GDPR and if SL provided information about the processing in accordance with article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with article 5.1.
+The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with Article 6 of the GDPR and if SL provided information about the processing in accordance with Article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with Article 5(1) GDPR.
-The employees body cameras automatically record everything in 1 minute intervals and the recording is automatically deleted afterwards, unless the employee press the "record" button on the camera. The employees are instructed to keep the camera active during all working hours. IMY accepts the purpose of the body camera, but is of the opinion that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds. SL do provide information about the fact that their employees have body cameras but they do not inform the travelers about the fact that, apart from video, the cameras also record sound. IMY found this to be a serious violation because the travelers can not be expected to assume and accept continual eaves-dropping when they travel by public transport. The violations were also considered severe because hundreds of thousands of people use the Stockholm public transport system everyday.
+SL found that the employee body cameras automatically record everything in one minute intervals and then automatically delete the recording afterwards, unless the employee presses the "record" button on the camera. The employees are instructed to keep the camera active during all working hours.
+SL provides information about the fact that their employees have body cameras to the public but they do not inform travelers about the fact that, apart from video, the cameras also record sound.
 === Dispute ===
-Did SL have lawful grounds for processing the personal data of public transport travelers?
+Did SL have lawful grounds for processing the personal data of public transport travelers?Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?
-Did SL provide enough information about the processing of the personal data of public transport travelers?
-Did SL follow the principles of lawfulness and transparency?
 === Holding ===
-The DPA (IMY) held that SL violated article 5.1(a) and 6.1 of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to article 13. IMY also held that SL violated article 5.1(c) abecause they processed more personal data than necessary.
+The Swedish DPA (IMY) accepted the stated purpose of the body cameras, but opined that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds.
+It also found that the undisclosed recording of sound by the body cameras to be a serious violation because travelers cannot be expected to assume and accept continual eaves-dropping when they travel by public transport. This violation was considered severe because hundreds of thousands of people use the Stockholm public transport system every day.
+Ultimately, the DPA (IMY) held that SL violated Article 5(1)(a) and 6(1) of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to Article 13 GDPR. IMY also held that SL violated article 5(1)(c) because they processed more personal data than necessary.
 == Comment ==