IMY (Sweden) - DI-2018-21487
| IMY (Sweden) - DI-2018-21487 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1) GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 21.06.2021 |
| Published: | 21.06.2021 |
| Fine: | 16000000 SEK |
| Parties: | n/a |
| National Case Number/Name: | DI-2018-21487 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Swedish |
| Original Source: | Integritetsskydsmyndighetens webpage (in SV) |
| Initial Contributor: | Anton Almer |
SL (Stockholm Public Transport) was fined 16 million SEK (1 565 792 EUR) by the Swedish DPA because the employees use of body cameras was without lawful ground for processing, and because the company did not provide enough information about the processing. SL was also found to violate the principle of data minimisation.
English Summary
Facts
The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that SL (Stockholm Public Transport) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA starting an investigation against SL.
The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with article 6 of the GDPR and if SL provided information about the processing in accordance with article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with article 5.1.
The employees body cameras automatically record everything in 1 minute intervals and the recording is automatically deleted afterwards, unless the employee press the "record" button on the camera. The employees are instructed to keep the camera active during all working hours. IMY accepts the purpose of the body camera, but is of the opinion that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds. SL do provide information about the fact that their employees have body cameras but they do not inform the travelers about the fact that, apart from video, the cameras also record sound. IMY found this to be a serious violation because the travelers can not be expected to assume and accept continual eaves-dropping when they travel by public transport. The violations were also considered severe because hundreds of thousands of people use the Stockholm public transport system everyday.
Dispute
Did SL have lawful grounds for processing the personal data of public transport travelers? Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?
Holding
The DPA (IMY) held that SL violated article 5.1(a) and 6.1 of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to article 13. IMY also held that SL violated article 5.1(c) abecause they processed more personal data than necessary.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
