IMY (Sweden) - DI-2018-21487
| IMY (Sweden) - DI-2018-21487 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1) GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 21.06.2021 |
| Published: | 21.06.2021 |
| Fine: | 16000000 SEK |
| Parties: | n/a |
| National Case Number/Name: | DI-2018-21487 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Swedish |
| Original Source: | Integritetsskydsmyndighetens webpage (in SV) |
| Initial Contributor: | Anton Almer |
The Swedish DPA fined Stockholm Public Transport (SL) €1,565,792 EUR (16 million SEK) because 1) they did not have lawful grounds for processing the personal data of public transport travelers which they obtained through the use of employee body cameras, 2) information about data processing by the cameras was not provided to the public, and 3) the processing of data by the cameras violated the principle of data minimization.
English Summary
Facts
The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that Stockholm Public Transport (SL) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents, and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA to start an investigation of SL.
The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with Article 6 of the GDPR and if SL provided information about the processing in accordance with Article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with Article 5(1) GDPR.
SL found that the employee body cameras automatically record everything in one minute intervals and then automatically delete the recording afterwards, unless the employee presses the "record" button on the camera. The employees are instructed to keep the camera active during all working hours.
SL provides information about the fact that their employees have body cameras to the public but they do not inform travelers about the fact that, apart from video, the cameras also record sound.
Dispute
Did SL have lawful grounds for processing the personal data of public transport travelers?Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?
Holding
The Swedish DPA (IMY) accepted the stated purpose of the body cameras, but opined that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds.
It also found that the undisclosed recording of sound by the body cameras to be a serious violation because travelers cannot be expected to assume and accept continual eaves-dropping when they travel by public transport. This violation was considered severe because hundreds of thousands of people use the Stockholm public transport system every day.
Ultimately, the DPA (IMY) held that SL violated Article 5(1)(a) and 6(1) of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to Article 13 GDPR. IMY also held that SL violated article 5(1)(c) because they processed more personal data than necessary.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
