IMY (Sweden) - DI-2018-21487

From GDPRhub
Revision as of 12:29, 21 June 2021 by AntonAlmer (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Sweden |DPA-BG-Color= |DPAlogo=LogoSE.png |DPA_Abbrevation=IMY (Sweden) |DPA_With_Country=IMY (Sweden) |Case_Number_Name=DI-2018-21487 |ECLI=...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
IMY (Sweden) - DI-2018-21487
LogoSE.png
Authority: IMY (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(c) GDPR
Article 6(1) GDPR
Article 13 GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 21.06.2021
Published: 21.06.2021
Fine: 16000000 SEK
Parties: n/a
National Case Number/Name: DI-2018-21487
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): Swedish
Original Source: Integritetsskydsmyndighetens webpage (in SV)
Initial Contributor: Anton Almer

SL (Stockholm Public Transport) was fined 16 million SEK (1 565 792 EUR) by the Swedish DPA because the employees use of body cameras was without lawful ground for processing, and because the company did not provide enough information about the processing. SL was also found to violate the principle of data minimisation.

English Summary

Facts

The Swedish DPA Integritetsskyddsmyndigheten (IMY) was informed, through information in the media, that SL (Stockholm Public Transport) was planning on giving their employees body cameras in order to prevent threatening situations, to better document incidents and to ensure that they issue fines to the correct offender when someone travels without a valid ticket. This information led to the DPA starting an investigation against SL.

The purpose of the investigation was to find out if SL had lawful grounds for processing in accordance with article 6 of the GDPR and if SL provided information about the processing in accordance with article 13 of the GDPR. IMY also investigated if SL followed the principles of lawfulness and transparency in accordance with article 5.1.

The employees body cameras automatically record everything in 1 minute intervals and the recording is automatically deleted afterwards, unless the employee press the "record" button on the camera. The employees are instructed to keep the camera active during all working hours. IMY accepts the purpose of the body camera, but is of the opinion that the duration of the automatic recording needs to be minimised to a maximum of 15 seconds. SL do provide information about the fact that their employees have body cameras but they do not inform the travelers about the fact that, apart from video, the cameras also record sound. IMY found this to be a serious violation because the travelers can not be expected to assume and accept continual eaves-dropping when they travel by public transport. The violations were also considered severe because hundreds of thousands of people use the Stockholm public transport system everyday.

Dispute

Did SL have lawful grounds for processing the personal data of public transport travelers? Did SL provide enough information about the processing of the personal data of public transport travelers? Did SL follow the principles of lawfulness and transparency?

Holding

The DPA (IMY) held that SL violated article 5.1(a) and 6.1 of the GDPR because they did not have lawful grounds for processing the personal data of public transport travelers, which they obtained through the use of body cameras, and that SL did not provide enough information about the processing according to article 13. IMY also held that SL violated article 5.1(c) abecause they processed more personal data than necessary.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.