IMY (Sweden) - IMY-2025-11828
| IMY - IMY-2025-11828 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 22 GDPR Article 58 GDPR |
| Type: | Investigation |
| Outcome: | No Violation Found |
| Started: | |
| Decided: | 18.11.2025 |
| Published: | 18.11.2025 |
| Fine: | n/a |
| Parties: | Swedish Social Insurance Agency (SSIA) |
| National Case Number/Name: | IMY-2025-11828 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Swedish |
| Original Source: | IMY (in SV) |
| Initial Contributor: | xz |
The DPA closed its investigation of the Swedish Social Insurance Agency’s use of risk profiles based on machine learning since the agency already stopped the processing.
English Summary
Facts
In June 2025, the Swedish Data Protection Authority (IMY) began inspecting the Swedish Social Insurance Agency (SSIA). The inspection aimed to examine how the SSIA processes personal data when using risk-based selection for targeted checks on individuals receiving temporary parental benefits. IMY specifically investigated the use of any AI or machine learning systems in these selection checks.
In response, SSIA stated that it had previously used a machine learning-based risk profile but had discontinued it over a month prior. SSIA also indicated that it had no plans to reinstate the risk profile in the processing.
Holding
IMY concluded that since the machine learning-based processing had ceased and there were no plans to reinstate it, there were no grounds for further investigation. The case was therefore closed.
Comment
It is interesting that IMY closed the case entirely simply because the machine learning-based processing had stopped, without conducting any examination of whether the agency’s prior practices had complied with GDPR requirements.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Initiated Step 1 of 3 Ongoing Step 2 of 3 Decision Step 3 of 3, Active Step 3 of 3 in the supervision process Decision In June 2025, the Swedish Privacy Authority (IMY) initiated supervision of Försäkringskassan to investigate how they process personal data in the work with risk-based selections for targeted checks against individuals within compensation for temporary parental benefit (VAB compensation). The supervision also applied to whether the processing is compatible with the Data Protection Regulation and regulations supplementing the Data Protection Regulation. Within the framework of the supervision, IMY has requested information about the current processing, in particular with regard to how a possible AI system is used in the work with selection checks. In the Social Insurance Agency's response to IMY, which was received on 5 September 2025, it was stated that the Social Insurance Agency had used a machine learning-based risk profile within the framework of the current work, but that this was taken out of use a little over a month before the date of the Social Insurance Agency's response. The Social Insurance Agency has further stated that the authority currently has no plans to take the previous risk profile into use again within the above-mentioned processing. Against this background, IMY assesses that there is no reason to conduct further investigation into the case and the case is being closed.
