fineConcludedSEK 200,000
Swedish Authority for Privacy Protection (IMY) — Skelleftea Municipality Upper Secondary Board
August 20, 2019 · Sweden
In Europe's first GDPR facial-recognition fine, IMY fined the Skelleftea school board SEK 200,000 for a trial using facial recognition to register 22 students' attendance, finding it processed sensitive biometric data unlawfully and that consent was invalid given the students' dependent position.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.