Swedish Authority for Privacy Protection (IMY) — Skelleftea Municipality Upper Secondary Board

Decided by

IMY

Parties

IMY v. Gymnasienämnden i Skellefteå kommun

Decision date

August 20, 2019

Remedy

The Swedish Authority for Privacy Protection imposed an administrative fine of 200,000 SEK on the school board.

Amount

SEK 200,000

Appeal

Affirmed on appeal

Key holdings

1. IMY imposed an administrative fine of 200,000 SEK on a school board that used camera-based facial recognition to record student attendance.

   “IMY utfärdar en sanktionsavgift på 200 000 kronor för en skola som under en period använt ansiktsigenkänning via kamera för att registrera elevers närvaro.” — Sammanfattning

2. The Administrative Court in Stockholm dismissed the school board's appeal on 14 August 2020.

   “Förvaltningsrätten i Stockholm avslår överklagan, 14 augusti 2020.” — Ärendehistorik

3. The Supreme Administrative Court denied leave to appeal, rendering IMY's decision final and legally binding.

   “Högsta förvaltningsdomstolen lämnar inte prövningstillstånd. Kammarrättens avgörande står fast och IMY:s beslut har vunnit laga kraft.” — Beslutet har vunnit laga kraft

In plain English

The Swedish Authority for Privacy Protection, IMY, conducted an audit into Gymnasienämnden i Skellefteå kommun regarding its use of camera technology in an educational environment. The upper secondary school board had deployed facial recognition software via cameras over a period to register student attendance at a high school. On 20 August 2019, IMY concluded that this processing of biometric data violated data protection regulations and issued an administrative fine of 200 000 kronor against the municipality board. Following the decision, the school board challenged the fine and ruling in court. The Administrative Court in Stockholm dismissed the appeal on 14 August 2020. The decision was further appealed to the Administrative Court of Appeal in Stockholm under case number 5888-20, which also rejected the appeal. Finally, the Supreme Administrative Court declined to grant leave to appeal, affirming the previous judgments. On 6 May 2021, IMY updated the case status confirming that its original decision had gained legal force and was final. This case represents a landmark enforcement action concerning biometric surveillance and facial recognition in European schools under general data protection rules. It highlights strict limitations on using sensitive personal data and automated monitoring on students, confirming that biometric attendance tracking requires clear lawful justification and cannot rely on invalid consent dynamics in public education.