Swedish Authority for Privacy Protection (IMY) — Swedish Police Authority
IMY imposed an administrative fine on the Swedish Police Authority for unlawfully processing biometric data for facial recognition using Clearview AI, failing to conduct a data protection impact assessment. The Police were also ordered to inform data subjects and ensure data erasure.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Swedish Authority for Privacy Protection
- Parties
- Swedish Authority for Privacy Protection v. Swedish Police Authority
- Decision date
- February 11, 2021
- Remedy
- IMY imposed an administrative fine of SEK 2,500,000, ordered employee training, required notification to data subjects where allowed, and ordered the police to ensure to the extent possible that transferred data is erased.
- Amount
- SEK 2,500,000
- Appeal
- Appeal status not stated
Key holdings
The Swedish Police Authority breached the Criminal Data Act by using Clearview AI to identify individuals without authorization.
“the Swedish Police Authority has processed personal data in breach of the Swedish Criminal Data Act when using Clearview AI to identify individuals.”
The police unlawfully processed biometric data for facial recognition without conducting a mandatory data protection impact assessment.
“When using Clearview AI the Police has unlawfully processed biometric data for facial recognition”
IMY imposed an administrative fine on the police authority for its data protection infringements.
“IMY imposes an administrative fine of SEK 2,500,000 (approximately EUR 250,000) on the Police Authority for infringements of the Criminal Data Act.”
The police must attempt to erase any personal data that was transferred to Clearview AI.
“the Police are ordered to ensure, to the extent possible, that any personal data transferred to Clearview AI is erased.”
In plain English
The Swedish Authority for Privacy Protection (IMY) conducted an investigation into the Swedish Police Authority after media reports revealed that police employees were using the facial recognition application Clearview AI to identify individuals. IMY found that the police processed personal data in breach of the Swedish Criminal Data Act because several employees used Clearview AI without authorization or prior approval. In using the app, the police unlawfully processed biometric data for facial recognition and failed to carry out a mandatory data protection impact assessment. Additionally, the police failed to implement adequate organizational measures to ensure compliance with legal requirements governing law enforcement data processing. As a result of these infringements, IMY imposed an administrative fine of SEK 2,500,000 on the Swedish Police Authority. IMY also issued corrective orders requiring the police authority to provide further training and education to its personnel to prevent future unauthorized data processing. Furthermore, the police must notify affected individuals whose personal data was shared with Clearview AI, provided confidentiality regulations allow for such disclosure, and must take steps to ensure, to the extent possible, that all personal data transferred to Clearview AI is deleted.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.