DPA case 2025-10429 – Violation Found (Sweden, 2026)

A security services company (the controller) had installed cameras in its patrol vehicles that filmed the drivers (the data subjects) during their shifts. The video surveillance was part of a temporary pilot project that was conducted in December 2024 as well as April and May 2025. The surveillance technology was installed in around 50 cars and affected 119 drivers. The technology was meant to detect certain potentially dangerous behaviours of the driver, such as not wearing a seat belt or using a cell phone. The most recent 100 hours of the footage were stored on local memory cards in the cars. If especially risky behaviour was detected, short video clips or still images were stored for 90 days. The supervisory authority launched an investigation into this practice to determine whether it had a legal basis for the processing of personal data of the drivers. The DPA also investigated whether the controller had ensured an appropriate level of security in accordance with Article 32(1) GDPR when storing the personal data collected. The controller relied on Articles 6(1)(c) and 6(1)(f) GDPR as legal bases. First, the controller argued that it had a legal obligation to guarantee a safe work environment and eliminate risks under national legislation on employee safety. Second, the controller relied on its legitimate interests to minimise damage, investigate alleged misconduct, and protect itself against disputes with insurance companies. The DPA issued the controller a reprimand under Article 58(2)(b) GDPR and held that there had been no legal basis under Article 6(1) GDPR for filming the data subjects during their shifts. First, the DPA held that the processing of personal data could not be based on Article 6(1)(c) GDPR. According to the DPA, the processing was of sensitive nature as it involved the real-time monitoring of employees. It stated that the provisions the controller relied on were not sufficiently clear and precise to constitute a legal obligation withi