The Swedish Migration Agency – Violation Found (Sweden, 2021)

The Visa Information System (VIS) is an EU database containing information, including biometrics, on visa applications by third country nationals requiring a visa to enter the Schengen area. The purpose and usage of the VIS database is regulated by Regulation (EC) 767/2008 of 9 July 2008. The Swedish Migration Agency (the Agency) is the Swedish competent authority for VIS which means that they are able to enter, amend, delete or consult data in the VIS database. This also means that the Swedish Migration Agency is the controller of personal information in the "Swedish part" of the database. Against this background, the Swedish DPA (IMY) conducted an inspection of how the Agency was processing personal data in the Swedish part of the VIS database. Although no fine was imposed, the IMY issued warnings concerning the status of the IT-documentation and the lack of routines for deleting user logs. The IMY issued two warnings in accordance with Article 58(2)(a) GDPR. The first warning relates to how the Agency was at risk of not being able to fulfill its obligations pertaining to Article 32 GDPR (security of personal data) because it is not clear if the IT-documentation of the VIS database was adopted by the Agency or not. The second warning relates to how the Agency was at risk of not being able to fulfill its obligations pertaining to Article 5(1)(e) GDPR (principle of storage limitation) because they did not have clear routines for deleting user logs in the VIS database.