Consulate General of Sweden in Istanbul – Violation Found (Sweden, 2025)

The DPA carried out an ex officio investigation of the Consulate General of Sweden in Istanbul (the controller)See Article 3(3) GDPR: "This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law". in order to assess its compliance with the GDPR and other Regulations (the VIS Regulation and the Borders Regulation). During the investigation, the DPA carried out an on-site inspection of the Consulate. The DPA also assessed the operations of VSF Global (the processor), an external provider responsible for transmitting most of the VISA applications received by the Consulate. Applications were collected on the processor’s premises, which included an area reserved for the personnel of the Swedish mission. This area was secured via a biometric locking system that recognized the fingerprints of authorized personnel. The DPA found that access to the reserved area of VSF’s center, was not properly secured. When the biometric system repeatedly failed to capture a high-quality fingerprint image, an officer could override the system and allow the image despite its insufficient quality. In practice, the override window of the system was always open and the officer would allow access without checking why the override was needed in the first place. The DPA held the system to be unsecure. Furthermore, the DPA found that the passports of VISA applicantsSee Article 2(1) GDPR: "This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system". were stored in boxes and placed on the floor. The DPA held that this practice was also insecure and unappropriate, as it would be easy to lose documents. On these grounds, the DPA concluded that the controller violated Articles 28(1) and 32(1) GDPR and ordered the controller to address the shortcomings it found.