Court case Case No. 5888-20 – Court Ruling (Sweden, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Swedish court upheld a decision that a school's use of facial recognition to track student attendance violated GDPR. The court agreed that students couldn't give valid consent due to their reliance on school services. This case highlights the importance of considering student privacy and consent in educational settings.
What happened
The Swedish court ruled that using facial recognition for student attendance violated GDPR.
Who was affected
Students at a high school in Skellefteå municipality, whose attendance was tracked using facial recognition, were affected.
What the authority found
The court found that the school board violated GDPR by using facial recognition without a valid legal basis, as students couldn't provide meaningful consent.
Why this matters
This decision underscores the need for schools to carefully assess the privacy implications of using biometric technology. It highlights the importance of obtaining genuine consent, especially when dealing with sensitive data like facial recognition.
GDPR Articles Cited
The Swedish DPA carried out an investigation of the Upper Secondary School Board in Skellefteåmunicipality and its pilot project at a high school that used facial recognition to record student attendance. The cameras installed with this technology use biometric personal data to uniquely identify natural persons. Such biometric personal data qualifies as particularly sensitive personal data (under Article 9 GDPR) concerning children. According to Article 9(1), the processing of such data shall be prohibited. The prohibition does not apply if the data subject consents to the processing of personal data for a specific purpose (Article 9 (2). For a consent to be valid, it must have been given voluntarily. Following an initial decision by the Swedish DPA, holding that the Board had violated the GDPR, the Upper Secondary School Board contended that students and their guardians provided valid consent to use of the facial recognition technology and appealed to the Court of Appeal. Following the appeal, the Court of Appeal in Stockholm upheld the decision of the Swedish DPA. The Upper Secondary School Board appealed the decision to the administrative court but the administrative court dismissed the appeal, finally rendering the decision of the Swedish DPA final. The Swedish DPA (IMY) held that the use of facial recognition technology to register student attendance is in violation with Articles 5, 9, 35 and 36 GDPR. It explained that students cannot provide meaningful consent to such data processing because of their dependence on school services. While there is a legal basis for administering the attendance of students at school, there is no legal basis to perform the task through the processing of sensitive data. The technology amounts to an intrusion of student integrity and is thus disproportionate to the task of measuring attendance. Furthermore, the DPA considered that the risk assessment reported by the Upper Secondary School Board did not meet the requirements o
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case Case No. 5888-20 in SE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case Case No. 5888-20 - Sweden (2021). Retrieved from cookiefines.eu
Last updated: