Skellefteå school
€19K($20K USD)final
Date Issued
2019-08-20
Regulation
Authority
Data Protection Authority of Sweden
Country
Sweden
Violation Type
Non-compliance with lawful basis for data processing
Currency
EUR
Violation Summary
A school attempted to introduce the use of facial recognition software to facilitate the attendance process of students. The school was ultimately fined because the means used to monitor attendance were disproportionate to the goal itself. Moreover, students and their parents couldn’t freely withdraw consent from being monitored to validate attendance. Furthermore, one case of processing activity presented elevated risks since it involved children dependent on the high-school board. Ultimately, the school didn’t observe Art. 35 of the GDPR.
Articles Violated
Art. 5 (1) c) GDPRArt. 9 GDPRArt. 35 GDPRArt. 36 GDPR