GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition Decision

Regulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 25 May 2018.

A biometric privacy rule binding public and private bodies.

As of 24 August 2026.

What it requires

Do not deploy a facial-recognition or fingerprint attendance-tracking system for a person in Sweden on consent alone; IMY treats employer consent as generally invalid given the employment power imbalance and fined the Skelleftea school board for exactly this processing.
Obtain a General Data Protection Regulation (GDPR) Article 9(2) basis, and expect weighty grounds plus a data protection impact assessment to be required, before deploying a biometric identification system in Sweden.

What it reaches

Excludes recording-derived identifiersNo

Who checks it

Audit expectation

continuous

Who audits it

Self

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

General Data Protection Regulation (GDPR) Article 9 special categories apply directly; Dataskyddslagen Chapter 3 supplies domestic legal bases letting a public authority process sensitive data for employment-law or important-public-interest purposes, confirmed against the chapter, with no biometric-specific definition or carve-out.

IMY's landmark biometric decision, Di-2019-2221 (20 August 2019, verified from IMY's own decision list), fined the Skelleftea municipal school board 200,000 SEK for using facial-recognition cameras to register student attendance, finding the processing violated Article 9 (no valid legal basis) and Article 5 (data minimization).

IMY's current guidance cites this decision for the rule that biometric attendance tracking is, as a rule, not permitted, and that employer consent is generally not a valid basis given the power imbalance in an employment relationship. No dedicated IMY guidance or enforcement on voiceprints specifically was found in the pages checked.

When LexLint raises it

processes_biometrics
processes_voice

Read the law

Dataskyddslagen ch. 3
IMY decision Di-2019-2221 and IMY workplace-biometrics guidance

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app