SwedenGDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition Decision
Regulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Do not deploy a facial-recognition or fingerprint attendance-tracking system for a person in Sweden on consent alone; IMY treats employer consent as generally invalid given the employment power imbalance.NIST Privacy FrameworkCT.PO-P1
- Obtain a General Data Protection Regulation (GDPR) Article 9(2) basis, with weighty grounds, and complete a data protection impact assessment before deploying a biometric identification system in Sweden.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text. Also read by: Integritetsskyddsmyndigheten (IMY) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.imy.se/verksamhet/dataskydd/dataskydd-pa-olika-omraden/arbetsliv/biometri/
- Guidance body
- Integritetsskyddsmyndigheten (IMY)
- Open questions
- What are the weighty reasons ('tungt vägande skäl') that allow an employer to process biometric data to identify employees uniquely under Article 9 of the GDPR, beyond the statement that security reasons outweigh efficiency reasons?
What it makes you log
Logging duty
Article 9 and chapter 3 of Dataskyddslagen set when sensitive data, biometric data included, may be processed and to whom they may be disclosed. They state no duty to create, keep or produce a log or record. The impact assessment that IMY's guidance asks an employer to consider before a biometric system arises under Article 35, which this row does not cite; it is an assessment before processing, with no cadence and no power to demand it.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9 special categories apply directly; Dataskyddslagen chapter 3 supplies domestic legal bases for processing sensitive data to meet employment-law and social-security duties, which any controller may use (section 2), and for a public authority to process it for an important public interest (section 3), with no biometric-specific definition or carve-out.
IMY's landmark biometric decision, Di-2019-2221 (), fined the Skelleftea municipal school board 200,000 SEK for using facial-recognition cameras to register student attendance, finding the processing violated Article 9 (no valid legal basis) and Article 5 (data minimization).
IMY's current guidance cites this decision for the rule that biometric attendance tracking is, as a rule, not permitted, and that employer consent is generally not a valid basis given the power imbalance in an employment relationship.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .