Law note · Sweden
GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition Decision
General Data Protection Regulation (GDPR) Article 9 special categories apply directly; Dataskyddslagen Chapter 3 supplies domestic legal bases letting a public authority process sensitive data for employment-law or important-public-interest purposes, confirmed by reading the chapter directly, with no biometric-specific definition or carve-out.
IMY's landmark biometric decision, Di-2019-2221 (20 August 2019, verified from IMY's own decision list), fined the Skelleftea municipal school board 200,000 SEK for using facial-recognition cameras to register student attendance, finding the processing violated Article 9 (no valid legal basis) and Article 5 (data minimization).
IMY's current guidance cites this decision for the rule that biometric attendance tracking is, as a rule, not permitted, and that employer consent is generally not a valid basis given the power imbalance in an employment relationship. No dedicated IMY guidance or enforcement on voiceprints specifically was found in the pages checked.
What it asks of an app
- Do not deploy a facial-recognition or fingerprint attendance-tracking system for a person in Sweden on consent alone; IMY treats employer consent as generally invalid given the employment power imbalance and fined the Skelleftea school board for exactly this processing.
- Obtain a General Data Protection Regulation (GDPR) Article 9(2) basis, and expect weighty grounds plus a data protection impact assessment to be required, before deploying a biometric identification system in Sweden.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Dataskyddslagen ch. 3 (direct read)
IMY decision Di-2019-2221 and IMY workplace-biometrics guidance (direct fetch)