Sweden's Data Protection Authority fined the Skelleftea municipality 200,000 Swedish Krona for illegally tracking 22 students over three weeks and detecting when each pupil entered a classroom.

According to Swedish state broadcaster SVT Nyheter, Skelleftea municipality said they thought facial recognition technology would save teachers 17,280 hours a year reporting student attendance.

The regulator ruled that although the school had secured parents' consent to monitor the students, it felt it was a legally disproportionate reason to collect such sensitive personal data, and that students could be expected to have a sense of privacy when they entered a classroom.

The DPA also said the managers of the project had failed to do a proper impact assessment, which should have led to consulting the authority due to the risks involved. 

Legal, regulatory 👩🏼‍⚖️

• Swedish Data Protection Authority (2019). Supervision pursuant to the General Data Protection Regulation (EU) 2016/679 – facial recognition used to monitor the attendance of students

• European Data Protection Board (2019). Facial recognition in school renders Sweden’s first GDPR fine

News, commentary, analysis 🗞️

• https://www.bbc.co.uk/news/technology-49489154

• https://www.telecompaper.com/news/tieto-trials-school-class-registration-using-tags-apps-and-facial-recognition-in-swedish-school--1276299

• https://www.forbes.com/sites/forrester/2019/10/11/a-lesson-on-facial-recognition-privacy-and-gdpr-from-the-far-north/

• https://computersweden.idg.se/2.2683/1.715020/ansiktsigenkanning-skola-datainspektionen?

• https://www.svt.se/nyheter/lokalt/vasterbotten/skolans-ovanliga-test-registrerar-elevernas-narvaro-med-kamera

• https://www.bloomberg.com/opinion/articles/2019-09-11/europe-shouldn-t-use-security-to-justify-facial-recognition