Sweden issues first GDPR fine for using facial recognition in school

For the first time the Swedish Data Protection Authority (DPA) has fined a municipality around 20,000 Euros for the use of facial recognition technology to monitor attendance of students in a school in northern Sweden. This is the first fine issued by the Swedish DPA.

While the school had obtained consent for processing, the Swedish DPA did “not consider that consent was not a valid legal basis given the clear imbalance between the data subject and the controller.the consent to be a valid legal basis”.