{"id":47061,"date":"2019-08-28T04:09:05","date_gmt":"2019-08-28T02:09:05","guid":{"rendered":"https:\/\/www.rudebaguette.com\/?p=47061"},"modified":"2019-08-28T04:11:59","modified_gmt":"2019-08-28T02:11:59","slug":"sweden-faces-first-gdpr-fine-against-a-high-school-that-used-facial-recognition-to-check-attendance","status":"publish","type":"post","link":"https:\/\/www.rudebaguette.com\/en\/2019\/08\/sweden-faces-first-gdpr-fine-against-a-high-school-that-used-facial-recognition-to-check-attendance\/","title":{"rendered":"Sweden issues first GDPR fine, against a high school that used facial recognition to check attendance"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A Swedish municipality has been fined for trialing facial recognition in a high school to track student attendance, in Sweden\u2019s first fine under the EU\u2019s General Data Protection Regulation (GDPR) data privacy rules,&nbsp;<a href=\"https:\/\/www.bbc.com\/news\/technology-49489154\" target=\"_blank\" rel=\"noopener\">according to BBC News<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Skelleftea municipality in northern Sweden was fined 200,000 Swedish Krona, or about \u00a316,800, for violating privacy laws.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The trial\u00a0<a href=\"https:\/\/gizmodo.com\/swedens-first-gdpr-fine-goes-to-a-high-school-piloting-1837616893\" target=\"_blank\" rel=\"noopener\">lasted about three weeks<\/a> and included just 22 students, according to Gizmodo. The high school board claimed that the students\u2019 parents had given consent for data collection. However, Sweden\u2019s Data Protection Authority (DPA) found that it was still a violation to collect biometric data, \u201cgiven the clear imbalance between the data subject and the controller,\u201d the European Data Protection Board said Thursday.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ranja Bunni, a lawyer for the DPA, said that consent wasn\u2019t a valid argument since students depend on the board, and also highlighted the fact that there are so many alternatives available for gauging school attendance that are less intrusive and invasive. They argued that students are entitled to a certain expectation of privacy in classrooms.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The agency said the school board had violated portions of the GDPR that set rules on collecting sensitive biometric data, failing to carry out an impact assessment, and failing to gain approval from the DPA before the trial was conducted.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The agency also noted that the fine would have been larger if the trial had been longer. Swedish authorities can issue fines of up to 10 million krona, or about \u00a3840,000, for GDPR violations.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The August 2018 trial was considered successful by the school board at the time, and they considered extending it. School board authorities told a Swedish state broadcaster that teachers had been spending 17,000 hours a year checking attendance, and that they were aiming to streamline the process.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under the GDPR, which came into effect in May of 2018, facial images and biometric data constitute a special category of data, and are subject to additional restrictions. Among the strictest data privacy rules in the world, the GDPR was enacted largely with powerful tech companies in mind\u2014and the fine was miniscule compared with those levied against tech giants like Google or Facebook. A recent fine against British Airways totaled \u00a3183.4 million. But the move does show that regulators are willing to use the laws against public authorities as well.&nbsp;<br><br>Photo by \u00a9 Cody Logan&nbsp;\/&nbsp;Wikimedia Commons&nbsp;\/ Security camera, September 2018<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Swedish municipality has been fined for trialing facial recognition in a high school to track student attendance, in Sweden\u2019s first fine under the EU\u2019s General Data Protection Regulation (GDPR) data privacy rules,&nbsp;according to BBC News. The Skelleftea municipality in northern Sweden was fined 200,000 Swedish Krona, or about \u00a316,800, for violating privacy laws.&nbsp; The<\/p>\n","protected":false},"author":77,"featured_media":47062,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"subtitle":"","footnotes":""},"categories":[113],"tags":[7927,7496],"class_list":["post-47061","post","type-post","status-publish","format-standard","has-post-thumbnail","category-finance","tag-european-union-en-2","tag-personal-data-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts\/47061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/users\/77"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/comments?post=47061"}],"version-history":[{"count":0,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts\/47061\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/media\/47062"}],"wp:attachment":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/media?parent=47061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/categories?post=47061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/tags?post=47061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}