Skellefteå High School Facial-Recognition Attendance Trial — Sweden's First GDPR Fine for Biometric Monitoring of Students

In autumn 2018, the Upper Secondary School Board in Skellefteå Municipality, northern Sweden, ran a three-week pilot using facial-recognition cameras to automatically register the attendance of 22 students in one class, aiming to reduce the administrative burden of manual roll-calls.

Sweden's data protection authority, Integritetsskyddsmyndigheten (IMY, formerly Datainspektionen), investigated the trial.

On 20 August 2019, IMY fined the school board SEK 200,000 (about €20,000) — the first sanction issued in Sweden since the GDPR took effect in 2018 — finding three separate violations: processing personal data more invasively than necessary for the stated purpose (Article 5), processing sensitive biometric data without a valid legal basis (Article 9), and failing to carry out a data protection impact assessment or prior consultation with IMY (Articles 35-36). IMY also rejected consent as a legal basis, since students were in a position of dependency relative to the school.

The school board appealed, but the Administrative Court of Appeal in Stockholm upheld IMY's decision in full. The case remains Sweden's reference precedent for biometric monitoring of minors, republished by the European Data Protection Board and analysed by bodies such as IAPP. The trial itself was discontinued; no comparable facial-recognition attendance system has since been deployed in Swedish schools.