Skellefteå High School Facial-Recognition Attendance Trial — Sweden's First GDPR Fine for Biometric Monitoring of Students

In autumn 2018, the Upper Secondary School Board in Skellefteå Municipality, northern Sweden, ran a three-week pilot using facial-recognition cameras to automatically register the attendance of 22 students in one class, aiming to reduce the administrative burden of manual roll-calls.

Sweden's data protection authority, Integritetsskyddsmyndigheten (IMY, formerly Datainspektionen), investigated and on 20 August 2019 fined the school board SEK 200,000 (about €20,000) — the first sanction issued in Sweden since the GDPR took effect in 2018. IMY found three separate violations: processing personal data in a manner more invasive than necessary for the stated purpose (Article 5), processing sensitive biometric data without a valid legal basis (Article 9), and failing to carry out a data protection impact assessment or prior consultation with IMY before the trial (Articles 35-36). The authority also rejected consent as a legal basis, since students were in a position of dependency relative to the school.

The school board appealed, but the Administrative Court of Appeal in Stockholm upheld IMY's decision in full, confirming both the legal reasoning and the fine. The case remains Sweden's reference precedent for biometric monitoring of minors and has been republished by the European Data Protection Board and analysed by international practitioner bodies such as IAPP as a template for how proportionality and consent should be assessed when schools deploy biometric AI systems. The trial itself was discontinued; no comparable facial-recognition attendance system has since been deployed in Swedish schools.

Read the full analysis: https://www.imy.se/globalassets/dokument/beslut/facial-recognition-used-to-monitor-the-attendance-of-students.pdf