Camera surveillance during daytime is justified at Swedish school to prevent fires

Background information

• Date of decision: 3 October 2023
• Cross-border case or national case: Cross-border case
• Controller: The Board of Education in the City of Stockholm, Sweden
• Legal references: Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject)
• Decision: Administrative fine, Compliance order
• Key words: Data security, Education, Children, CCTV

Summary of the Decision

Origin of the case

The IMY's review was initiated as a result of complaints which claimed that Aspudden's school, which belongs to the City of Stockholm, conducts comprehensive camera surveillance in large parts of the school and that no information about the camera surveillance has been provided to guardians and students.

Key Findings

The review shows that there are approximately 50 fixed cameras in the school. The cameras monitor hallways, stairwells and corridors in conjunction with doors, toilets and student lockers and are installed in large parts of the school. Surveillance was taking place 24/7 with image recording.

IMY considered that the national provision, identified by the controller as legal support, was not sufficiently clear and precise to form the basis for the processing of personal data pursuant to Article 6(1)(c) of the GDPR. However, the national legal regulation may form the basis for the processing under Article 6(1)(e) GDPR.

IMY concluded that fires are serious and can pose a threat to life and health, which IMY believe in this case can justify camera surveillance of certain areas. Camera surveillance of children is always sensitive to privacy, especially since the school is a place where they are obliged to stay as a compulsory schooling. It is therefore important not to casually have camera surveillance throughout the school, around the clock.

IMY concluded that camera surveillance may be permitted in a school, but it is important to document what has happened and investigate whether other measures are sufficient. In this case, IMY considered that all other camera surveillance, in the way it was carried out, was more intrusive and wider than was necessary to carry out the task in question in the public interest.

Decision

IMY criticises the school for the choice of legal basis for the camera surveillance, that all camera surveillance took place around the clock and that the cameras' recording area was not limited but filmed too large areas for the purposes.

All in all, the deficiencies found mean that IMY issues an administrative sanction fee of SEK 800,000 (approximately 67 950 EUR) against the Board of Education in the City of Stockholm. IMY instructs the school to limit the camera surveillance during the day and also presents views on how the school should inform about the camera surveillance that takes place.

For further information:

• Utbildningsnämnden i Stockholms stad – Aspuddens skola