Enforcement · Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Schockholm School borard: Non-compliance with general data processing principles

The Swedish DPA has fined the Stockholm School Board EUR 70,000 for excessive video surveillance in a school.

€70,000 Fine
Schockholm School borard
SWEDEN
Art. 5 GDPR Art. 6 GDPR Art. 13 GDPR
Supervisory Authorities Processing Video Surveillance Monitoring Education
Oct 3, 2023 Source imy.se

Full text

The Swedish DPA has fined the Stockholm School Board EUR 70,000 for excessive video surveillance in a school. A school had installed extensive video surveillance due to past problems with incendiary crimes. During its investigation, the DPA found that there were about 50 fixed cameras in the school monitoring hallways, stairwells and corridors in conjunction with doors, toilets and student lockers. Surveillance was taking place 24/7 with image recording. The DPA concluded that video surveillance for the purpose of preventing incendiary crimes is generally permissible, but that the area covered by the cameras must be limited to the absolute necessary areas. According to the DPA, the video surveillance in the school was too wide and not all cameras were necessary to monitor potential fire hazards.

Industry: Public Sector and Education

How it connects

References

Related across sources

42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Administrative Court Berlin Apr 20, 2026 Legitimate Interest Supervisory Authorities Retention Period
C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
Guidelines 3/2018 territorial scope of the GDPR (Article 3) Guidelines on the territorial scope of the GDPR Guidelines ·EDPB Nov 12, 2019 Territorial scope (GDPR) IP Address Processors
T-70/23 Data Protection Commission v European Data Protection Board The Irish Data Protection Commission (DPC) challenged provisions of EDPB Binding Decisions 3/2022, 4/2022, and 5/2022, arguing the EDPB exceeded its competence under Article… General Court ·Tenth Chamber, Extended Composition Jan 29, 2025 Supervision Supervisory Authorities Monitoring
Related documents