Sweden

IMY fined Region Uppsala after unauthorized staff access to patient records revealed inadequate access reviews and logging controls under GDPR Articles 5, 24 and 32.

IMY investigated digital healthcare provider Kry over excessive employee access to patient records and insufficient logging controls, citing GDPR Articles 5, 24 and 32.

IMY sanctioned the school for retaining student and alumni personal data longer than necessary and for incomplete information notices, implicating GDPR Articles 5, 13 and 14.

IMY fined Apoteket for insufficient access controls around prescription and customer data, finding failures to ensure confidentiality and role-based access under GDPR Articles 5 and 32.

IMY reviewed Swedish employee-data governance following broader H&M workforce monitoring concerns and emphasized purpose limitation, minimization, and lawful basis under GDPR Articles 5 and 6.

IMY sanctioned the Swedish Police Authority for unlawful use of Clearview AI facial recognition searches without prior impact assessment, adequate instructions, or lawful basis, engaging GDPR Articles 5, 6, 35 and law-enforcement data protection rules.

IMY fined Klarna for insufficient transparency in privacy notices, including incomplete information about recipients, retention periods, and data subject rights under GDPR Articles 12, 13 and 14.

IMY imposed sanctions after sensitive call recordings from the healthcare service 1177 were exposed online due to inadequate processor oversight and security controls, raising issues under GDPR Articles 5, 24, 28 and 32.

IMY sanctioned Google for failing to properly comply with delisting requests under the right to erasure and for not adequately informing website operators when search results were removed, implicating GDPR Articles 5, 6, 17 and 19.

IMY fined a Swedish municipality for using facial recognition to monitor student attendance without a valid legal basis and without satisfying necessity and proportionality requirements for biometric processing under GDPR Articles 5, 6, 9 and 35.