IMY (Sweden) - 2025-10429
Sweden's IMY reprimands security firm for unlawful employee video surveillance.
IMY (Sweden) has issued a reprimand to a security services company for conducting video surveillance of its patrol car drivers without a valid legal basis under GDPR. The company used cameras in approximately 50 vehicles for a pilot project to detect dangerous driving behaviors, storing footage locally. While the company cited employee safety obligations and legitimate interests, IMY ruled that these did not justify the real-time monitoring and that the employees' right to privacy outweighed the company's interests.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IMY?
Get an email when a new story names IMY, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Swedish security services company deployed in-vehicle cameras across ~50 patrol cars to monitor driver behavior without establishing a valid legal basis under GDPR, resulting in a formal reprimand from IMY. The company incorrectly assumed that occupational safety obligations and legitimate business interests were sufficient to justify continuous real-time video surveillance of employees. This case highlights that even well-intentioned monitoring programs can violate privacy rights if a proper Data Protection Impact Assessment (DPIA) and lawful basis analysis are not completed before deployment. It matters because employee monitoring is a high-risk processing activity under GDPR, and organizations face reputational and regulatory consequences when privacy-by-design principles are ignored from the outset.