SwedenEducation2018Skellefteå Municipality
Facial recognition for school attendance
Skellefteå's school attendance pilot was ruled unlawful and drew a SEK 200,000 fine
Problem
The municipality wanted to reduce teachers' attendance administration and avoid missed or incorrect registrations. It worked with Tieto to test automatic registration at Anderstorpsgymnasiet.
Approach
In autumn 2018, cameras matched students entering a classroom against previously registered facial images. The regulator examined three weeks of facial recognition involving 22 students and imposed a SEK 200,000 fine in August 2019. The municipality said participation was voluntary and students and guardians had consented, but the courts found that the unequal relationship between students and the school prevented valid consent. The administrative court upheld the decision in 2020, and the appeal court upheld it in 2021.
Results
Takeaway
The municipality treated consent and a limited pilot as sufficient safeguards. The courts found that attendance could be recorded through less intrusive methods and that the required assessment and prior consultation were missing.
Categories
- Size
- Large enterprise
- Industry
- Education
- Business function
- Production and quality
- Innovation type
- Process innovation
- AI technology
- Computer vision
- Adoption
- Partner co-development
- Evidence
- Regulator, audit or court
Sources
Source summaries
The decision covered three weeks of facial recognition involving 22 students. It imposed a SEK 200,000 fine, found inadequate legal grounds and assessment, and warned against continued use.
The municipality described its collaboration with Tieto and its aim of reducing attendance administration. It said students and guardians had consented and described facial recognition as machine learning.
The court upheld the fine and warning. It rejected consent because of the unequal relationship between students and the school and found the processing disproportionate to attendance recording.
SVT dated the classroom use to autumn 2018. It reported that the appeal court upheld the finding of a GDPR breach and the SEK 200,000 fine.
Full details are in the original sources.
