Continuous camera surveillance of employed drivers, combined with automatic detection of things like mobile telephone use, being inattentive and not using safety belts, breached the General Data Protection Regulation(GDPR). This is the conclusion of the Swedish Authority for Privacy Protection (IMY) in a ruling concerning Securitas’ use of cameras in company vehicles.
Read this article in Swedish on Arbeidsliv i Norden
Securitas had been using inward-facing cameras in some company vehicles as part of a pilot project. The cameras recorded the drivers and analysed their behaviour in real time. The system could register certain events and issue warnings to the driver. Some of the data was also passed on to the employer.
Among other things, Securitas referred to its responsibility for occupational health and safety and argued that the use of the data was necessary to comply with a legal obligation under Article 6(1)(c) of the GDPR.
IMY did not accept this. The authority argued the provisions of the Work Environment Act and the Swedish Work Environment Authority’s regulations cited by the company were too general to constitute a sufficiently clear and precise legal basis for data processing of such sensitive nature in terms of privacy.
IMY also considered whether the data processing could have been based on legitimate interest under Article 6 (1)(f) of the GDPR. The company’s aims – including minimising the risk of accidents, monitoring risky behaviour and investigating incidents – were accepted as legitimate interests.
The authority also found some ground for considering the data processing to be necessary, partly because less intrusive measures had already been tried.
Instead, the decisive factor was the balance of interest. The drivers were being monitored for large parts of their working day, they could not avoid this surveillance and as employees they were dependent on their employer.
The surveillance was therefore particularly intrusive from a privacy perspective. Securitas’ interest did not outweigh the employees’ interest in protecting their own personal integrity.
The decision is a clear example of how an employer’s working environment responsibility does not in itself legitimise extensive digital surveillance. It also shows how the GDPR plays a central role when algorithmic systems are being used to manage, monitor and assess work.
At the same time, the decision does not determine how much weight the employer’s interest may carry in justifying less intrusive monitoring systems. Nor does it address the significance that negotiations or agreements with trade unions may have in the balancing of interests.
(The Swedish Authority for Privacy Protection’s decision (in Swedish) IMY-2025-10429, from 16 June 2026)
This article was first published by EU & Labour Law, number 3/2026: Algoritmisk kameraövervakning av förare stred mot dataskyddsförordningen
A more detailed analysis of the ruling will appear in the next issue of Förvaltningsrättslig tidskrift.
