Swedish regulator says Securitas, a security company, unlawfully monitored drivers with in-car cameras
The Swedish data protection authority IMY has criticized security company Securitas for unlawfully monitoring employees using in-car cameras installed in company vehicles. Securitas, a security firm, used the system to track driver behavior, including phone use, seatbelt use, fatigue, and smoking, during a pilot program.
-
Swedish privacy authority IMY says Securitas unlawfully monitored employees using in-car cameras.
-
The cameras tracked driver behaviour including phone use, seatbelt use, fatigue, and smoking.
-
Regulators say the monitoring was too intrusive and lacked a valid legal basis under GDPR rules.
-
No fine was issued, as the surveillance was limited to a short pilot and showed no evidence of misuse.
According to IMY, the security company installed cameras in company cars aimed at the driver.
Securitas said it did this to improve the driver’s safety, reduce accidents and vehicle damage, comply with occupational safety obligations, and investigate insurance claims and accidents. Based on what the cameras recorded, an alert was sent to both the driver and Securitas. Some versions of the system also stored video recordings.
The built-in camera surveillance was part of a pilot that ran from December 2024 to May 2025.
According to the Swedish privacy and data protection regulator, Securitas had legitimate business interests to monitor their drivers, including reducing accidents, lowering repair costs, investigating incidents, and handling insurance disputes.
However, continuously monitoring employees is highly intrusive and constitutes a serious violation of their privacy. To carry out such extensive monitoring, the company needed a better, valid legal basis under the General Data Protection Regulation (GDPR).
Although the camera surveillance was unlawful, IMY decided not to impose a fine but rather to reprimand the company. As the regulator explains in its supervisory decision, it was only a pilot involving a small number of vehicles and drivers.
Furthermore, the surveillance was ended after only a few months, and there was no evidence that any recordings were misused. Lastly, Securitas has no previous GDPR violations to its name.
“We have found that this is an intrusive form of surveillance. In this case, it took place in a limited pilot project, and the surveillance has ceased. But our supervision means that there is now clarity that strong reasons are required for surveillance of this kind to be permitted,” Anders Haag, lawyer at IMY, said in response.
Unlock more exclusive Cybernews content on YouTube.
