The Swedish authority issued a reprimand against the police for failing to inform travelers in a border control area, as the information was only available on its website without any on-site reference.

Facts and context

The Swedish Data Protection Authority (IMY) today published a decision issuing a reprimand against the police for shortcomings related to the information provided to travelers during border controls at Arlanda airport.

The case originated from an inspection conducted by the authority in an arrivals hall of the airport intended for travelers from third countries, to examine data processing within the Schengen Information System (SIS) and the Visa Information System (VIS).

Reasons for the decision

• Information obligation (Article 12 of the GDPR): The authority found that the police provided no written information to travelers about the processing of their personal data in the border control area. No posters, brochures, or any other materials were available on site. Although information was published on the police website, no signage in the arrivals hall directed data subjects to this resource. The authority therefore concluded that this online-only provision, without physical reference at the point of collection, did not satisfy the transparency obligation.

Decision of the authority

Consequently, the authority issued a reprimand against the police.

Lessons learned

This decision reminds that:

• Information on data processing must be provided in an easily accessible manner, directly at the point and time of collection.
• Publishing information on a website is not sufficient to fulfill the transparency obligation if data subjects are not informed of the existence of this resource by appropriate means at the place of collection.
• In physical locations where data is collected, such as border control areas, clear and visible signage is essential to guide individuals to data protection information.