Which agency brought the action?

IMY (Swedish DPA) brought this enforcement action in SE.

What was the penalty?

The disclosed penalty is a monetary_fine amount of $75000.

When did the action take effect?

The most recent activity on this action was published on 7/3/2025.

Enforcement action · IMY (Swedish DPA)

[IMY] Administrative fines against two companies in the SL Group

[IMY] Administrative fines against two companies in the SL Group is an AI-related enforcement action involving IMY (Swedish DPA). Penalty: monetary_fine of $75000. The Swedish Authority for Privacy Protection (IMY) has fined two companies for GDPR breaches related to processing personal data from employee sobriety tests.

Action details

Agency: IMY (Swedish DPA)
Jurisdiction: SE
Enforcement type: fine
Document type: enforcement action
Penalty: $75000 monetary_fine
Topic: ai privacy

Summary

The Swedish Authority for Privacy Protection (IMY) fined Aktiebolaget Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB (WÅAB) SEK 75,000 each for GDPR violations. The violations relate to processing personal data from sobriety tests conducted on employees.

Primary source

https://www.imy.se/en/news/administrative-fines-against-two-companies-in-the-sl-group2/ →

[IMY] Four companies must stop using Google Analytics
enforcement action 7/3/2023
[IMY] Administrative fee against Spotify
enforcement action 6/13/2023
[IMY] Administrative fines against Apoteket and Apohem for transferring personal data to Meta
enforcement action 7/3/2025

Frequently asked questions

What is [IMY] Administrative fines against two companies in the SL Group?: The Swedish Authority for Privacy Protection (IMY) fined Aktiebolaget Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB (WÅAB) SEK 75,000 each for GDPR violations. The violations relate to processing personal data from sobriety tests conducted on employees. Primary source →
Which agency brought the action?: IMY (Swedish DPA) brought this enforcement action in SE. Primary source →
What was the penalty?: The disclosed penalty is a monetary_fine amount of $75000. Primary source →
When did the action take effect?: The most recent activity on this action was published on 7/3/2025. Primary source →
Where can I find the primary source?: The primary source for [IMY] Administrative fines against two companies in the SL Group is at https://www.imy.se/en/news/administrative-fines-against-two-companies-in-the-sl-group2/. AIGI does not paraphrase secondary commentary — every claim on this page links back to that primary source. Primary source →

Stay informed

Get every IMY (Swedish DPA) AI enforcement update.

Start 14-day trial →

Important — about this brief

This brief is published by AIGI as a regulatory intelligence service. It contains general information about AI laws, regulations, enforcement actions, and policy signals across jurisdictions. It is not legal, compliance, audit, or risk-management advice; it does not establish an attorney-client, advisory, or fiduciary relationship; and it should not be relied upon as a substitute for professional counsel applied to specific facts and circumstances. Where the brief identifies “Issues for Review,” those are observations of questions a reader in a particular role might raise with their own legal, compliance, or risk function — not recommendations to act. AIGI expressly disclaims liability for actions taken or not taken in reliance on this brief. Subscribers in regulated industries should consult licensed professionals authorized to practice in their jurisdiction.

Full disclosures →

Action details

Summary

Primary source

Related IMY (Swedish DPA) actions

Frequently asked questions

Related

Get every IMY (Swedish DPA) AI enforcement update.