GDPR Breach Fines for SL Group Companies

IMY News (Sweden DPA)

Filed July 3rd, 2025

Detected February 11th, 2026

Email Set alert

Summary

The Swedish Authority for Privacy Protection (IMY) has issued administrative fines of SEK 75,000 each to Aktiebolaget Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB (WÅAB). The fines were imposed for processing personal data related to employee sobriety tests in breach of the GDPR, specifically regarding excessive data storage and handling of potentially sensitive health data.

View original document View source feed page

What changed

The Swedish Authority for Privacy Protection (IMY) has fined two companies within the SL Group, Aktiebolaget Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB (WÅAB), SEK 75,000 each for violations of the General Data Protection Regulation (GDPR). The violations stem from the processing of personal data related to sobriety tests conducted on employees, specifically ship captains. IMY found that the companies stored this data for longer than necessary and failed to implement sufficient routines, thereby exceeding legitimate interests and potentially mishandling sensitive health data.

Companies that conduct sobriety tests on employees must ensure that data processing is lawful under the GDPR and that data is not stored for longer than necessary. Employers must be aware that sobriety test results can indicate alcohol dependency, classifying this information as health data which requires strong legal protection. Failure to comply with GDPR requirements regarding data minimization, purpose limitation, and data security can result in significant administrative fines.

What to do next

Review data retention policies for employee sobriety test results to ensure compliance with GDPR.
Assess the necessity and proportionality of collecting and storing employee sobriety test data.
Ensure robust data protection routines are in place for handling sensitive personal data, including health data.