Swedish municipality required children's ID numbers to swim: what GDPR's data minimisation principle means

What happened in Mölndal

Mölndal municipality runs a public swimming facility. To swim without an adult, children under 13 had to give their personal identity numbers at reception.^[1] The municipality's culture and leisure board is now under investigation by IMY, Sweden's data protection authority, for that practice.

IMY opened the case to examine whether the collection was justified under the GDPR.^[1] The authority has not yet published its decision, but the fact that it opened an investigation suggests the practice raised questions about necessity.

Data minimisation in plain terms

Article 5(1)(c) of the GDPR says personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed.^[2] That is the data minimisation principle. You collect what you need, not what might be useful one day.

A personal identity number is a particularly sensitive piece of information in Sweden. It uniquely identifies a person and is used across public services, health care and finance. Asking for it at a swimming pool reception is a high bar to clear.

The question is not whether the municipality had a reason. The question is whether that reason required a personal identity number, or whether something else would have done the job.

What the municipality might have argued

We do not yet know the municipality's defence, but common justifications in similar cases include safety, age verification and parental consent.

If the facility wanted to check that a child was old enough to swim alone, a birth date might have been enough. If it wanted to reach a parent in an emergency, a phone number and a first name could work. A personal identity number gives you both, but it also gives you a permanent, unique identifier tied to every interaction that child has with the state.

The GDPR does not ban collecting personal identity numbers. It requires that you show why less identifying information would not achieve the same purpose.^[2] In practice, that means asking: what would go wrong if we did not have this?

What this means for you

If your organisation collects personal data from people, particularly from children, here are three questions to ask:

1. Could we achieve the same purpose with less identifying information? For example, could a year of birth replace a full birth date, or a reference number replace a name?
2. Do we have a documented reason for each piece of data we collect, and can we explain it to the person and to a regulator?
3. If we were investigated, could we show that we considered alternatives and chose the least intrusive option?

Data minimisation is not a technical question. It is a question about defaults. The default should be to collect less, and to have a reason ready when you collect more.

Article 5(1)(f) adds that personal data must be processed securely, protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.^[2] The more sensitive the data, the higher the bar for security. A log of who collected what, when and why becomes part of showing that you took that obligation seriously.

What to watch

IMY has not yet published the outcome of its supervision of Mölndal municipality.^[1] When it does, the decision will clarify what counts as necessary in a case like this, and what alternatives the authority considers acceptable.

The case is a reminder that necessity is not a checkbox. It is a test that applies every time you ask for personal data, and it applies even when the request feels routine.

A digital witness can seal a record of what data was collected, when and under what policy, so that if the necessity is questioned later, both sides are working from the same facts.