IMY opens GDPR supervision of Arbetsförmedlingen AI support tool

The Swedish Authority for Privacy Protection (IMY) opened GDPR supervision of Arbetsförmedlingen on 5 November over its use of a statistical decision-support tool, described as an AI system, when assessing jobseekers for the “Rusta och matcha” labour-market programme. In its supervisory notice, IMY said it would examine the lawfulness and necessity of the processing, which personal data the tool needs, whether it involves automated decision-making and what information is given to affected jobseekers.

The case is an active supervision, not a finding of non-compliance. Arbetsförmedlingen must provide the information IMY needs and allow access to relevant premises, equipment and documents under Article 58(1) GDPR. The authority can issue a later decision identifying any deficiencies and requiring measures.

The provisions under review

IMY will assess:

- lawfulness and transparency under Article 5(1)(a) GDPR;
- data minimisation under Article 5(1)(c);
- the legal basis and necessity requirement under Article 6(1)(e);
- information provided to data subjects under Articles 12, 13 and 14 GDPR and section 20 of Sweden’s Ordinance (2002:623) on processing personal data in labour-market policy activities; and
- automated decision-making under Article 22 GDPR.

The authority said it received information through tips and media reports, and had reviewed documents supplied by or obtained from Arbetsförmedlingen. Those include a 2020 description of the assessment process, a June 2026 compliance document, the programme’s process flow, screenshots of privacy information and a 2023 document on the model’s functioning and performance.

IMY will ask which legal basis Arbetsförmedlingen relies on, which public-interest or official-authority task requires the processing, and where that task is established in law or regulation. It will also examine the personal data used, how the tool contributes to case handling and decisions, how the model has been evaluated, and how effective and meaningful human review is ensured.

The technical review will cover the model’s factors, suitability, known limitations, component parts and explanation model. IMY will also examine the methods used to verify the model and the decision-support tool.

Inspection and next steps

The inspection is scheduled for 24 November from 09:00 to 16:00 and 26 November from 09:00 to 12:00. Arbetsförmedlingen must make technical, operational and legal personnel available, either physically or digitally, with access to the systems under review.

The demonstration must take place in production or an identical environment, and known difficulties, shortcomings, deviations and ongoing development work that could affect testing must be shown. IMY will examine the version in use at the inspection and earlier versions, but not changes made afterwards. It also plans digital interviews with case handlers during weeks 49 to 51.

The case adds a GDPR investigation of an AI-enabled public service to IMY’s wider AI role. On 15 June, IMY announced that Sweden had designated it as the market-surveillance authority for the EU AI Regulation. After the inspections, IMY will send Arbetsförmedlingen a protocol of its observations and give it opportunities to respond before issuing a decision.