Last year, the new European Data Protection Regulation (GDPR) began to apply in Sweden. Something that can put a sting on the wheel if you plan to make this year's Christmas celebration a success on social media. One of the situations that can be tricky to figure out is what applies when it comes to children's lucia trains. What can you do or not do when you as a parent want to take cards on their child's Lucia train?

Protected identity

- What you can say is that for the pictures you want to save in a photo album or in your phone, it's just to focus on. Then the GDPR does not apply. But it may be worth checking out the photo rules that apply at the school in question, says Ranja Bunni, a lawyer at the Data Inspectorate.

Rather, the problems arise if one wants to make possible lice pictures available on social media, for a wider audience.

- It's really about balancing interests. The parent can decide for himself whether the interest in posting the image on the internet outweighs the children's interest in not being exposed, she says.

Consent not decisive

And there are cases where it is important to keep track of which ones appear in the picture. For example, children in the Lucia train may have a protected identity. Then you should avoid posting the Lucia pictures online.

- But if it is a Lucia train where no one has a protected identity, it may still be okay to post the Lucia images depending on the image, how it is spread and in what context, says Ranja Bunni.

She emphasizes that it is not whether or not you have received the consent of other parents who decide whether you have violated the GDPR. Instead, it is still the balance of interests that determines.

"If you have been denied by a parent, it is a pretty strong argument in such a balance," she says.

Unclear practice

If you feel as a parent that your child has appeared on social media against your will, you can turn to the Data Inspectorate with a complaint. In this case, the authority may decide whether to proceed with the case.

- A person who has suffered damage as a result of his or her personal data being processed in violation of the GDPR is entitled to damages by the person who published the picture in violation of the data protection rules. The Data Inspectorate receives many complaints, so it is important for us to prioritize. And in these cases with the GDPR, there is no elaborated practice on what applies, says Ranja Bunni.