- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
YAY ehf. – €27,200 Fine (Iceland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
YAY ehf. was fined for not properly handling personal information during a travel voucher promotion in Iceland. This is important because it shows that companies must get clear consent from users before collecting their data.
What happened
YAY ehf. processed personal data without proper consent during a travel voucher promotion.
Who was affected
Visitors who used the YAY app to obtain travel vouchers were affected by the mishandling of their personal information.
What the authority found
The Icelandic DPA found that YAY ehf. did not have valid consent for processing personal data, violating GDPR rules.
Why this matters
This ruling emphasizes the need for clear consent when collecting personal data. Companies should ensure they have proper agreements in place to avoid fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 13 March 2026.
Processing notes: articles corrected, amount discrepancy, entity split needed.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Icelandic Data Protection Authority has imposed a fine of EUR 51,000 on the Ministry of Industry and Innovation and a fine of EUR 27,200 on YAY ehf. The fine is related to a campaign by the ministry to encourage Icelanders to travel domestically in the summer of 2020. This involved a digital gift voucher that could be obtained through the app of the company YAY ehf. The DPA received a number of complaints regarding the fact that the use of the travel gift required extensive personal information and access to users' phones. As a result, the DPA launched investigations against the ministry and the company. The DPA found that the ministry had violated the principle of legality and transparency. Participating individuals were only required to agree to the General Terms of Use of the YAY app in order to participate in the voucher promotion. However, the DPA found that by doing so, the data subjects had not expressly consented to the processing of their personal data carried out as part of the promotion. The DPA also found that the information provided about the actual processing of personal data was insufficient. Moreover, neither the ministry nor YAY ehf. had implemented appropriate technical and organizational measures to ensure the security of the processing of personal data. Also, due to a configuration error on the part of YAY, more data than necessary was processed, which is why the DPA found a violation of the principle of data minimization.
Related Enforcement Actions (0)
No other enforcement actions found for YAY ehf. in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
23 November 2021
Authority
Persónuvernd
Fine Amount
€27,200
About this data
Cite as: Cookie Fines. YAY ehf. - Iceland (2021). Retrieved from cookiefines.eu
Last updated: