- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
City of Reykjavík – €36,000 Fine (Iceland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The City of Reykjavík was fined EUR 36,000 for mishandling personal data of students using the Seesaw education system. The Icelandic data protection authority found that the city did not clearly define how it was using the children's data and failed to protect it properly. This case highlights the importance of having clear data protection measures in place, especially when dealing with minors' information.
What happened
The City of Reykjavík used the Seesaw digital education system without properly defining the purpose of processing students' personal data.
Who was affected
Minor students whose personal data, including teacher feedback and private information, was processed by the Seesaw system.
What the authority found
The authority ruled that Reykjavík did not implement adequate measures to protect personal data, violating GDPR's principles of purpose limitation and data minimization.
Why this matters
This ruling emphasizes that organizations must have clear data protection strategies, especially when handling sensitive information about children. Other schools and educational institutions should review their data practices to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Icelandic DPA has imposed a fine of EUR 36,000 on the City of Reykjavík. The city had used the digital education system 'Seesaw' at several schools. The student system processed, among other things, personal data of minor students such as teacher feedback and information about students' private affairs. During its investigation, the DPA found that the purpose of the processing of the children's data had not been sufficiently clearly defined. In this context, the DPA also found a breach of the principle of proportionality and data minimization. In addition, the DPA concluded that the city had not implemented adequate technical and organizational measures regarding the protection of personal data. This would have been necessary given the high risk that the data might be transferred to and processed in the United States. In determining the fine, mitigating consideration was given to the fact that no damage was caused by the data breaches.
Related Enforcement Actions (0)
No other enforcement actions found for City of Reykjavík in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
3 May 2022
Authority
Persónuvernd
Fine Amount
€36,000
About this data
Cite as: Cookie Fines. City of Reykjavík - Iceland (2022). Retrieved from cookiefines.eu
Last updated: