Borgarholtsskóli – Violation Found (Iceland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Borgarholtsskóli, a school in Iceland, faced a complaint about how it handled an anonymous tip regarding a teacher. The school claimed it processed the tip to comply with legal obligations, but the data subject argued it was unfair and not transparent. This case raises questions about how schools manage anonymous feedback.
What happened
The DPA investigated a complaint about Borgarholtsskóli processing an anonymous tip that included personal data.
Who was affected
The teacher whose methods were anonymously criticized through the school's feedback button.
What the authority found
The DPA found that the school was allowed to process the anonymous tip under national law, but the complaint raised important concerns about transparency.
Why this matters
This case highlights the need for schools to be clear about how they handle anonymous feedback. It reminds educational institutions to ensure transparency and fairness in their data processing practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The DPA received a complaint from a data subject regarding the processing of their personal data by Borgarholtsskóli (a school and the controller) in connection with an anonymous tip received via the feedback button on the controller’s website. The tip received regarded the data subject and their teaching methods, which according to the data subject were fabrications, misrepresentations and slander. In their complaint, the data subject claimed that their personal data was not processed in a lawful, fair and transparent manner, and demanded that the false and anonymous defamation about them be deleted from the controller’s system. Particularly, as the purpose and objective of the feedback button was not clearly stated. In its defence the controller clarified that where an individual submits a general tip, voluntarily providing their personal data, the processing of such is based on consent. On the other hand, when an anonymous tip, which contains personal data about a third party, the processing operations are based on compliance with a legal obligation particularly in improving the quality of education. Supporting its statement with national law, the controller stated that the feedback button is necessary for the controller’s operations, ensuring they are able to fulfill their national law obligations. Ultimately, the dispute concerned whether the controller was authorised to accept the anonymous tip and subsequently save it in its system, as well as whether the controller should delete the anonymous tip from its system. The DPA found the data processing of the controller in violation of Article 5(1)(a)-(d) GDPR and Article 6(1) GDPR. Particularly, the DPA found that whilst the controller had obligations under national education laws, this did not automatically extend to the acceptance and processing of anonymous complaints. The DPA therefore held that the controller did not provide sufficient evidence to justify that its processing was necessary to comply with a
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Borgarholtsskóli in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Borgarholtsskóli - Iceland (2026). Retrieved from cookiefines.eu
Last updated: