Borgarholtsskóli – Violation Found (Iceland, 2026)

The DPA received a complaint from a data subject regarding the processing of their personal data by Borgarholtsskóli (a school and the controller) in connection with an anonymous tip received via the feedback button on the controller’s website. The tip received regarded the data subject and their teaching methods, which according to the data subject were fabrications, misrepresentations and slander. In their complaint, the data subject claimed that their personal data was not processed in a lawful, fair and transparent manner, and demanded that the false and anonymous defamation about them be deleted from the controller’s system. Particularly, as the purpose and objective of the feedback button was not clearly stated. In its defence the controller clarified that where an individual submits a general tip, voluntarily providing their personal data, the processing of such is based on consent. On the other hand, when an anonymous tip, which contains personal data about a third party, the processing operations are based on compliance with a legal obligation particularly in improving the quality of education. Supporting its statement with national law, the controller stated that the feedback button is necessary for the controller’s operations, ensuring they are able to fulfill their national law obligations. Ultimately, the dispute concerned whether the controller was authorised to accept the anonymous tip and subsequently save it in its system, as well as whether the controller should delete the anonymous tip from its system. The DPA found the data processing of the controller in violation of Article 5(1)(a)-(d) GDPR and Article 6(1) GDPR. Particularly, the DPA found that whilst the controller had obligations under national education laws, this did not automatically extend to the acceptance and processing of anonymous complaints. The DPA therefore held that the controller did not provide sufficient evidence to justify that its processing was necessary to comply with a legal obligation pursuant to Article 6(1)(c). Furthermore, the DPA clarified that the data subject’s right to erasure does not apply if retention is necessary for archiving purposes in the public interest in light of national archive laws. The DPA issued a reprimand against the controller ordering it to review the collection of personal data through their feedback form on the website, and ensure that they bring their data processing obligations into compliance with Articles 5(1)(a)-(d) GDPR and Article 6(1) GDPR.