NPA MIÐSTÖÐIN – Violation Found (Iceland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Icelandic data protection authority found that a service manager's request for personal data was unreasonable. This is significant because it emphasizes the limits on data collection.
What happened
The NPA Centre challenged the Social Services Department's request for personal data from its members.
Who was affected
Disabled individuals who were members of the NPA Centre and whose personal data was requested.
What the authority found
The authority ruled that the request for personal data was beyond the legal authority of the controller and unnecessary.
Why this matters
This case serves as a reminder for organizations to ensure that their data requests are necessary and within legal limits to protect individuals' privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 1 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA received a request from the NPA Centre (NPA), the service manager of services for disabled people with long-term care needs, asking whether the Social Services Department of the City of Reykjavik (the controller) is permitted to request personal data. This included bank statements and receipts from the members of the centre relating to expenses for the services of support workers who provide user-directed personal assistance (NPA). In the request, it was made evident that the NPA Centre receives funds from the local authority and distributes it accordingly to its members and supporting staff. Disabled individuals are the line managers and NPA is the employer of the individual’s support workers receiving their timesheets and correspondingly paid their wages. It was further established that the personal data requested by the controller would provide the local authority with comprehensive insight into the life, lifestyle, interests, events, social participation and daily activities of disabled individuals that are with NPA. Thus, the NPA held that the request for the collection of this data goes beyond the legal authority of the controller, is unreasonable and unnecessary. The controller claimed no personal data processing was being undertaken. However, deemed the collection of such necessary to obtain detailed monitoring of the use of funds as some individuals had accumulated high sums of money. The DPA held that in line with complying with its legal obligations, the controller may be able to process personal data including sensitive data in connection to monitoring the expenditure of funds allocated for NPA. Nonetheless, the DPA found that the current planned collection of personal data by the controller from NPA is not compatible with the GDPR and the national data protection act. The DPA clarified that processing must comply with the principles enshrined in Article 5 GDPR particularly transparency and proportionality. The DPA emphasised that collecting su
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for NPA MIÐSTÖÐIN in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. NPA MIÐSTÖÐIN - Iceland (2026). Retrieved from cookiefines.eu
Last updated: