DPA case nr. 2019/232 – Dismissed (Iceland, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic data protection authority dismissed a complaint from a job applicant who wanted to keep their request private. The authority found that the other applicants had the right to know about the access request. This matters because it clarifies how privacy works in situations involving multiple people.
What happened
A job applicant complained after the agency informed other applicants about his request for access to their documents.
Who was affected
The job applicant who made the request and the other applicants whose documents were involved.
What the authority found
The authority ruled that it was appropriate to inform other applicants about the access request, aligning with GDPR principles.
Why this matters
This decision reinforces the idea that transparency is important in data access requests. It reminds individuals that privacy rights can be balanced with the rights of others in similar situations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant applied for a job in a public agency. He asked the government agency to disclose the others applicant's documents. Following the access request, the government agency notified the others applicants. The notification included information concerning the complainant’s request, including personal data. However, the complainant did not consent to share information about his request with the other applicants. Thus, the complainant brought a complaint before the Persónuvernd. Should data subjects be notifed of an access request which concerns their personal data? The Persónuvernd considered that since the request concerned the personal data about his fellow applicants, the complainant should have also assumed that the same applicants had the right to know who was granted the access to their personal data. Thus, it was not required to inform nor to ask the consent of the complainant about the disclosure. The Persónuvernd found that the processing was in line with Article 5(1) GDPR principles and its national law.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case nr. 2019/232 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case nr. 2019/232 - Iceland (2019). Retrieved from cookiefines.eu
Last updated: