DPA case nr. 2018/1779 – Complaint Upheld (Iceland, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic authority ruled that sharing a person's work call records with their ex-wife without consent was unlawful. This is important because it reinforces the need for consent in sharing personal data, protecting individuals' privacy. Businesses should always seek permission before sharing personal information with third parties.
What happened
The Persónuvernd found that sharing a person's personal data with their ex-wife without consent was unlawful.
Who was affected
A citizen whose personal data was shared without consent was affected.
What the authority found
The authority determined that the sharing of personal data violated principles of fairness, transparency, and purpose limitation under GDPR.
Why this matters
This ruling underscores the necessity of obtaining consent before sharing personal data. Companies must prioritize privacy and ensure compliance with data protection principles.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A citizen complained that his ex-wife received work call records containing personal data about him. Is the dissemination of personal data to the data subject's ex-wife, without having obtained the data subject's consent, lawful? The Persónuvernd considered that the dissemination of personal data to a third party without having the data subject's consent unlawful. Especially, it found that the processing was contrary to several principles including the fairness and transparency principle, the purpose limitation principle and the integrety and confidentailty principles pursuant to the GDPR and its national act on electronic monitoring and processing of personal information generated by electronic monitoring.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case nr. 2018/1779 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case nr. 2018/1779 - Iceland (2019). Retrieved from cookiefines.eu
Last updated: