- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Íslandshótels – Complaint Upheld (Iceland, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Íslandshótels in Iceland was found to have improperly shared a list of sick employees by posting it in a public area. This is important because it shows that companies must protect employee privacy even when they have a reason to share information.
What happened
The hotel shared a list of employees who were absent due to sickness in a public space.
Who was affected
The employees listed as absent due to sickness were affected by this action.
What the authority found
The authority ruled that posting the list publicly was a breach of GDPR rules regarding personal data processing.
Why this matters
This case serves as a reminder for businesses to ensure that employee information is handled securely and privately, even when sharing is necessary.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The operation manager of the hotel hung up a list of employees who were absent due to sickness. It was not contested that the hotel had a lawful legal ground to process the information. However, the information was shared by hanging the list up in a space open for the workers. This processing was not covered by the legal ground. The question for Persónuvernd was if hanging up the list of employees constituted a security breach. Personurvernnemdi found that the processing of the personal data by Islandshotels by hanging up the lists of sick and absent employees was a breach of Article 5(1)(f) of the GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Íslandshótels in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Íslandshótels - Iceland (2019). Retrieved from cookiefines.eu
Last updated: