- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020010591 – Complaint Upheld (Iceland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
In Iceland, the data protection authority found that the electronic complaint form for the Ombudsman was not secure enough. The form initially used an unencrypted HTTP connection, which could expose sensitive information. This ruling is important because it emphasizes the need for secure online forms to protect personal data.
What happened
The electronic complaint form for the Ombudsman did not use secure HTTPS protocols, risking the exposure of personal information.
Who was affected
Individuals submitting complaints to the Ombudsman who could have had their personal information compromised.
What the authority found
The authority determined that the complaint form did not comply with GDPR security requirements due to its use of unencrypted data transfer.
Why this matters
This decision stresses the importance of using secure connections for online forms. Website operators should ensure their sites use HTTPS to protect user information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In Iceland, any person who feels unfairly treated by the authorities may lodge a complaint with the Ombudsman. The complainant in the concerned case states that the electronic submission for a complaint to the Ombudsman does not comply with the GDPR. The electronic form requests sensitive personal information about complainants, but the form was only accessible on the official website that supported the HTTP protocol and not the HTTPS protocol. The complainant said she had sent an ombudsman on this issue but had not responded to it until several months later. The Ombudsman responded that the website has been updated and is now supported by HTTPS protocols. The Icelandic DPA had to decide whether an appropriate security of information on individuals could be ensured through an electronic complaint form on the Citizens' Ombudsman's website. The Icelandic DPA assessed the requirements of the Articles 32, 5 (1)(f) GDPR. According to the provision laid down, appropriate security measures may include, inter alia, the use of artificial identifiers and encrypted personal information and the ability to ensure the continued confidentiality of processing systems. HTTP protocols are the rules for unencrypted data transfer between each user's hardware browser and a web server hosting e.g. website, through the Internet. HTTPS protocols are the rules for encrypted data transfer in such cases. The Icelandic DPA is of the opinion that when sharing personal information through websites that use HTTP protocols, there is a significant risk that a third party will be able to access the personal information unauthorized. This risk is less when sharing through websites that use HTTPS protocols. According to the above, the Icelandic DPA considered that the processing of personal data by means of the electronic complaint form was not compliant with the GDPR. However, the Citizens' Ombudsman website now supports HTTPS protocols. Therefore, the Icelandic DPA did not consider grounds fo
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010591 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010591 - Iceland (2020). Retrieved from cookiefines.eu
Last updated: