- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020010373 – Violation Found (Iceland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Iceland's DPA approved the sharing of personal data about foreign prisoners between state agencies. They confirmed this is allowed if done for specific legal purposes. This ruling clarifies how data can be shared in government contexts.
What happened
The DPA found that state agencies can exchange personal data of foreign prisoners under certain conditions.
Who was affected
Foreign prisoners whose data is shared between the Prison and Probation Service and the Immigration Office.
What the authority found
The DPA determined that the data exchange complied with GDPR as long as specific legal bases were met.
Why this matters
This decision provides guidance on lawful data sharing between government entities, helping agencies understand their obligations under data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Prison and Probation Service requested an opinion on the data protection implications of processing foreign prisoners' personal data after it requested that the Immigration Office provide it with the criminal history and prison records of "foreigners" sentenced in Iceland. Does the GDPR permit the exchange of the personal data of foreign prisoners between state agencies? The Icelandic DPA was of the opinion that the exchange was GDPR compliant, so long as: - Article 5(1)(c) was upheld, ie the purpose for the processing was limited to allowing the Prison Service to facilitate probation for foreign prisoners and grant penalties for out of prison sentences, or to permit the Immigration Service to expel foreign nationals; -the legal basis for the processing was Article 6(1)(c), ie the exchange of data was necessary for the agencies to fulfil their legal obligations; -when either agency was acting as the controller, they had to fulfil their obligations as controllers under Article 32 GDPR, in particular "preventing unauthorized access in a safe and adequate manner in the dissemination and processing of such data."
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010373 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010373 - Iceland (2020). Retrieved from cookiefines.eu
Last updated: