- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020010628 – Complaint Upheld (Iceland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An institution and a municipality were found to have mishandled sensitive health data. The municipality published this data on its website after it was disclosed in board meeting minutes, which should have been kept confidential. This case shows the importance of protecting sensitive information and ensuring it is not shared publicly without proper safeguards.
What happened
The municipality published sensitive health data on its website after it was improperly disclosed during a board meeting.
Who was affected
The individual whose health and sick leave information was disclosed and published without consent.
What the authority found
The data protection authority ruled that the municipality violated GDPR by failing to secure sensitive health data before publishing it.
Why this matters
This ruling underscores the need for organizations to handle sensitive data with care and to ensure that privacy measures are in place before sharing any information publicly.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject complained to the DPA about the processing of his sensitive data by an institution and a municipality. More specifically, the complainant's health and sick leave information was disclosed in the minutes of the institution's board meeting on at least two occasions. The institution then communicated the minutes to multiple municipalities, one of which published the minutes on its website without removing the health data. The complainant argued that the board of the institution should have recorded his health information as confidential, and refrained from making it available to anyone other than the board and its director. Furthermore, the municipality notified the DPA about publishing the information on its website and considered it to be a data breach which resulted from a mistake. Were the recording of the personal data by the institution, the communication to the municipality, and the publishing on the municipality's website in line with the GDPR? First, the Persónuvernd held that the public institution in question acted lawfully (in line with Articles 6(1)(c) and 9(2)(b) GDPR) as it communicated the personal data of the complainant to the municipality. Second, the DPA held that the municipality breached the GDPR (especially Articles 5 and 32) by publishing the health data on its website, as it did not properly review the minutes before their publication.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010628 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010628 - Iceland (2020). Retrieved from cookiefines.eu
Last updated: