- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020010550 – Complaint Upheld (Iceland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person reported that their ID number and bank details were posted on another individual's public Facebook page without consent. The authority found this sharing to be illegal under privacy rules. This case highlights the risks of sharing sensitive information on social media.
What happened
A person's ID number and bank details were published on a public Facebook page without their consent.
Who was affected
The individual whose ID number and bank details were shared without permission.
What the authority found
The authority ruled that the publication of the person's information was unlawful under GDPR.
Why this matters
This case serves as a reminder that sharing sensitive personal information online can lead to serious privacy violations. Individuals should be cautious about what they post.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject complained to the Persónuvernd that his personal data was published by another individual on the latter's Facebook page. The complainant also attached a screenshot with the complaint to the DPA, and the individual who had posted the information did not respond to the DPA's invitations to submit explanations regarding the complaint. More specifically, the data published on the Facebook page included the complainant's ID number, account number, and summary of payments to the complainant's bank account. Furthermore, the defendant's Facebook page was open and accessible to all those who are registered on social media. If a URL that directly refers to the post in question and the documents that accompany it were used, they were also accessible to those who are not registered. Was the publishing of the information regarding the claimant lawful based on Article 9 of Act no. 90/2018 (the national implementation of Article 6 GDPR)? The Persónuvernd held that the publishing of the complainant's information constituted an unlawful processing of personal data in breach of Article 6 GDPR. In its reasoning, the DPA first examined whether the publishing of the complainant's ID number, account number, and summary of payments to the complainant's bank account constituted processing of personal data. Despite the DPA not having explicitly mentioned Recital 18 GPDR, it did state that the processing did not only cover personal information intended for personal use. A main reason for the household exemption not applying was that the Facebook page was not closed, but open to be accessible to anyone who had the URL of the post in question. The DPA then examined the defendant's potential exercise of his freedom of expression based on Article 10 ECHR and its relation to Article 8 ECHR. The Persónuvernd first noted that expressing one's views and beliefs, as well as value judgements based on facts, do not constitute personal data and the DPA would not be competent to asse
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010550 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010550 - Iceland (2020). Retrieved from cookiefines.eu
Last updated: