- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020031243 – Complaint Upheld (Iceland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A primary school in Iceland faced scrutiny for sharing sensitive information about a child without consent. This is important because it shows how crucial it is for schools and organizations to protect personal information.
What happened
The school shared sensitive information about a child with a counseling company after their partnership ended.
Who was affected
The child and their family, who were affected by the unauthorized sharing of personal information.
What the authority found
The data protection authority criticized the school for not ensuring that all staff were aware of the end of the partnership with the counseling company.
Why this matters
This case highlights the responsibility organizations have to protect sensitive information. Schools and similar institutions should implement clear communication protocols to prevent unauthorized data sharing.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On March 21, 2020, the DPA received a complaint that a primary school had sent an e-mail containing sensitive information about a child to a counseling company after the school's partnership with the company ended. According to the complainant, the company KVAN was hired by a school to work on the bullying case of the complainants’ child. The municipality’s education department and the complainant decided that the school's bullying team would take over the case from KVAN and that the company would not be further involved in the case. Three weeks after that decision, a KVAN employee sent an e-mail to a school employee asking about the status of the complainant's child. On the same day, an employee of the school replied to the e-mail and provided information on the status of the case, without the complainants' consent. The e-mail contained the child's name and sensitive personal information about it. The complainants only became aware of this after requesting access to all data about themselves and their child at the school. According to the school, the employee that had replied to KVAN’s e-mail had not been aware that the collaboration with the company had been terminated and he had therefore been in good faith in his communication. The e-mail did not contain any new personal information that the KVAN employee in question was not already aware of. Despite this, the municipality has apologized to the complainants. The DPA found school’s behavior reprehensible in light of the nature of the documents in question that the school did not ensure that all employees who were involved in the complainant's child's case were informed that the termination of collaboration with KVAN. The fact that the recipient of the e-mail had already been informed of the case and therefore it was not new information except to a limited extend did not matter. The DPA considered that there was no authorization for the school to pass on personal information about the complainant's child to t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020031243 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020031243 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: