DPA case 2020010394 – Complaint Upheld (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint about a municipality sharing personal data with a trade union was upheld by the Icelandic DPA. This is important because it shows that organizations must respect privacy when sharing personal information. It reminds municipalities and businesses to get consent before sharing data.
What happened
A municipality shared personal data about a worker's studies with a trade union without proper authorization.
Who was affected
The worker whose personal data was shared without consent.
What the authority found
The Icelandic DPA found that the municipality did not have authorization to share the personal data.
Why this matters
This ruling highlights the importance of obtaining consent before sharing personal information. It serves as a reminder for organizations to review their data sharing practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA received a complaint about the sharing of personal data between a municipality and a trade union. The complainant requested that her workplace contribute to the cost of studies she pursued in parallel with her work. However, she was informed by an e-mail that she had already received the reimbursement from the union. The municipality obtained information about the studies and courses she had been paid for from the union's funds directly from the union. The complainant argued that her rights were violated because nor she nor her boss were not contacted and asked for receipts. According to the municipality, when the inquiry was sent, the authorizations for the processing of personal information were not taken into account. The complainant had not been informed about the inquiry. The municipality also stated that procedures have been reviewed and it has been ensured that cases such as this will not be repeated. The DPA stated that the disclosure of the complainant's personal data was not authorized. For that reason alone, it is the opinion of the DPA that the processing of a municipality and of a trade union of personal information about the complainant was not in accordance with Article 6 GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010394 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010394 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: