DPA case 2020010633 – Dismissed (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Icelandic DPA dismissed a complaint from a former employee who claimed his dismissal was due to improper sharing of his personal data. The DPA found that the sharing of information between his former and current employers was lawful. This case highlights the importance of understanding data sharing practices in employment.
What happened
A former employee's complaint about the sharing of his personal data between two employers was dismissed.
Who was affected
The former employee who believed his dismissal was caused by the sharing of his personal data.
What the authority found
The Icelandic DPA ruled that the sharing of the employee's data was compliant with data protection laws.
Why this matters
This case illustrates that employers can share certain information legally, which is important for businesses to understand when managing employee data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject (the Complainant) had been working for an institution (hereafter, X). He then started to work for a municipality (hereafter Y). Y however decided to re-evaluate the status of the Complainant. In this context, representatives of X shared information about the Complainant with Y. Nine days later, the Complainant was dismissed by Y. The Complainant considered that his dismissal was a direct result of the sharing of information between X (his former institutional employer) and Y (the municipality). Furthermore, his job application with a sub-agency of Y (hereafter, Z) was rejected on the basis of the same information. The Complainant was of the opinion that X and Y should not have shared and used information about him for the purpose of deciding whether to dismiss him or reject his new job application with Z. In particular, the Complainant considered that X and Y did not have any valid legal basis for the processing of his personal data, and that X and Y had violated the principles of data processing as enshrined in Article 5 GDPR. The Icelandic DPA considered the processing in question, i.e. the collection, sharing and use, between X and Y, of the Complainant's personal data for the purpose of human resources management, complied with the applicable data protection law. The Icelandic DPA therefore rejected the complaint. In particular: * the Icelandic DPA found that data relating to the dismissal of a former employee does not qualify as special categories of personal data under Article 9 GDPR. Hence, it was not necessary for X or Y to justify the processing of such data under Article 9 GDPR (i.e. legal bases for the processing of special categories of data). Rather, Icelandic DPA found that X and Y could rely on Article 6 GDPR for processing the Complainant's data (i.e. legal bases for the processing of personal data in general). * the Icelandic DPA rejected the idea that the processing of the Complainant's data should have been based on his consent
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010633 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010633 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: