DPA case 2020010642 – Complaint Upheld (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint was upheld by the Icelandic data protection authority after a school employee's report about inappropriate behavior was shared without her knowledge. This matters because it highlights the need for organizations to inform individuals when their personal data is shared. It reminds public bodies to respect privacy during investigations.
What happened
The Child Protection Committee shared a report about a school employee without informing her beforehand.
Who was affected
The school employee who reported inappropriate behavior and had her name shared without consent.
What the authority found
The authority ruled that sharing the employee's name without her knowledge did not comply with data protection law.
Why this matters
This case reinforces the importance of transparency in data sharing, especially in sensitive situations, and reminds organizations to respect individuals' privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The employee of a primary school (the Complainant) called the Icelandic Child Protection Committee (CPC) to orally report the inappropriate behaviors of one of her colleagues towards children under their care. During the phone call, the employee of the CPC wrote down the name of the Complainant, but not the identity of the children concerned. Because this report did not include the name of any children, the CPC considered that it was not competent to investigate the case. Without informing the Complainant about it, the CPC then transmitted the report to the education and leisure department of the competent municipality (the Municipality). The Municipality then started an investigation and interviewed both the Complainant and her colleague. The Complainant had not been informed beforehand that she would be included in this procedure. The Complainant considered that the disclosure of her name by the CPC to the Municipality without informing her beforehand, and the further processing of her personal data by the Municipality, did not comply with data protection law. The Complainant therefore decided to file a complaint with the Icelandic DPA. The CPC argued, for its part, that the disclosure of the personal data of the Complainant was necessary and therefore lawful for the performance of a task carried out in the public interest (Article 9(5) of the Icelandic Data Protection Act no. 90/2018 , and Article 6(1)(e) GDPR). The Municipality further argued that the report had been legally shared by the CPC on the basis of Articles 16, 17 or 18 of the Icelandic Child Welfare Act no. 80/2002, and that no provision in that law required the CPC or the Municipality to inform the Complainant about it beforehand. The Icelandic DPA reviewed the provisions of the applicable data protection law and of the Child Protection Act, to determine whether the processing of the personal data of the Complainant by the CPC and the Municipality was lawful. Having regard to the circumstances of t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010642 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010642 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: