- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2020031451 – Complaint Upheld (Iceland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic primary school accidentally shared a student's medical diagnosis with other parents while addressing a bullying issue. This mistake raised concerns about privacy and the handling of sensitive information. The case highlights the importance of protecting personal data in schools.
What happened
The primary school mistakenly sent an un-redacted action plan that included a student's medical diagnosis to the parents of all involved children.
Who was affected
The students involved in the bullying case and their parents were affected by the accidental sharing of sensitive medical information.
What the authority found
The Icelandic DPA ruled that the school violated GDPR by sharing medical data without a legal basis.
Why this matters
This case underscores the need for schools to implement strict data protection measures. It serves as a reminder that even well-intentioned actions must respect privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A primary school developed an action plan to address a case of alleged bullying being carried out by one student against another two. The action plan included the opinion of a professional council on bullying from the municipal directorate of education, which issued a mental health diagnosis of the student believed to be bullying the other two. When contacting the parents of all three children on these matters, the director of the primary school mistakenly sent out the action plan un-redacted, and hence the medical diagnosis of the student suspected of bullying was visible to the other parties. The director realised that this mistake had taken place on the same day as the email was sent, and contacted the Icelandic DPA to notify the data breach. It also notified the recipients of the email of this data breach, asking them to disregard the email, and delete it. The Icelandic DPA informed the school that it would undertake no further action, and that the notification of the data breach by the primary school was enough up until that point. However, the DPA noted that if new facts emerged, or if a complaint was filed regarding this matter, it would reopen the case. However, the parent of the child whose medical data had been shared in the email to the other parents, eventually filed a complaint with the DPA, claiming that in the contents of subsequent correspondence regarding the bullying issue, they believed that the other parents had accessed the breached medical data belonging to their son. The DPA held that although the school had an obligation to respond and deal with bullying cases, this did not justify sharing the medical data of a student without a legal basis under Articles 6 and 9 GDPR. Furthermore, the DPA held that although it could not verify if the email had indeed been read or not by the other parents, the breach in itself constituted a violation of Articles 5(1)(f), 24, 25 and 32 GDPR, related to the controller’s obligations regarding security of perso
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020031451 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020031451 - Iceland (2022). Retrieved from cookiefines.eu
Last updated: