DPA case 2021101909 – Violation Found (Iceland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic school principal entered the wrong attendance record for a child, allegedly to influence a court case between the child's parents. This mistake was only corrected after the father pointed it out. The case highlights the importance of accurate record-keeping in schools.
What happened
The principal of a school incorrectly recorded a child's attendance to potentially influence a visitation court case.
Who was affected
The child and their parents, who were involved in a court case regarding visitation rights.
What the authority found
The DPA found that the school violated data protection rules by not ensuring the accuracy of the attendance record.
Why this matters
This case emphasizes the responsibility of schools to maintain accurate records and the potential consequences of inaccuracies, especially in sensitive situations like custody disputes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 1 October 2021, the Icelandic DPA received a complaint from the father of a child. The child is the relevant data subject in the case at hand. The complaint alleged that the principal of the data subject's school deliberately entered the wrong attendance record. It was alleged that this was done to influence proceedings in a visitation case, where the parents of the data subject were engaged in court proceedings against each other. The complaint also stated that the principal was related to the mother of the data subject and that the attendance record was corrected by the school only after it was pointed out by the father. In its reply to the DPA, the school stated that the wrongful entry in the attendance record had been done by mistake. The school stated that access to attendance records is restricted and only the supervising teacher, office manager, and the principal have access. It was also stated that the attendance record was corrected as soon as it was brought to the notice of the school. The school stated that logs of all actions on the attendance systems are maintained and a monthly report is sent out to parents so that they can comment on the registration of attendance concerning their child. The DPA held that, pursuant to Article 4 GDPR, the school is the controller. However, the DPA said that it does not have the jurisdiction to decide whether the principal fed in the wrong attendance record on purpose. Nevertheless, for the processing of personal data to be lawful, it should be covered within the grounds mentioned in Article 6 GDPR. The DPA stated that Iceland has a law on the attendance of schoolchildren which created obligations for school managers and teachers. As per Article 8 Section 4 of the Act on Data Protection and the Processing of Personal Data and Article 5(1)(d) GDPR, it is the controller's responsibility to ensure data accuracy. As the attendance record was not accurate, the school violated Article 8 Section 4 of the Act on Data P
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021101909 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021101909 - Iceland (2022). Retrieved from cookiefines.eu
Last updated: