- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case Case no. 2021030666 – Dismissed (Iceland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic school administrator was found not to have violated data protection rules when discussing a teacher's evaluation at a meeting. The teacher claimed this sharing was unauthorized, but the administrator argued it was necessary for addressing parent complaints. This case underscores the balance between confidentiality and the need for transparency in educational discussions.
What happened
A school administrator shared results of a teacher's evaluation during a staff meeting without the teacher's consent.
Who was affected
The teacher whose evaluation results were discussed at the meeting with other school staff.
What the authority found
The Icelandic Data Protection Authority dismissed the case, stating the sharing of information did not constitute a violation of data protection rules.
Why this matters
This ruling suggests that sharing information in educational settings may be permissible under certain circumstances, especially when addressing concerns about student welfare.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
There was a dispute as to whether a controller, a school administrator, was allowed to refer to the results of a teaching evaluation concerning the data subject's teaching at a meeting, in which other school staff was present. The data subject argued that the controller had breached the GDPR when it shared information about the results of the teaching evaluation without consent. Such teaching evaluations were highly confidential and only the controller and the relevant teacher should have received a copy and discussed the results of the evaluation. The controller replied that the data subject was invited to the meeting for the purpose of discussing complaints of a parent regarding the data subject's behavior and assessment towards the students. No unauthorized parties had attended the meeting and all participants were bound by the statutory duty of confidentiality of government officials or employees regarding what was discussed. The controller also referred to the fact that the case only concerned the verbal communication of personal data, which was based on memory at the time. Therefore, it would not constitute "processing" of personal data in the sense of the GDPR. The controller further elaborated that teaching evaluation is an important part of the school's dashboard on teacher performance and necessary for quality management. The purpose of it is, among other things, to achieve the goals laid down in Icelandic law on secondary schools, to ensure that the school's activities are in accordance with the applicable regulations, the main curriculum and to increase the quality of learning and school work and to ensure that students' rights are respected and that they receive the services they are entitled to. The DPA first assessed whether the case fell within the scope of the GDPR. It mentioned that according to Article 4(2) GDPR "processing" means " means any operation or set of operations which is performed on personal data or on sets of personal data, whether
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Case no. 2021030666 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Case no. 2021030666 - Iceland (2022). Retrieved from cookiefines.eu
Last updated: