DPA case Case no. 2021112113 – Dismissed (Iceland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic medical authority shared personal information about a medical department head during an investigation, which led to a complaint. The Icelandic Data Protection Authority dismissed the complaint, stating the authority acted within its legal rights. This case illustrates the complexities of privacy in public health investigations.
What happened
The medical authority disclosed personal information about a department head during an official investigation.
Who was affected
The head of the medical department whose information was shared.
What the authority found
The Icelandic Data Protection Authority found that the medical authority had a legal basis for sharing the information.
Why this matters
This case highlights the balance between transparency in public health investigations and individual privacy rights. Organizations should be aware of their legal obligations when handling sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is the Icelandic Office of the National Medical Examiner. The controller was established by national law and supervised health services and health workers and dealt with complaints from the public regarding health services. The data subject was the head of a medical department. At an unspecified time, "association X", a non-profit organisation representing the interests of patients, sent a message to the controller which criticised the management of the data subject's department and made suggestions to its improvement. Considering the suggestions, the controller started an official investigation case. According the Icelandic administrative law, the complainant is a party to the investigation. Further, based on law no. 37/1993 on "The Right to Information and the Duty to Provide Guidance", the parties to a case enjoy the right to be informed about it. Therefore, after the association sent multiple inquiries, the controller shared personal information about the data subject (the head of the department) in a letter which included, among other things, information that the data subject had been placed on indefinite leave and another person had taken over his job. Subsequently, the data subject issued a complaint the Icelandic DPA and argued that the controller had no legal basis for the processing. The data subject believed that the comments of the controller in the letter, regarding his indefinite leave, were presented as if they were specific sanctions due to what was stated in the criticism of association X. Moreover, the data subject believed that the association X was not a party in the investigation case and, thus, disclosure of such information could not have been possibly based on a law. (The data subject's arguments, as presented by the decision, do not go further in depth. However, it can be presumed that the data subject is, in effect, arguing the following: First, if the processing of the personal data can not be based on a law, Article 6(1
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Case no. 2021112113 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Case no. 2021112113 - Iceland (2022). Retrieved from cookiefines.eu
Last updated: