DPA case Case no. 2021020294 – Dismissed (Iceland, 2022)

The controller was a secondary school. The data subject had been a teacher at the school. In November 2018, the data subject requested a meeting with her fellow teachers to discuss the case of another teacher (teacher C) who, according to her, had been bullied for years. The data subject defended teacher C and, among other things, requested that a psychologist was brought in to assess the situation. According to the school administrator, the data subject had been insulting and shown a lack of respect for her colleagues in view of the sensitive topic of discussion during the meeting. Following the incident, the administrator received emails from the data subject's fellow teachers concerning the improper behaviour of the data subject. In February 2019, the controller was informed by the Ministry of Education about a complaint by the data subject, in which she argued that she had suffered mental abuse in the November 2018 meeting. The same year, the school was required to rearrange its employment structure in the course of which the data subject and teacher C were dismissed. In November 2019, the school received a letter from the Parliamentary Ombudsman, requesting the school's opinion regarding the joint complaint of the data subject and teacher C, who argued that their dismissals had been illegal. In 2021, the data subject sent a complaint to the Icelandic DPA. She argued that after she had sent her complaint to the Ministry, the school administer started collecting her personal data through her former colleagues and shared it with the Ministry. Both happened without her consent (see Article 6(1)(a) GDPR) and without informing her of the existence of the data (see Article 14 GDPR). The illegally processed personal data would be used against her in the proceedings in front of the Ministry and the Ombudsman. The administer of the school denied having actively collected information about the data subject from other teachers. The existing information was sent b