DPA case 2020010726 – Dismissed (Iceland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person complained that a city department shared their personal information without permission. The Icelandic Data Protection Authority found that the department acted within legal boundaries. This case illustrates how local authorities can share information under certain conditions.
What happened
A city department shared personal information with another department without the individual's consent.
Who was affected
The individual whose personal information was shared between city departments.
What the authority found
The DPA concluded that the sharing of information was permissible and did not violate privacy laws.
Why this matters
This ruling clarifies that local authorities can exchange information when necessary. It serves as guidance for local governments on handling personal data.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In this case a data subject turned to the welfare department of the city Kópvagur (controller) for assistance with a housing problem. The data subject later filed a complaint about the processing of personal data with the DPA. The complaint was accompanied by a copy of the communication log between the data subject and the processor. The data subject claimed that the processor shared personal information without authorisation and knowlegde of the data subject. The claim related to the fact that the department of Kópvagur has shared the information with the department in Reykjavik. The controller, on the other hand, claimed to only have processed non-personally identifiable information. Additionally, the controller relied on the fact that there existed an authorisation for passing along the personal information. The DPA held that the processing of personal information by the city Kópavogur (controller) was admissible. Therefore the DPA comes to the conclusion that the controller acted in accordance with Act No 77 / 2000. The processing was necessary to fulfill a legal obligation according to Act 40 / 1991. Also, the DPA held that it is permissible for local authorities to exchange information about clients. Therefore the controller did not have the obligation to inform the data subject about the processing. The processing was fair and transparent and the personal information was obtained for a stated, clear and objective purpose.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010726 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010726 - Iceland (2023). Retrieved from cookiefines.eu
Last updated: