- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2021020374 – Complaint Upheld (Iceland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Iceland's Directorate of Fisheries filmed a fishing crew without their consent while inspecting for illegal activities. The Icelandic Data Protection Authority found that the filming did not meet legal requirements because it happened before a law allowed such actions. This case highlights the importance of having clear legal grounds for monitoring activities.
What happened
The Directorate of Fisheries filmed a fishing crew during an inspection without having the legal basis to do so at that time.
Who was affected
The fishing crew, including the captain, who were filmed without consent during an inspection.
What the authority found
The Data Protection Authority ruled that the Directorate lacked a valid legal basis for the filming, violating GDPR requirements.
Why this matters
This decision emphasizes that public bodies must have clear legal grounds for surveillance activities. Companies should ensure compliance with legal requirements before conducting any monitoring.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Icelandic Directorate of Fisheries (the controller) is a public body responsible, among other things, to supervise fishing activities by fishing vessels and conduct inspections, partially without prior notification. The data subject and his employees were fishing, when they realised they were being filmed by a vessel of the Directorate of Fisheries. The data subject, as the captain of the vessel, later received a letter by the controller reprimanding the crew for unlawful fishing activities against the Icelandic law on treatment of marine stocks making reference to the recordings in question. The controller was in fact able to identify the vessel and its crew by using a powerful binoculars camera. The data subject felt that his right to privacy had been violated by the controller and thus filed a complaint with the Icelandic DPA on 9 February 2021. The Icelandic DPA considered that the recording in question did not amount to electronic surveillance as defined in the Icelandic Law on Data Protection, since that requires the monitoring to be continuous or repeated on a regular basis. Still, the DPA held that all processing activities must be carried out in accordance with one of the legal bases set out in Article 6(1) GDPR and the principles of processing of Article 5(1) GDPR. The DPA specified that in order for the recording carried out by the Fisheries Directorate to be based on Article 6(1)(c) GDPR, there must be a clear provision in the law that allows for such processing to take place. In this case, the Act regulating the working of the Directorate of Fisheries, allows the Directorate to carry out inspections on fishing activities in Icelandic waters by accessing the vessels. Such Act was amended in 2022, adding a provision that explicitly allows the Directorate to use cameras for recording while carrying out its inspection duties. Yet, the monitoring in question took place in March 2020, when the above mentioned amendment had not been adopted yet. For thi
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021020374 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021020374 - Iceland (2023). Retrieved from cookiefines.eu
Last updated: