- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2022081290 – Complaint Upheld (Iceland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An applicant for a job in Iceland complained that she wasn't informed about how her personal data would be used during a background check. This case is important because it stresses the need for transparency in data processing.
What happened
The national emergency line conducted a background check without properly informing the applicant about the data processing.
Who was affected
A job applicant whose personal data was checked without clear communication about the process.
What the authority found
The Icelandic DPA found that the emergency line failed to provide adequate information regarding the processing of the applicant's personal data.
Why this matters
This case highlights the necessity for organizations to be transparent about how they handle personal data during hiring processes. It serves as a reminder that clear communication is essential for compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject applied for a position as an emergency operator at the national emergency line of Iceland. When applying, the data subject claimed that she only received information that a background check would be carried out on applicants but was not informed about the scope or purpose of processing of her personal data nor did she consent thereto. The national emergency line then asked the police commissioner look up the applicant’s personal information in the police case file and transmit it to the emergency line office. The data subject felt that the lack of transparency regarding the processing of her personal data constituted a violation of the GDPR, thus, on 31 August 2022, she filed a complaint against the National Police Commissioner with the Icelandic DPA. The DPA invited the police commissioner and the emergency line to submit their views. The national emergency line submitted that its close cooperation with the national police commissioner requires its employees to fulfil the requirement of passing a police background check, and this is provided for in the law on coordinated emergency response. The emergency line further added that applicants are informed about this check and they are asked to give their consent. Also, the emergency line considered that the police commissioner is the controller since it determines the purpose and means of processing and it is in the police interests to carry out such a check. The police commissioner submitted that it did not receive a copy of the data subject’s consent form but that the processing of her personal data is necessary due to the public interest in doing so and the exchange of information with the emergency line occurred on the basis of the [https://www.althingi.is/lagas/nuna/2019075.html National Act on processing of personal data for law enforcement purposes] implementing the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016L0680 LED]. First of all, the Icelandic DPA considered the po
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2022081290 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2022081290 - Iceland (2023). Retrieved from cookiefines.eu
Last updated: