DPA case 2023030483 – Complaint Upheld (Iceland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Iceland's data protection authority upheld a complaint from a person who requested access to their personal data but received incomplete information. This is important because it emphasizes the right of individuals to access their data fully. Organizations must ensure they provide complete and accurate information when responding to data access requests.
What happened
The authority upheld a complaint regarding incomplete responses to a data access request.
Who was affected
The data subject, who sought access to their personal data, was affected by the incomplete information provided.
What the authority found
The authority found that the City of Reykjavík did not fully comply with the data subject's access request under data protection laws.
Why this matters
This ruling reinforces the importance of fulfilling data access requests completely. Organizations must be diligent in providing all requested information to avoid complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 3 February 2023, a data subject filed multiple access requests with the City of Reykjavík, the controller, asking to obtain a copy of her personal data processed in the context of her work permit applications from 1998 until 2023, in accordance with Article 15(3) GDPR. The controller replied with an incomplete set of documents containing data about the data subject. Then the data subject submitted a list of the missing data requested and the controller sent her seven additional documents and informed her that it could not find further data about her. However, the data subject was not satisfied with the documents provided by the controller, as some were still missing, thus she filed a complaint with the Icelandic DPA, also claiming that the controller failed to take the appropriate security measures under Article 32 GDPR, since it was not able to locate her data. In its submissions, the city of Reykjavík argued that the laws governing the issuing and storage of work permits had changed during the period covered by the data subject’s request. The controller also claimed that it answered the data subject’s request but it could not find all of the data requested. In addition to this, the controller argued that it took measures to ensure security of processing, including encryption, record keeping and access control. The DPA considered that the controller complied with the data subejct’s access request under Article 15(3) GDPR as it provided all the information available to it, even though in different occasions, but within the time limit set out in Article 12(3) GDPR. As a matter of fact, the DPA held that the right to access to one’s personal data only extends to existing personal data, hence, since the controller had conducted a thorough search and could not locate some of the missing data, the DPA was satisfied that the missing personal data was not available to the controller and thus could not be provided. As regards the security of processing, the DPA first
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2023030483 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2023030483 - Iceland (2023). Retrieved from cookiefines.eu
Last updated: