- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case Mál nr. 2022050993 – Dismissed (Iceland, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic authority dismissed a complaint against the City of Reykjavík for sharing a person's medical certificate among departments. The authority found that sharing was necessary for legal obligations, which shows the balance between compliance and privacy in sensitive cases.
What happened
A person's medical certificate was shared between city departments without their consent.
Who was affected
The individual who submitted the medical certificate to the city for childcare assistance was affected.
What the authority found
The authority ruled that sharing the medical information was necessary for legal compliance, thus no violation occurred.
Why this matters
This case illustrates how legal obligations can sometimes require sharing personal data, emphasizing the need for clear communication about data use.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject applied to the City of Reykjavík (the controller) to continue receiving state-funded child care. By proving her medical inability to work, the state is legally obliged to provide child care for her. She therefore sent her medical certificate assesing her fitness to work to the controller. She signed a consent form, where it was stated that the data that would be obtained on the basis of it would not be used for any other purpose than to process the application. Nonetheless, her medical certificate was handed over between departments and divisions of the city, as well as to the city attorney and from there to third parties (court-appointed appraisers). The data subject complained that her confidentiality had not been respected and that the city did not implement appropriate technical and organisational measures The Icelandic DPA rejected the complaint on the basis of Article 6(1)(C) GDPR as the processing was necessary for compliance with a legal obligation to which the controller was subject to. First, the assesment of her medical condition, and thus the processing of her medical certificate by the controller is a mandatory requirement under national law. In order to receive state-funded child care, it is required that a medical certificate be provided. Second, the city attorney represents the City of Reykjavík and its institutions. His access to the medical certificate was also required by national law because due to doubts about the wording in the complainant's medical certificates, the School and Leisure Department of the City of Reykjavík requested a legal opinion from the city attorney on whether the medical certificate in question met the aforementioned conditions of the regulation on work skills. Third, the communication by the city attorney of the complainant's personal information to her attorney and court-appointed evaluators was legally processed under Article 6(1)(f). The data subject was (at the time) party to another civil case be
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Mál nr. 2022050993 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Mál nr. 2022050993 - Iceland (2024). Retrieved from cookiefines.eu
Last updated: