- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2025041148 – Complaint Upheld (Iceland, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An individual complained that a trade union improperly processed their salary information during collective bargaining. The Icelandic Data Protection Authority ruled that the union did not have a valid reason to process this data, which is crucial for protecting personal information.
What happened
The trade union processed the individual's salary information without a valid legal basis.
Who was affected
An individual whose salary information was processed by the trade union.
What the authority found
The Icelandic Data Protection Authority determined that the trade union violated data protection rules by processing the individual's personal data without proper justification.
Why this matters
This ruling highlights the need for organizations to ensure they have a valid legal basis for processing personal data, especially in sensitive areas like salary information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An individual (the data subject) lodged a complaint with the Icelandic DPA regarding the processing of information on his salaries by a trade union (the controller) in the interest of collective bargaining. The data subject considered the processing to be in breach of Article 5 GDPR, Article 6 GDPR, as well as Article 8 and Article 9 of Act no. 90/2018 on Data Protection and the Processing of Personal Data. The controller previously received an email from a different employee containing information on the contributions of all employees, including the data subject, to pension funds and trade unions. However, some of the employees whose information was contained in the email did not belong to the trade union. The information in the email became part of a table containing job titles and salaries which was later on communicated to the management and the board of directors of the controller in connection with a collective bargaining process, as well as to five other external recipients. The controller claimed that it processed the personal data based on its legitimate interest to analyse the salaries in the workplace where there was evidence of infringement of legal provisions on equal treatment in the labour market. The DPA held that the processing of personal data by the controller was not in accordance with Point 1 Paragraph 1 Article 8 and Article 9 of Act No. 90/2018 on Data protection and the Processing of Personal Data, as well as Article 5(1)(a) GDPR and Article 6(1) GDPR. In this sense, while the DPA accepted that the controller may process the personal data of the employees who belong to the trade union on the legal basis of legitimate interest, it also concluded that the controller’s legitimate interest did not outweigh the interests of the data subject. Furthermore, the DPA noted that the controller failed to bring to the data subject’s attention that their personal data were processed by the controller or to what extent, what the purpose of the processi
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025041148 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025041148 - Iceland (2026). Retrieved from cookiefines.eu
Last updated: