- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2025020471 – Order (Iceland, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic doctor accessed a person's medical records without permission, leading to a complaint. This case is significant because it emphasizes the importance of patient privacy and the need for strict access controls.
What happened
A doctor was found to have accessed a patient's medical records without authorization.
Who was affected
The individual whose medical records were accessed without consent.
What the authority found
The authority investigated the unauthorized access but the outcome of the investigation is not established in this record.
Why this matters
This case underscores the importance of protecting patient data and ensuring that only authorized personnel have access to sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 12 September 2023, a data subject filed a complaint with the Icelandic DPA against a doctor (the controller). The controller had a family connection to the data subject, as he was the father of the mother of the data subject’s child. The data subject alleged that the controller accessed his medical records without authorisation on multiple occasions between 19 October 2017 and 1 May 2021 and specifically on 19 October 2017, 18 May 2018, 6 May 2019, 17 June 2019, 20 August 2019, 28 April 2020, 14 September 2020, 15 September 2020 and 1 May 2021. The data subject argued that the controller was neither his doctor nor had he ever treated him as a patient. Additionally, the data subject noted that these unauthorised search queries occurred while he was in a relationship with the controller’s daughter. The DPA asked the controller and the Landspítali Hospital for their submissions, since the controller was a doctor of the hospital during that period. The hospital stated that the data subject sought medical assistance on three occasions (on 20 August 2019, 28 April 2020, and 1 May 2021). It noted that the processing of his personal data on these occasions was legitimate, as it was for his health benefit, at his request, and based on the therapeutic relationship between doctor and patient. Additionally, the hospital stated it could not confirm the lawfulness or proper authorisation of the other searches. The controller stated that from 2017 to 2021, he worked in the hospital and had access to the medical records system via hospital computers and remote access from his own computer, particularly during night shifts. He pointed out that he often assisted close relatives and their families with both major and minor health issues. Moreover, he claimed that during the period when the data subject was related to him, the latter also sought and received similar medical advice and assistance from him. He presented screenshots of their communications during this time, demonstrat
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025020471 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025020471 - Iceland (2026). Retrieved from cookiefines.eu
Last updated: