HEI – Medical Travel – €10,600 Fine (Iceland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
HEI – Medical Travel was fined €10,600 for sending unsolicited emails and not providing information about how they got a person's email address. This case is important because it shows that companies must have a legal reason to contact people and must be transparent about their data practices.
What happened
HEI – Medical Travel accessed a person's email without permission and sent unsolicited emails.
Who was affected
An individual whose email was accessed and used by HEI – Medical Travel without consent.
What the authority found
The Icelandic DPA found that HEI – Medical Travel lacked a valid legal basis for accessing and using the person's email, violating GDPR.
Why this matters
This ruling highlights the importance of respecting individuals' privacy and being transparent about data collection practices. Companies should ensure they have a legal basis for contacting individuals and must respond to requests for information about data processing.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Icelandic DPA has imposed a fine of EUR 10,600 on HEI - Medical Travel. A data subject had filed a complaint with the DPA against the controller. The controller had gained access to the data subject's email via the Icelandic Medical Association's internal website and had then sent them unsolicited emails. The DPA found that such access was unlawful due to the lack of a valid legal basis. In addition, the data subject had asked the controller for information about the processing of their personal data, such as the origin of the e-mail address. The controller did not properly comply with this request.
Related Enforcement Actions (0)
No other enforcement actions found for HEI – Medical Travel in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
3 May 2022
Authority
Persónuvernd
Fine Amount
€10,600
About this data
Cite as: Cookie Fines. HEI – Medical Travel - Iceland (2022). Retrieved from cookiefines.eu
Last updated: