- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
HEI – Medical Travel – €10,600 Fine (Iceland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
HEI – Medical Travel was fined EUR 10,600 for unlawfully accessing a user's email and sending unsolicited messages. The Icelandic data protection authority found that the company did not have a valid reason to access the user's data. This case serves as a reminder for businesses to ensure they have proper consent before handling personal information.
What happened
HEI – Medical Travel accessed a user's email through an internal website and sent unsolicited emails without consent.
Who was affected
A user whose email was accessed without permission and who received unsolicited communications from HEI – Medical Travel.
What the authority found
The authority determined that HEI unlawfully accessed personal data and failed to respond properly to the user's request for information about their data.
Why this matters
This case highlights the importance of obtaining consent before accessing personal data. Companies should implement clear policies to respect user privacy and respond to data requests appropriately.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Icelandic DPA has imposed a fine of EUR 10,600 on HEI - Medical Travel. A data subject had filed a complaint with the DPA against the controller. The controller had gained access to the data subject's email via the Icelandic Medical Association's internal website and had then sent them unsolicited emails. The DPA found that such access was unlawful due to the lack of a valid legal basis. In addition, the data subject had asked the controller for information about the processing of their personal data, such as the origin of the e-mail address. The controller did not properly comply with this request.
Related Enforcement Actions (0)
No other enforcement actions found for HEI – Medical Travel in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
3 May 2022
Authority
Persónuvernd
Fine Amount
€10,600
About this data
Cite as: Cookie Fines. HEI – Medical Travel - Iceland (2022). Retrieved from cookiefines.eu
Last updated: