Reykjanesbær municipality – €16,600 Fine (Iceland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Reykjanesbær municipality was fined EUR 16,600 for not properly following data protection rules when using Google Education. They failed to ensure that student data was only used for its intended purpose and kept it longer than necessary. This case highlights the importance of careful data handling, especially for sensitive information like children's data.
What happened
Reykjanesbær municipality used Google Education without complying with data protection regulations.
Who was affected
Students whose data was processed by Google Education through the municipality were affected.
What the authority found
The authority found that Reykjanesbær did not meet its obligations in selecting Google as a service provider and failed to protect sensitive data properly.
Why this matters
This ruling emphasizes that municipalities must ensure compliance with data protection rules when using external services. Other organizations should review their data agreements and practices to avoid similar issues.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Icelandic DPA has imposed a fine of EUR 16,600 on the municipality of Reykjanesbær. The municipality had used the Google Education system without sufficiently complying with data protection regulations. In particular, the municipality did not fulfill its obligations when selecting Google as a processor and the processing agreement with Google did not comply with data protection requirements. Furthermore, the municipality did not ensure that the student data was not processed for purposes other than those specified by the municipality. Furthermore, the retention period was not considered appropriate but rather too extensive. In imposing the fine, particular consideration was given to the protection of sensitive children's data. Although no demonstrable damage had occurred, it was criticized that Reykjanesbær had not sufficiently ensured the secure transfer of data to the US in the past. However, the municipality cooperated transparently with the data protection authority and revised its data protection practices.
Related Enforcement Actions (0)
No other enforcement actions found for Reykjanesbær municipality in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 December 2023
Authority
Persónuvernd
Fine Amount
€16,600
Enforcement Tracker ID
ETid-2139
About this data
Cite as: Cookie Fines. Reykjanesbær municipality - Iceland (2023). Retrieved from cookiefines.eu
Last updated: