- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Akureyri Hospital – Complaint Upheld (Iceland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Icelandic Data Protection Authority upheld a complaint against Akureyri Hospital for sending sensitive medical records to the wrong address. This is important because it shows that hospitals must be careful with personal data to protect patient privacy.
What happened
Akureyri Hospital mistakenly sent a woman's and her child's medical records to the wrong address.
Who was affected
A woman and her child, whose medical records were mishandled, were affected.
What the authority found
The authority found that the hospital failed to ensure secure handling of personal information as required by data protection laws.
Why this matters
This ruling highlights the need for healthcare providers to have strict procedures in place for handling sensitive data. It serves as a reminder for all organizations to prioritize data security.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 22 March 2026.
Processing notes: articles corrected, national law identified, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 11 May 2020 the DPA received a complaint from a woman whose hers and her child's medical records, which she had requested from the Akureyri Hospital, had been sent to the wrong address. Although she had specifically requested that the documents be sent to her, the letter had been sent to the address of her child, who is domiciled with her father. The data was sent by registered mail and returned to the Hospital in Akureyri unopened. At the hospital, they had been placed in another envelope and sent by registered mail to the complainant. The DPA held that, in view of the sensitive nature of the data in question, it was highly reprehensible that the Hospital in Akureyri did not ensure that the data was sent to the correct address. The procedures did not ensure adequate security of personal information according to Act no. 90/2018 on personal protection and the processing of personal information. In view of the above, the conclusion of the DPA is that the processing of the personal information of the complainant by the Hospital in Akureyri in the transmission of the complainant's and her child's medical records did not comply with Act no. 90/2018 on personal protection and processing of personal information. The DPA found no preconditions for imposing a fine.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Akureyri Hospital in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
12 March 2021
Authority
Persónuvernd
About this data
Cite as: Cookie Fines. Akureyri Hospital - Iceland (2021). Retrieved from cookiefines.eu
Last updated: