- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
MAGNA Lögmenn (law firm) – Complaint Upheld (Iceland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Magna Lögmenn, an Icelandic law firm, accidentally shared sensitive personal data of a client in an email. The DPA upheld the complaint, indicating that the law firm mishandled personal data. This case highlights the importance of careful data handling in legal matters.
What happened
Magna Lögmenn disclosed sensitive personal data by sending it to the wrong email addresses.
Who was affected
The individual whose sensitive personal data was disclosed in the email.
What the authority found
The DPA concluded that Magna Lögmenn acted as a controller and mishandled personal data, breaching data protection laws.
Why this matters
This case emphasizes that law firms must handle personal data with care to avoid breaches. It serves as a warning to all businesses about the risks of improper data sharing.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In the context of a legal dispute, Magna Lögmen - an Icelandic law firm - disclosed the personal data of an individual (the Complainant) by sending a formal notice to (i) the Complainant's private Gmail address, and to (ii) the general email address of a Municipality. Several documents were attached to this email as exhibits, including a copy of the Complainant's previous employment contract, in which information relating to the salary and trade union membership of the Complainant could be found. The Complainant considered that, by sending this email, and in particular the copy of his previous employment contract, Magna Lögmen had disclosed sensitive personal data to the Municipality, and also to Google (the latter being the service provider of the Complainant's private email address). On this basis, the Complainant filed a complaint against Magna Lögmen with the Icelandic DPA, arguing that Magna Lögmen had breached the applicable data protection law. Magna Lögmen argued, for its part, that the processing of the Complainant's personal data was lawful because (i) necessary for the purposes of the legitimate interests pursued by the client of Magna Lögmen (Article 6(1)(f) GDPR) and, as far as sensitive personal data were concerned, (ii) necessary for the establishment, exercise and defence of a legal claim (Article 9(2)(f) GDPR). The Icelandic DPA, after reviewing the facts of the case and the applicable law, considered that Magna Lögmen was acting as a controller in the sense of the GDPR. In that respect, the Icelandic DPA pointed in particular that the law firm enjoyed a high level of independence and decision-making power when representing its client. In particular, the Icelandic DPA noted that the client did not specifically instruct the law firm as to how or why the personal data of the Complainant should be processed. As a result of this broad mandate, the Icelandic DPA concluded that Magna Lögmen should be considered as a 'controller' of the personal data, a
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for MAGNA Lögmenn (law firm) in IS
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
30 September 2021
Authority
Persónuvernd
About this data
Cite as: Cookie Fines. MAGNA Lögmenn (law firm) - Iceland (2021). Retrieved from cookiefines.eu
Last updated: