Who was sanctioned, and for what?

Persónuvernd (Icelandic Data Protection Authority) fined the operator of a fast-food restaurant chain in Iceland 1,500,000 ISK because the manager of one outlet had used footage from the surveillance cameras to check an employee's work and had produced annotated screenshots for that purpose. The authority found this to be unlawful processing outside the declared purpose of the surveillance and also criticised signs that did not name the controller and inadequate information for employees; it ordered the company to delete the screenshots, put up compliant signs in its outlets, inform employees and keep a record of processing activities.

Authority / court

Persónuvernd

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 Bst. a–c, Art. 6 Abs. 1, Art. 12 und 13 DSGVO; §§ 8, 9, 14 Abs. 1 und 4 und 17 Gesetz Nr. 90/2018 (isländisches Datenschutzgesetz); Regeln Nr. 837/2006 über elektronische Überwachung; Geldbuße nach § 46 Abs. 3 Gesetz Nr. 90/2018 i.V.m. Art. 83 Abs. 5 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Culpability

negligent

Mitigating circumstances

Only one outlet and relatively few people affected, no proven direct damage, only one documented instance of performance monitoring.

Liability of senior managers

The monitoring was carried out by the manager of one outlet; the authority stated that companies must instruct employees who have access to footage. The fine was imposed on the operating company.

Published

20 Mar 2024

Original amount 1,500,000 ISK, converted at the ECB reference rate of 12 Mar 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 12 Mar 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Persónuvernd (Icelandic Data Protection Authority) fined the operator of an Icelandic event hall 3,500,000 ISK after finding on 7 February 2023 that video surveillance during events held by third parties took place without a legal basis, without a specified legitimate purpose and without adequate information. Weighing heavily was that the cameras also covered rooms where children and young people stayed overnight as well as Covid-19 mass vaccinations, and that the surveillance had affected a very large number of people since at least 2008.

Authority / court

Persónuvernd

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 Bst. a und b, Art. 5 Abs. 2, Art. 6 Abs. 1 und Art. 13 DSGVO; § 8 Abs. 1 Nr. 1 und 2 und Abs. 2, §§ 9 und 17 Abs. 2 Gesetz Nr. 90/2018 (isländisches Datenschutzgesetz); Geldbuße nach § 46 Abs. 3 Gesetz Nr. 90/2018 i.V.m. Art. 83 Abs. 5 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

There was signage, albeit inadequate; the company cooperated with the authority and partly implemented the earlier orders; no financial damage (given little weight by the authority).

Published

17 Oct 2023

Original amount 3,500,000 ISK, converted at the ECB reference rate of 17 Oct 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 17 Oct 2025 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report