Persónuvernd (Iceland) · 28 March 2023
Icelandair
About: DPIA, Data principles, Data subject rights, Unlawful processing
FineNo fineViolation found
- Regulator
- Persónuvernd (Iceland)
- Decided
- 28 March 2023
- Country
- Iceland
- Sector
- Not given
- Regulator’s reference
- 2022050940
- Fino case number
- 2023/IS/015
What happened
The Icelandic DPA held that by encouraging its staff to evaluate each other's performance in an app after each flight, Icelandair violated the principles of data minimisation, lawfulness, fairness and transparency and should have conducted a prior data protection impact assessment.
Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)Read →
- Art. 6Lawfulness of processingRead →
- Art. 15Right of access by the data subjectRead →
- Art. 35Data protection impact assessmentRead →
- DPIA
- Data principles
- Data subject rights
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2023/IS/015.