Icelandic DPA fines health care system IKr 5m for unlawful data processing

Institution failed to ensure that the mergers of healthcare records were authorized.

Heilsugæsla höfuðborgarsvæðisins (HH), an institution which operates 15 health care centres in the Reykjavik area in Iceland, has been fined IKr 5m ($35,844) by Personuvernd, the Icelandic Data Protection Authority, after processing personal data unlawfully. The institution manages a joint medical record system containing thousands of

The institution,

Free Trial

Register for free to keep reading.

To continue reading this article and unlock full access to GRIP, register now. You’ll enjoy free access to all content until our subscription service launches in early 2026.

  • Unlimited access to industry insights
  • Stay on top of key rules and regulatory changes with our Rules Navigator
  • Ad-free experience with no distractions
  • Regular podcasts from trusted external experts
  • Fresh compliance and regulatory content every day
Register for free Already a member? Sign in