Persónuvernd (Island) - 2025041148
From GDPRhub
| Persónuvernd - 2025041148 | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Persónuvernd (Island) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 8 of Act no. 90/2018 on Data Protection and the Processing of Personal Data Article 9 of Act no. 90/2018 on Data Protection and the Processing of Personal Data |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 05.02.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2025041148 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | island.is (in IS) |
| Initial Contributor: | dt |
The DPA reprimanded a trade union for processing information about an employee’s salary in order to analyse the workplace’s compliance with legal equal treatment provisions during the course of collective bargaining procedures.
English Summary
Facts
An individual (the data subject) lodged a complaint with the Icelandic DPA regarding the processing of information on his salaries by a trade union (the controller) in the interest of collective bargaining. The data subject considered the processing to be in breach of Article 5 GDPR, Article 6 GDPR, as well as Article 8 and Article 9 of Act no. 90/2018 on Data Protection and the Processing of Personal Data.
The controller previously received an email from a different employee containing information on the contributions of all employees, including the data subject, to pension funds and trade unions. However, some of the employees whose information was contained in the email did not belong to the trade union.
The information in the email became part of a table containing job titles and salaries which was later on communicated to the management and the board of directors of the controller in connection with a collective bargaining process, as well as to five other external recipients.
The controller claimed that it processed the personal data based on its legitimate interest to analyse the salaries in the workplace where there was evidence of infringement of legal provisions on equal treatment in the labour market.
Holding
The DPA held that the processing of personal data by the controller was not in accordance with Point 1 Paragraph 1 Article 8 and Article 9 of Act No. 90/2018 on Data protection and the Processing of Personal Data, as well as Article 5(1)(a) GDPR and Article 6(1) GDPR.
In this sense, while the DPA accepted that the controller may process the personal data of the employees who belong to the trade union on the legal basis of legitimate interest, it also concluded that the controller’s legitimate interest did not outweigh the interests of the data subject.
Furthermore, the DPA noted that the controller failed to bring to the data subject’s attention that their personal data were processed by the controller or to what extent, what the purpose of the processing was or who the recipients of the data were.
Therefore, the DPA issued a reprimand to the controller under Point 2 Article 32 of Act No. 90/2018.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
The Data Protection Authority has ruled that a trade union was not permitted to use information about the complainant's contribution payments for the purpose of examining the salary structure of employees at a particular workplace and setting up a table with a reference to the job title and salary paid for the relevant job. The table was subsequently distributed in a letter to the employer, the board and management of the workplace for the purpose of wage negotiations, in addition to the members of the trade union's negotiating committee receiving a copy of the letter. In the case, it was established that the trade union had received an email from an employee of the workplace that contained returns for pension fund and union dues for all employees, but only some of the employees at the workplace belong to the trade union. In the complainant's opinion, the trade union should have been aware that this was irrelevant personal information that the company was not permitted to work with and use. The trade union, however, referred to the legitimate interests of the processing, i.e. to analyze wage setting at a workplace where there were indications, in the opinion of the trade union, that its members were being violated, cf. e.g. against Act No. 150/2020 on equal status and equal rights of the sexes and Act No. 86/2018 on equal treatment in the labour market. The processing was therefore based on point 6 of Article 9 of Act No. 90/2108, cf. point f of the first paragraph of Article 6 of Regulation (EU) 2016/679. The conclusion of the Data Protection Authority was that it could not be determined from the case documents that the complainant had been made aware that his personal data was being processed by the trade union or to what extent, what the purpose of the processing was or who the recipients of the information were. As was the case here, the Data Protection Authority therefore considered that the legitimate interests of the trade union did not outweigh the interests of the data subject. The processing of the personal data was therefore not considered to be compatible with point 1 of paragraph 1 of Article 8 and Article 9 of Act No. 90/2018 and point a of paragraph 1 of Article 5 and paragraph 1 of Article 6 of Regulation (EU) 2016/679. The decision-makers received a complaint about the processing of personal data by [trade union X] in case no. 2025041148:Case procedure1. On 15 April 2025, the Data Protection Authority received a complaint from [A] (hereinafter the complainant) about the processing of his personal data by [trade union X] (hereinafter [X] or the company).2. The Data Protection Authority invited [X] to comment on the complaint by letter dated 23 September 2025, and responses were received on 3 November 2025. The complainant was given the opportunity to submit comments on [X]'s responses by letter dated 7 p.m., and they were received by email on 21 p.m. Finally, [X] was invited to comment on the complainant's comments, and the company's responses were received on 11 December 2025.3. All of the above-mentioned data has been taken into account in resolving the case.Subject of dispute4. The dispute concerns [X's] authorization to process information about the complainant's salary in connection with correspondence to [workplace Y] (hereinafter [Y] or […]) for the purpose of wage negotiations.Facts of the case and available data5. It is known that [X] received, by email from employee [Y], information about the premium payments of all employees of [Y], including on m. complainant, in a pension fund and unions for September and November [year], but only part of the staff of [Y] belongs to [X]. Subsequently, the managers of [X] used the information to examine the salary setting of different groups of employees of [Y] and set up a table with reference to the job title and salary paid for the relevant job. That table was communicated in a letter to the managers and board of [Y], in connection with wage negotiations between [X] and [Z] on behalf of [Y].6. In the case, there is a copy of the aforementioned letter [X] to the managers and board of [Y], dated [date]. There are also copies of the correspondence between [X]'s lawyer and [Y]'s lawyer, which took place subsequently. The parties' viewsThe complainant's main views7. The complainant relies on the fact that [X] was not authorized to process his personal data at the time in question. The company should have been aware that the personal data in question was irrelevant and that it was not permitted to process and use it. The complainant considers that the processing is not in accordance with the principles of data protection legislation and has not been based on a processing authorisation, cf. Articles 8 and 9 of Act No. 90/2018 on the Protection of Personal Data and the Processing of Personal Data and Articles 5 and 6 of Regulation (EU) 2016/679. 8. In comments to [X]'s response letter, the complainant refers to the fact that the managing director of [Y] has confirmed that his personal data has been shared with five parties outside [Y]. It is therefore not correct that his personal data has only been shared with the top management of [Y], as [X] claims in his response letter to the Data Protection Authority. [X] cannot therefore confirm that the personal information has been deleted for everyone who received it, although it may have been deleted by the company. Main points of view [X]9. [X] has based its argument on the fact that the personal information of the complainant in question was not processed. The company received an email from employee [Y] containing returns for pension fund and union dues, which in [X]'s opinion told a certain story about salary setting within [Y]. [X] has made the information non-personally identifiable by setting up a table with a reference to the job title and salary paid for the relevant job. Only that table was communicated in a letter to the management and board of [Y], no salary information for employees by name.10. If the Data Protection Authority concludes that personal information has been processed, it is based on the fact that the processing was [X] permitted on the basis of point 6 of Article 9. Act No. 90/2018 and Article 6(1)(f) of Regulation (EU) 2016/679. The company indicates that the interests in the processing were legitimate, i.e. to analyze wage setting at a workplace where, among other things, there were indications that there was a violation against members of [X], cf. e.g. against Act No. 150/2020 on equal status and equal rights of the sexes and Act No. 86/2018 on equal treatment in the labor market. The purpose of the processing was to summarize the gap that had arisen in wage setting between members of [X] on the one hand and [….] and other key employees of [Y] on the other. The aforementioned table was therefore communicated to the senior management of [Y], i.e. the Chairman of the Board, the Managing Director and [….], as well as the Board, in connection with wage negotiations. The processing of the information was necessary for this purpose, as the company has the role of safeguarding the interests of its members. Furthermore, the interests of other employees in having their salaries at [Y] kept secret did not outweigh these interests of members of [X]. 11. [X] also refers to the fact, in connection with the above-mentioned assessment of interests, that only the company's managing director saw the complainant's personal information received by e-mail from employee [Y]. The personal information in question never went outside the company's office and the recipients of the letter, dated [date], already had the salary information by job title that was communicated. It is later confirmed in [X]'s response letter to the Data Protection Authority, regarding the confirmation by managing director [Y] that letter [X] had been communicated to five parties outside [Y], that those who received a copy of the letter were members of the [X] negotiating committee. It is noted that the committee consists of five members of [X], in addition to the chairman and managing director [X]. The negotiating committee acts on behalf of [X] and the committee members are bound by confidentiality regarding all information they receive in their work for the company and have borne joint responsibility for the matter. [X] has therefore never distributed the information to an unauthorized third party. 12. Finally, [X] confirms that the data that the company's managing director received in an email from employee [Y] has been deleted. The company has also requested that the parties within the company who received the letter delete it. Premises and conclusionLegal environment13. Scope of application of Act No. 90/2018 on the protection of personal data and the processing of personal data and Regulation (EU) 2016/679, cf. Paragraph 1 of Article 4 of the Act, and thus the competence of the Data Protection Authority, cf. Paragraph 1 of Article 39 of the Act. of the Act, covers the processing of personal data that is partly or wholly automated and the processing by means other than automated means of personal data that are or are to become part of a register. According to Article 39 of Act No. 90/2018, every data subject or their representative has the right to submit a complaint to the Icelandic Data Protection Authority if they consider that the processing of personal data about them in Iceland or according to the special rules of Article 7 of the Act violates the Act or Regulation (EU) 2016/679.14. [X] has based its claim that no personal data about the complainant in question has been processed. The company has only processed salary information about employees [Y] by their job titles. 15. Personal data is defined as any information about an identified or identifiable individual, cf. Point 2 of Article 3 of Act No. 90/2018. An individual is considered identifiable if he or she can be identified, directly or indirectly, such as by reference to an identifier such as a name, social security number, location data, online identifier or one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity. The comments to Article 3 of the explanatory memorandum to the bill that became Act No. 90/2018 state, among other things, that the concept of personal data is broad and covers all information, opinions and comments that can be directly or indirectly linked to a specific individual, i.e. information that is personally identifiable or personally identifiable. 16. It is known that [X] received information about the complainant's contributions to a pension fund and a trade union. The company used the information to examine the salary setting of different groups of employees [Y] and to prepare correspondence with [ Y]. A table was set up with a reference to the job title and salary paid for the relevant job, but the complainant is the only employee [Y] who holds a specific job. It was thus possible to identify the complainant based on the identification of the job title and link the salary information to him. All of the above information is therefore considered personal information about him within the meaning of the provisions set out in paragraph 15 above.The case therefore concerns the processing of personal data about the complainant and thus the competence of the Data Protection Authority, cf. Article 4(1), Article 1(2) and Article 39(1) of the Act. 17. The controller is the natural person, legal person, public authority or other body which, alone or in cooperation with others, determines the purposes and means of the processing of personal data, cf. Article 3(6) of Act No. 90/2018 and Article 4(7) of Regulation (EU) 2016/679.18 All processing of personal data must fall under one of the authorisation provisions of Article 9 of Act No. 90/2018, cf. Article 6(1) of Regulation (EU) 2016/679. According to Article 6(6) of of the statutory provision and point (f) of the regulatory provision, the processing of personal data may be permitted if it is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh them. 19. In order for processing to be considered permitted on the basis of the cited provisions, three conditions must be met. First, the processing must be carried out for the purposes of the legitimate interests pursued by the controller or a third party. Second, the processing must be necessary for the purposes of the legitimate interests pursued. Third, the interests or fundamental rights and freedoms of the data subject which require the protection of personal data must not outweigh the legitimate interests referred to. The third condition requires an assessment of interests, where the legitimate interests in the processing are weighed against the interests of the data subject. 20. In addition to the authorisation as stated above, the processing of personal data must be compatible with all the principles of Article 8(1) of Act No. 90/2018, cf. Article 5(1) of Regulation (EU) 2016/679. This stipulates, among other things, that personal data shall be processed lawfully, fairly and transparently in relation to the data subject, cf. point 1 of the legal provision and point a of the regulatory provision. The controller is responsible for ensuring that the processing of personal data always complies with the principles of data protection legislation and must be able to demonstrate this, cf. Article 8(2) of the Act, cf. 2. paragraph. Article 5. of the Regulation. Conclusion21. According to the available data, [X] determined the purpose and means of the processing of personal data at issue here, namely the use of information about the complainant's premium payments in connection with correspondence to [Y] for the purpose of wage negotiations. [X] is therefore considered to be the controller of the processing, cf. point 6. of Article 3. of Act No. 90/2018 and point 7. of Article 4. of Regulation (EU) 2016/679. 22. [X] has based, among other things, that the processing of personal data in question was permitted on the grounds that it was necessary for the legitimate interests of its members, which outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, pursuant to point 6. of Article 9. of Act No. 90/2018 and Article 6(1)(f) of Regulation (EU) 2016/679. As is the case here, in the opinion of the Icelandic Data Protection Authority, it cannot be seen that other processing authorisations under the aforementioned provisions can be considered.23. It is apparent that [X] processed information about the complainant's salary in connection with collective bargaining on behalf of its members for the purpose of pointing out what, in the opinion of the company, would indicate that there was a violation against its members, including under Act No. 150/2020 on Equal Status and Equal Rights of the Gender Equality and Act No. 86/2018 on Equal Treatment in the Labour Market, cf. discussion in paragraph 10. [X] is an interest, professional and trade union association [….]. Its role is to protect the interests of its members and the company has full negotiating authority for its members in collective agreements with employers, including. to [Y]. The Data Protection Authority is of the opinion that the processing of employees' salary information, in connection with collective bargaining negotiations, may therefore be [X] necessary for the legitimate interests pursued by the company. 24. With regard to the third condition, concerning the assessment of the legitimate interests pursued by the controller against the interests, fundamental rights and freedoms of the data subject which require the protection of his personal data, it is to be considered that in the above-mentioned assessment of interests, it may, among other things, be relevant whether the controller complies with other provisions of the data protection legislation during the processing, such as those concerning fairness and transparency, as well as the legitimate expectations of the data subject. In the opinion of the Data Protection Authority, it cannot be concluded from the evidence in the case that the complainant was made aware that his personal data was being processed by [X] or to what extent, what the purpose of the processing was or who the recipients of the information were. As is the case here, the Data Protection Authority therefore considers that the legitimate interests pursued by [X] did not outweigh the interests of the data subject. 25. In view of all the above, the Data Protection Authority considers that the processing of the complainant's personal data by [X], which is under discussion here, was not in accordance with point 1 of paragraph 1 of Article 8 and Article 9 of Act No. 90/2018 and point a of paragraph 1 of Article 5 and paragraph 1 of Article 6 of Regulation (EU) 2016/679. 26. Despite this conclusion, it is not possible to give the company an order to delete personal data on the basis of point 7 of Article 42 of Act No. 90/2018, in light of what has been stated in [X]'s responses, cf. discussed in paragraph 12, that the complainant's personal data have already been deleted. Decision on the exercise of powers27. The Data Protection Authority may issue a warning to the controller or processor if processing operations have infringed Regulation (EU) 2016/679, cf. point 2 of Article 42 of Act No. 90/2018, and may impose administrative fines on those who, intentionally or negligently, infringe any of the provisions of the Regulation listed in paragraphs 2 and 3 of Article 46 of Act No. 90/2018, cf. points 1 and 5 of that Act. According to point 1 of paragraph 3 of Article 46, these include provisions on the fundamental principles of processing, including those pursuant to paragraph 1 of Article 5 and paragraph 1 of Article 6. of the Regulation.28. When deciding whether the above provisions on the authority to impose a fine shall be applied, as well as on the amount of the fine, consideration shall be given to the 1st paragraph of Article 47 of Act No. 90/2018, which provides for the factors that may be assessed in favour of or against the person concerned. Having regard to the considerations specified in the referenced provision and all the circumstances of the case, as well as taking into account the rules of proportionality, cf. the 1st paragraph of Article 83 of Regulation (EU) 2016/679 and Article 12 of the Administrative Procedure Act No. 37/1993, there are not sufficient grounds to impose an administrative fine on [X] for the violations of the data protection legislation set out in paragraph 25 above. However, it is considered appropriate to issue [X] a warning, cf. point 2. Article 42 of the Act, due to the aforementioned violations. Ruling: [Union X]'s use of personal data [A] in question was not in accordance with point 1 of paragraph 1 of Article 8 and Article 9 of Act No. 90/2018 on the protection of personal data and the processing of personal data and point a of paragraph 1 of Article 5 and paragraph 1 of Article 6 of Regulation (EU) 2016/679. [Union X] is hereby given a warning, cf. point 2 of Article 42 of Act No. 90/2018, due to the aforementioned violations. Personal Data Protection, 5 February 2026Bjarni Freyr RúnarssonEdda Þuríður Hauksdóttir
