On March 4, 2024, the Icelandic data protection authority (Persónuvernd) announced that it had applied for leave to appeal against a judgment of the Reykjavík District Court from February 5, 2024, in case no. E-4081/2023, City of Reykjavík v. Personal Data Protection and the Icelandic state, which relates to two decisions on the processing of personal data under a municipality's responsibility in the Seesaw student system.

The Persónuvernd explained that the ruling of the District Court violates applicable law and international obligations under the data protection laws and the Agreement on the European Economic Area, and therefore, is unacceptable. The Persónuvernd detailed that the decision undermines the uniform application of the General Data Protection Regulation (GDPR) as well as the statutory responsibilities of the controller, the role of the privacy protection officer, its supervisory powers, and the special protection granted to children's personal information.

You can read the press release, only available in Icelandic, here.

Update: April 18, 2024

Persónuvernd granted permission to appeal to Supreme Court

On April 17, 2024, the Persónuvernd announced that it had been granted permission to appeal the case before the Supreme Court. The Persónuvernd highlighted that the Supreme Court held that the case is significant for the application and the interpretation of the law on personal protection and the processing of personal information. In addition, the Supreme Court considers that the case has an important precedential value as it would be the first time that a court would decide on the application of administrative fines by the Persónuvernd.

You can read the press release here and the Supreme Court judgment here, both only available in Icelandic.