Icelandic DPA Imposed a Fine to the Ministry of Industries and Innovation and YAY ehf. for Data Processing through a Digital Gift Card App

The Icelandic Data Protection Authority (“DPA”) imposed a fine to the Ministry of Industries and Innovation and YAY ehf. due to the multiple infringements of the DPA with the decision dated 24th of November No. 2020092288.

The Icelandic government contracted a company that issued a digital gift card app based on an already existing app developed. After the app was first published, the DPA received tips from data subjects on the amount of personal data the app was using and the extensive access rights it claimed in the user’s mobile device.

In the decision, the DPA notes that due to the economic situation, a heavy emphasis was placed on the speed of both the programming and the publication of the app, resulting in inadequate adjustment of settings. This led to unlawful and unnecessary collection of considerable amounts of personal data and the collection of access rights to the user’s mobile devices.

With all that, requirements for consent for processing were not met, the information the data subjects received when signing into the app was inadequate and the controller and the processor had not ensured the appropriate security of the personal data.

The Ministry of Industries and Innovation was fined 7,5 million ISK (approx. 50.800 Euros)

The company YAY ehf. was fined 4 million ISK (approx. 27.100 Euros).

You can find the press release here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr