Full text
29 paragraphsThe Data Protection Authority has made a decision regarding a preliminary investigation into the processing of personal data in connection with the electronic surveillance of parking lots at the airports of Isavia Domestic Airports Ltd. (Reykjavik Airport, Akureyri Airport, Egilsstaðir Airport, Ísafjörður Airport, and Sauðárkrókur Airport). The inspection focused on whether the signage and information provided about electronic surveillance complied with the requirements of data protection legislation.The decision concludes that at the time the Data Protection Authority's initiative investigation began, on June 30, 2025, the signage and information about electronic surveillance at Akureyri Airport, At the time the Data Protection Authority's proactive investigation began, on June 30, 2025, the signage and information regarding electronic surveillance at Akureyri Airport, In this regard, it was noted that the information provided was, at that time, materially insufficient at Isafjordur Airport and Sauðárkrókur Airport.
This was due in part to the fact that the training at the time was substantively inadequate at Isafjordur Airport and Saudarkrokur Airport. Additionally, training was not provided in a timely manner at Akureyri Airport. Finally, the signage at Akureyri Airport, Isafjordur Airport, and Saudarkrokur Airport was not positioned in such a way that data subjects were alerted to the surveillance before entering the monitored area.However, the Data Protection Authority found that the signage and information about electronic surveillance in the company's airport parking lots were now, following improvements by the company, such that they complied with the company's obligations under the requirements of data protection law. It was therefore not considered appropriate to issue an order for corrective action, but it was deemed appropriate to issue a reprimand for a violation of the transparency and information obligations of the Act No. 90/2018 and the regulation (EU) 2016/679.
Decision in an own-initiative investigation on the processing of personal data in connection with the electronic surveillance of parking lots at the airports of Isavia Domestic Airports Ltd. in case no. 2025061555: Procedural matters Facts of the case 1. By letter dated March 20, 2025, Isavia Domestic Airports Ltd. (hereinafter Isavia INN or the company) was notified that an initial investigation had been launched into the processing of personal data at the company in connection with the electronic surveillance of parking lots at airports under its jurisdiction. In deciding to initiate the above-mentioned preliminary investigation, the Data Protection Authority took into account a complaint it received on September 16, 2024, which concerned, among other things, the electronic monitoring of license plates for the purpose of charging fees at the open parking lots of Reykjavik Airport and Akureyri Airport, without adequate signage indicating the monitoring.2.
After reviewing the response letter from Isavia INN and its accompanying documents in the aforementioned preliminary investigation case, the Data Protection Authority decided to initiate an investigation on its own initiative regarding the processing of personal data that the aforementioned preliminary investigation concerned, pursuant to Article 2. para. 32 of Regulation No. 1150/2023 on the procedures of the Icelandic Data Protection Authority, and to initiate an administrative proceeding in that regard. Isavia INN was notified of that decision by letter dated June 30, 2025.3. The decision to initiate the above-mentioned proactive investigation was based on 1 and 3. subsections 1 and 3 of Article 39 of the Personal Data Processing Act No. 90/2018 and Article 30, as per Article 32(2) of Regulation No. 1150/2023 on the Procedures of the Data Protection Authority.4. The purpose of the investigation was to examine whether Isavia INN had complied with Law No. 90/2018 and Regulation (EU) 2016/679 in its aforementioned processing of personal data, particularly with regard to the transparency of the processing, see item 1.
applies Art. 32(2), Art. 2, Art. 30, Art. 39
Article 8(1) of the Act and Article 5(1)(a) of the Regulation, and the provision of information to data subjects, pursuant to Article 14(1) and Article 17(1) of the Act and Articles 12 and 13 of the Regulation, and subsection 14(1) and subsection 17(1) of the Act and Article 12(1) and Article 13 of the Regulation, see also the Personal Data Authority's Rule No. 50/2023 on electronic monitoring.5. Responses from Isavia INN, along with supporting documents, were received by letter dated August 20 and December 22, 2025. Investigation of the Case 6. In the aforementioned letter, dated June 30, 2025, the Data Protection Authority requested further information from Isavia INN on how the company's processing was considered to comply with the main principles of Article 8(1) of Act No. 90/2018, pursuant to Article 5(1) of the regulation (EU) 2016/679. In the same letter, the Authority requested information on how signage for electronic surveillance was handled in the company's airport parking lots, whether it was general video surveillance or license plate surveillance, etc.e. whether the data subjects were informed of the surveillance before entering a monitored area, driving past a license plate camera, or otherwise entering the cameras' field of view, in accordance with Article 13 of Regulation (EU) 2016/679.
applies Art. 5(1), Art. 5(1)(a), Art. 8(1), Art. 12(1), Art. 14(1), Art. 17(1), Art. 12, Art. 13
Additionally, screenshots from all surveillance cameras present at the company's airports showing the field of view of each camera were requested, as well as an overview map of each airport's parking lot with the location of all cameras and any signage indicating electronic surveillance marked on it. Responses from Isavia INN, along with supporting documents, were received by the Data Protection Authority, as previously noted, in letters dated. August 20 and December 22, 2025.Issue 7. The Data Protection Authority's proactive investigation concerned the electronic surveillance by Isavia INN of the company's airport parking lots, whether involving general video surveillance or license plate surveillance. The investigation focused on whether signage regarding electronic surveillance was present in all areas covered by the monitoring; whether data subjects were informed of the surveillance before entering a monitored area; and whether the information provided to data subjects complied with legal requirements.Existing Data8.
The following documents were attached to the response letter from Isavia INN, dated August 20, 2025: i. Signs, an overview map, and screenshots from security cameras in the parking lots at Reykjavik Airport. The overview map shows the location of all electronic surveillance signs as well as the location of license plate cameras. The images show four designs for the signs. On three of them, it is stated that Isavia INN is the controller of the surveillance, and its purpose is for billing, security, and property protection. The signs also feature a QR code that leads to the company's privacy policy, where more information can be found. It is stated that on one of these signs, which indicates that toll areas are ahead, the information has been added. Another type of sign does not draw attention to electronic surveillance but instead reminds users of the toll requirement and displays a different QR code that links to a webpage with more information about the airport's parking facilities, including information about electronic surveillance.
The document states that only license plate cameras are used on roads operated by Isavia INN. Screenshots from the license plate cameras show that their field of view covers the front of the vehicle (front grill) and the license plate. ii. Signage, overview images, and screenshots from security cameras in the parking lots at Akureyri Airport. An overview image shows the location of all cameras and electronic surveillance signs, as well as the planned locations for signs that were intended to be updated or added. The images show three designs for the signage. The first image shows a sign which states, among other things, that Isavia INN is the controller of the surveillance and its purpose is stated as fee collection and security and property protection. The second image shows a picture of a sign that was not in place but was planned to be installed in three locations before entering the monitored area, which states that Isavia INN is the data controller for the monitoring and its purpose is for security and property protection.
Both of the above-mentioned types of signs include a QR code that leads to the company's privacy policy, where further information can be found. The third type of sign does not alert to electronic surveillance but instead reminds people of the fee requirement and displays a different QR code that links to a web address with more information about the airport's parking facilities, including electronic surveillance. A photograph shows an example of a sign that was intended to be updated, which generally warns of electronic surveillance in the area, i.e., without further information about the surveillance or a reference to where it can be found. Screenshots from security cameras and an overview image show that their field of view covers the majority of the parking lot. Screenshots from license plate cameras show that their field of view covers the front of the vehicle (radiator grille) and the license plate.iii.
Signage, an overview image, and screenshots from security cameras in the parking lots at Egilsstaðir Airport. The first overview image shows the location of license plate cameras and electronic surveillance signs, as well as the planned location of signs that were to be updated or added. The second overview image shows the location of other security cameras and their field of view. The images show three designs for the appearance of the signs. The first image shows a sign which states, among other things, that Isavia INN is the controller of the monitoring and its purpose is stated as fee collection and security and property protection. The second image shows a picture of a sign that was planned to be installed in four locations, including at entrances before entering the monitored area, which states that Isavia INN is the data controller for the surveillance and its purpose is for security and property protection.
Both of the above types of signs include a QR code that links to the company's privacy policy, where further information can be found. It is stated that at the four locations where new signs were planned, signs were already in place, but photographs of them show signs stating that the area is under surveillance. The third type of sign does not alert people to electronic surveillance but instead reminds them of the parking fee and displays a different QR code that links to a webpage with more information about the airport's parking, including information about electronic surveillance. Screenshots from security cameras and an overview image show that their field of view covers the entire parking lot. Screenshots from license plate cameras show that their field of view covers the front of the vehicle (front grill) and the license plate.iv. Signage, an overview image, and a screenshot from a security camera in the parking lot at Isafjörður Airport.
The overview image shows the location of two electronic surveillance signs, one on the terminal building and the other between it and the adjacent building, as well as the location of, among other things, the security camera facing the airport parking lot. Also included were photos of the proposed signage and a description of the existing signs, which had generally warned of electronic surveillance. It is stated that the updated signs will, among other things, indicate that Isavia INN is the controller of the surveillance and that its purpose is for security and property protection. The QR code on the sign will lead to the company's privacy policy, where further information can be found. A security camera screenshot and an overview image show that its field of view covers the inner part of the driveway and part of the parking lot. Signage, an overview image, and security camera screenshots at the parking lot at Sauðárkróksflugvöll.
Photographs show the location of two signs that alert to electronic surveillance, one on a light pole in the middle of the parking lot and the other in a window of the terminal building. It is stated that an update to these signs is planned, and a picture of their new design is shown. It states, among other things, that Isavia INN is the controller of the monitoring. The purpose of the monitoring is for security and property protection. A QR code on the sign leads to the company's privacy policy, where further information can be found. A screenshot from security cameras and an overview image show that their field of view covers the airport parking lot.9. With additional information from Isavia INN, dated December 22, 2025, the following documents were attached: i. An overview of new signs at Akureyri Airport, their locations, and updated older signs. The image shows, among other things, three new signs before driving to the license plate cameras. ii.
An overview of new markings at Egilsstaðir Airport and their locations, and of updated older markings. The image shows, among other things, one new marking before driving to the license plate cameras and six new or updated markings inside the monitored area. iii. Image showing the location and appearance of three new signs at Isafjörður Airport, two of which are located before entering the monitored area. Position of Isavia Domestic Airports Ltd. 10. In the previous response letter from Isavia INN, dated April 11, 2025, states that the company alerts the data subject to electronic surveillance with various signs at all of its airports, and also provides information about the surveillance, its purpose, legal basis for processing, and other details, in accordance with Article 1. subsection 1 of Article 17 of Act No. 90/2018, in the company's privacy policy, which is available on its website and referenced on numerous signs at the company's airports, see discussion in paragraph 8 (i–v).
The signs are posted in all areas covered by the surveillance. In the opinion of Isavia INN, the processing of personal data in connection with the electronic surveillance of parking lots at the domestic airports of the company covered by the preliminary investigation is lawful, fair, and transparent toward the data subjects, pursuant to point 1. Article 8(1) of the aforementioned law.11. In its response letter, Isavia INN states that before entering the parking lot entrances at Reykjavik, Akureyri, and Egilsstaðir airports, signs can be seen indicating, among other things, that automatic cameras record vehicles entering and exiting; that electronic surveillance is conducted in the area for the purposes of asset protection and fee collection, and that Isavia INN is the controller of the surveillance, see discussion in paragraph 8 (i–iii). The signs feature a QR code that links to information on the company's privacy policy.
applies Art. 8(1)
Additionally, some signs feature another QR code that links to information about parking provided by Isavia INN, which also contains information about electronic surveillance. Warnings and signs about electronic surveillance at the aforementioned airports are located in such a way that data subjects can familiarize themselves with the content of the information before entering the monitored area.12. The response letter from Isavia INN states that at the Isafjörður and Sauðárkrókur airports, warnings and signage are provided at the time the information is collected, i.e.,e. with signs in the airport parking lots, but these do not inform about the responsible party or direct people to where more information can be found. Work is underway to install additional signage at the latter two airports to warn those being recorded about the surveillance before they enter the monitored area. Additionally, signage will be increased at Akureyri Airport and Egilsstaðir Airport.13.
Regarding Akureyri Airport, the previous response letter from Isavia INN states that the license plate camera number can be found before the surveillance signs, but that the number of signs at the airport is being increased as previously noted, see discussion in paragraph 8(ii). It also states that the company has been working on providing more comprehensive and clearer information about electronic surveillance, including an update to its privacy policy, where the purpose of electronic surveillance will be further clarified. There are plans to standardize all warnings at the company's airports in accordance with the latest guidelines from the Data Protection Authority and the authority's Regulation No. 50/2023, as some of the signage was installed before the regulations came into effect. 14. In the letter from Isavia INN to the Personal Data Authority, dated December 22, 2025, states that the company has completed all the improvements reported in its previous response letter, with the exception that surveillance cameras at the Sauðárkrókur Airport have been removed, and therefore no electronic surveillance is currently conducted there.
At Akureyri Airport, three new electronic surveillance signs have been installed, positioned so that registered individuals are adequately notified of the surveillance before entering the monitored area. One sign was placed on Drottningarbraut, another on Eyjafjarðarbraut Vestri, and the third on Flugvallarvegur, which leads to the airport, see paragraph 9(i). At Egilsstaðir Airport, five older signs were updated and three new ones were added, see discussion in paragraph 9(ii). At the Isafjörður Airport, older signs were removed and new ones were installed and positioned so that data subjects are adequately notified of electronic surveillance before entering the monitored area, see discussion in paragraph 9(iii). Additionally, signage has been added to a window of the terminal building, by the second entrance, facing the parking lots. The Isavia INN privacy statement, which was previously noted to be under review, has now been updated.
Rationale and Conclusion Legal Framework
15. This case concerns the processing of personal data in connection with electronic surveillance conducted by Isavia INN using surveillance cameras and license plate cameras in the parking lots of airports under the company's jurisdiction, i.e., Reykjavik Airport, Akureyri Airport, Egilsstaðir Airport, Ísafjörður Airport, and Sauðárkrókur Airport. It therefore concerns the processing of personal data that falls under the scope of Law No. 90/2018 on the Protection of Personal Data and Processing of Personal Data, and thus within the jurisdiction of the Icelandic Data Protection Authority, see Article 4, Article 1(2) and Article 39(1) of the Act. 16. Isavia INN is considered the controller of the processing, pursuant to Article 3(6) of Act No. 90/2018 and Article 4(7) of the regulation (EU) 2016/679.17. The processing of personal data must be in compliance with all the principles in Article 8(1) of Act No. 90/2018, pursuant to Article 5(1) of Regulation (EU) 2016/679.
applies Art. 1(2), Art. 5(1), Art. 8(1), Art. 39(1), Art. 3, Art. 4 , Regulation 50/2023 Art. 4(7)
This includes, among other things, that personal data must be processed in a lawful, fair, and transparent manner in relation to the data subject, pursuant to item 1 of Article 8(1) of the Act and Article 5(1)(a) of the Regulation.18. The aforementioned general principle of transparency in the processing of personal data includes, among other things, that individuals should be aware when their personal data is collected or used, consulted, or otherwise processed, to what extent it is or will be processed and for what purpose. For the processing of personal data to meet this requirement, controllers must take specific measures regarding the information provided to the data subject. With respect to electronic monitoring, a rule on such information is found in Article 4. section 14 of Act No. 90/2018, which states that clear notice must be given of electronic monitoring conducted in the workplace or in a public place with a sign or in another conspicuous manner, and of the identity of the controller responsible for the monitoring.
applies Art. 5(1)(a), Art. 8(1), Art. 4
Reference is also made to Article 12(1) of Regulation (EU) 2016/679, as per Article 17(1) of Act No. 90/2018, which provides that the controller shall take appropriate measures to provide the registered individual with the information referred to in Articles 13 and 14 of the Regulation, and that the information shall be provided in writing or by other means, e.g., in electronic form. In the European Data Protection Board (EDPB) Guidelines 3/2019 (version 2), of January 29, 2020, on the processing of personal data in the context of electronic monitoring, emphasizes the importance of making it clear to the data subject, through clear warning signs, that electronic monitoring is taking place and the areas it covers. Furthermore, it is noted that additional information may be provided by means other than such warning signs, but that it must nevertheless be available and accessible.19. The content of the information and the timing of its provision, in relation to electronic monitoring, are governed by the provisions of Article 13 of Regulation (EU) 2016/679, in light of the aforementioned EDPB Guidelines No. 3/2019.
applies Art. 12(1), Art. 17(1), Art. 13, Art. 14
According to it, the controller shall inform the data subject, at the time of collection of personal data, of the identity of the controller, the contact details of the data protection officer where applicable, the purposes of the processing, and the legal basis for it, the recipients or categories of recipients of the personal data, and if the basis for the processing is that it is necessary for the purposes of the legitimate interests pursued by the controller, what those legitimate interests are, in accordance with paragraphs 1 and 2 of the provision.20. The rules of the Personal Data Authority No. 50/2023 on electronic surveillance apply, regarding surveillance in public spaces, in workplaces, in schools, and in other areas where a limited group of people normally comes and goes, including in the common areas of multi-unit buildings or on a shared lot. Article 8 of the regulations provides for warnings and education about electronic surveillance.
applies Art. 8
It states, among other things, in paragraph 3. paragraph that the controller of electronic monitoring shall, in a verifiable manner, provide the information required by Articles 12–13 of the Regulation to those groups of people who regularly pass through the monitored area. (EU) 2016/679.Conclusion 21. Based on the available evidence, see discussion in paragraph 8 (i and iii), it is the conclusion of the Data Protection Authority that the signage and information regarding electronic surveillance at Reykjavik Airport and Egilsstaðir Airport have, at the time the institution's proactive investigation began, were, for the most part, in accordance with the company's obligations under Article 14(4) of Law No. 90/2018 and Article 13 of Regulation (EU) 2016/679, see Article 17(1). Articles of Act No. 90/2018, see also item 1 of the first paragraph of Article 8 of the Act and Article 5(1)(a) of the Regulation, see discussion in paragraphs 17–20. 22.
applies Art. 5(1)(a), Art. 14(4), Art. 17(1), Art. 8, Art. 12, Art. 13
However, in the opinion of the Data Protection Authority, it is also clear that when the institution's proactive investigation began, the individuals who were to be subject to electronic surveillance in the parking lots at the company's airports in Akureyri, Ísafjörður, and Sauðárkrókur, were informed, before entering the monitored area or before the monitoring began, that electronic surveillance would be conducted in the airport parking lots, see discussion in paragraphs 8(ii, iv, and v), 9 (i and iii) and 12–13. At Akureyri Airport, there was a lack of a notification about license plate monitoring before driving into the camera's field of view, and at Isafjordur Airport and Sauðárkrókur Airport, there was a lack of general video surveillance notices located before entering the camera's field of view.or an electronic link to such information. Furthermore, the data subjects were not provided with information about the controller responsible for the monitoring at Isafjordur Airport and Saudarkrokur Airport and where more detailed information about it could be obtained, in accordance with Article 13 of the Regulation.
applies Art. 13
(EU) 2016/679, or an electronic link to such information, see discussion in paragraphs 8 (iv and v) and 12. At Akureyri Airport, such information was provided, but not until after entering the monitored area.23. In light of the foregoing and based on the available evidence, it cannot be concluded that Isavia INN fulfilled its duty to inform the data subjects, pursuant to Article 4. subsection 14 and subsection 1 of section 17 of Act No. 90/2018, cf. also articles 12 and 13 of the Regulation (EU) 2016/679 and Article 8 of Regulation No. 50/2023 on electronic monitoring, at Akureyri Airport, Isafjordur Airport, and Saudarkrokur Airport. In this regard, it is noted that the information provided was substantively inadequate at the time at Isafjörður Airport and Sauðárkrókur Airport. Furthermore, such information was not provided in a timely manner at Akureyri Airport. Finally, the signage at Akureyri Airport, Isafjordur Airport, and Saudarkrokur Airport was not located in such a way that the data subjects were made aware of the monitoring before entering a monitored area.
In light of this, Isavia INN has therefore not demonstrated that it ensured transparency at that time for the processing of personal data at issue here, in accordance with Article 8(1)(a) of the Act and Article 5(1)(a) of the Regulation.24. In light of the evidence received from Isavia INN, see discussion in paragraphs 8(i) and (iii) and 9(i–iii), however, it is also the conclusion of the Personal Data Authority that the signage and information regarding electronic surveillance in the company's airport parking lots, which this preliminary investigation covered, are now such that they comply with the company's obligations under Article 4. paragraph 14 of Article 14 of Act No. 90/2018 and Article 12(1) and Article 13 of the regulation (EU) 2016/679, see 17(1) of Act no. 90/2018 and 8 of Regulation no. 50/2023 on electronic monitoring, see also item 1 of the Annex to Regulation no. 50/2023.
applies Art. 4, Art. 14 , Regulation 50/2023 Art. 8(1)(a), Regulation 50/2023 Art. 5(1)(a), Regulation 50/2023 Art. 12(1), Regulation 50/2023 Art. 13
Article 8(1) of the Act and Article 5(1)(a) of the Regulation. Furthermore, after the preliminary investigation began, the company decided to cease electronic surveillance of the parking lot at Sauðárkrókur Airport. In light of the remedies that Isavia INN has implemented, as mentioned above, it is not considered appropriate to issue an order to the company to remedy violations under item 4 of Article 42 of the Act. Decision on the Exercise of Authority25. The Data Protection Authority may impose administrative fines on those who violate, intentionally or negligently, any of the provisions of the regulation (EU) 2016/679 that are listed in paragraphs 2 and 3 of Article 46 of Act No. 90/2018, as amended by paragraphs 1 and 5 of that article. Pursuant to items 1 and 2 of Article 46(3) includes provisions on the basic principles of processing, in particular pursuant to Article 5(1)(a) of the Regulation, and on the rights of data subjects, in particular pursuant to Articles 12 and 13 of the Regulation.26.
applies Art. 5(1)(a), Art. 46(3), Art. 12, Art. 13, Art. 42, Art. 46 , Regulation 50/2023 Art. 8(1), Regulation 50/2023 Art. 5(1)(a)
In determining whether to apply the above-mentioned provisions authorizing a fine, as well as the amount of the fine, regard shall be had to Article 1. paragraph 47 of Act No. 90/2018, which provides for the factors that can be considered either in mitigation or in aggravation. As is the case in the present matter, the Data Protection Authority considers that it must take into account that the scope of the electronic surveillance at the company's parking lots is rather limited, as well as the fact that the company has now made the necessary improvements. Having regard to the considerations set out in the referenced provision, and having regard to other legitimate considerations and the facts of the case as a whole, as well as taking into account the principle of proportionality, pursuant to Article 83(1) of Regulation (EU) 2016/679 and Article 12 of the Administrative Procedure Act No. 37/1993, do not constitute sufficient grounds to impose an administrative fine on Isavia Domestic Airports Ltd. for the company's aforementioned violations of the personal data protection law.
applies Art. 83(1), Art. 1, Art. 12
However, it is deemed appropriate to issue a reprimand to Isavia Domestic Airports Ltd., pursuant to item 2 of Article 42 of the Act, for the aforementioned violations. D e c i s i o n:Isavia Domestic Airports Ltd.'s signage and information regarding electronic surveillance in the parking lots of its airports in Akureyri, Ísafjörður, and Sauðárkrókur were not in accordance with Act No. 90/2018 on Personal Data Protection and Processing of Personal Data, regulation (EU) 2016/679 and Regulation No. 50/2023 on electronic monitoring. Isavia Domestic Airports Ltd. is issued a reprimand, pursuant to item 2 of Article 42 of Act No. 90/2018, for the aforementioned violation.Isavia Domestic Airports Ltd.'s signage and information regarding electronic surveillance in its parking lots are now compliant with Act No. 90/2018 on the Protection of Personal Data and Processing of Personal Data, Regulation(EU) 2016/679 and Regulation No. 50/2023 on electronic surveillance. Isavia Domestic Airports Ltd. is issued a reprimand, pursuant to item 2 of Article 42 of Act No. 90/2018, for the aforementioned violation. (EU) 2016/679 and Regulation No. 50/2023 on electronic monitoring. Personal Data Protection, September 22, 2026 Edda Þuríður Hauksdóttir Ósk Óskarsdóttir
applies Art. 42