# Primary Health Care in the Capital Area: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Icelandic data protection authority ('Persónuvernd')
- Date: 2025-02-17
- Original: https://www.enforcementtracker.com/ETid-2602
- Canonical: https://overview.legal/posts/48717
- Topics: Health Data, Healthcare, Healthcare, Controllers, Processing Agreement, Processing, Special Categories of Data, Types of Special Categories of Personal Data, Supervisory Authorities, Data Controller

## Summary

The Icelandic DPA has imposed a fine of EUR 34,300 on the Primary Health Care in the Capital Area. The controller processed personal and health data in shared medical record systems by merging its medical records with those of other parties and granting them access to its patients' records.

## Full text

The Icelandic DPA has imposed a fine of EUR 34,300 on the Primary Health Care in the Capital Area. The controller processed personal and health data in shared medical record systems by merging its medical records with those of other parties and granting them access to its patients' records.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48717 · 2026-08-22