Persónuvernd (Island) - 2025010358

The DPA found no violation after an employee claimed that her employer monitored her work and allowed colleagues to access her personal files. English Summary. Facts. The data subject was an employee of the enterprise BL ehf (the controller). When she started working there, she was provided with a computer set up by the controller’s IT department. The controller had a Microsoft Office 365 subscription, which included OneDrive and Delve for each employee. OneDrive is a cloud storage service linked to a user account, where files may be stored online rather than only locally. The data subject lodged a complaint with the Icelandic DPA (Persónuvernd) against the controller. She argued that she had been subject to unlawful electronic surveillance during her employment and that colleagues had gained unauthorised access to her computer desktop. According to the data subject, the controller had configured her work computer and the software installed on it in such a way that colleagues and super