Data Protection Authority
Court of Appeal upholds the Data Protection Authority's decision concerning security vulnerabilities in Heilsuvera but reduces fine
23rd October 2026
The Icelandic Court of Appeal (Landsréttur) has upheld the finding of the Icelandic Data Protection Authority (DPA) that the Directorate of Health had failed to adequately ensure the security of personal data on the Heilsuvera health information portal and that the infringements warranted an administrative fine. However, the Court reduced the fine from ISK 12 million to ISK 4.5 million.
The case originates from a decision issued by the DPA on 27 June 2023, in case No. 2020061844, in which the Directorate of Health was fined ISK 12 million for security vulnerabilities in the messaging and maternity care sections of Heilsuvera. These vulnerabilities enabled users to access personal data relating to other individuals, including sensitive health data.
The Directorate of Health brought legal proceedings seeking the annulment of the decision. In its judgment of 10 June 2025, the Reykjavík District Court upheld the DPA's finding that data protection legislation had been infringed but reduced the fine to ISK 8 million. The case was subsequently appealed to the Court of Appeal.
In its judgment of 22 October 2026, the Court of Appeal reiterated that data controllers are required to ensure an appropriate level of security for personal data, including by establishing processes for regularly testing and evaluating the effectiveness of security measures. The Court found that such processes had not been adequately implemented and that no specific assessment of data security had been carried out when the maternity care section was added to Heilsuvera.
The Court of Appeal held that the Directorate of Health had acted negligently by failing to fulfil these obligations and that the infringements were serious, given that they involved sensitive health data. The imposition of an administrative fine was therefore justified.
In determining the amount of the fine, however, the Court took into account, among other factors, that no damage resulting from the security vulnerabilities had been demonstrated and that the Directorate had responded promptly once the vulnerabilities were discovered. With reference to the principle of proportionality under the Administrative Procedures Act, the Court of Appeal reduced the fine to ISK 4.5 million.
The judgment highlights the importance of data controllers ensuring the security of personal data through effective and regularly implemented measures, particularly when processing special categories of personal data.