The Data Protection Authority has completed an initiative review on the processing of personal data in connection with electronic monitoring in swimming pools operated by Akraneskaupstaður, Akureyri, Árborg and Mosfellsbær. The decision to initiate the review was taken in view of the fact that the Data Protection Authority received in 2024 tips on the processing of personal data in connection with electronic monitoring by municipalities that takes place in swimming pools.

The purpose of the review was to examine how the labelling of electronic monitoring is done at swimming pools operated by the abovementioned municipalities and how the registered individuals are educated about electronic monitoring that is done there. On the other hand, the purpose of the review was to examine whether access to video material and other personal data collected during the monitoring meets the requirements of the data protection legislation on the security of personal data, regarding the preservation period of personal data and whether access control and action registration is carried out.

In the course of the investigation, the municipalities provided screenshots from all surveillance cameras in swimming pools, pictures of electronic monitoring labels and information on the location of labels. Consequently, the Data Protection Authority conducted a field inspection in certain swimming pools of the municipalities in order to examine whether labels were in all areas covered by the monitoring and to examine how the operational registration in the surveillance camera system of the swimming pools was conducted. In view of all available data and the results of the field inspections, it was the conclusion of the Data Protection Authority that the labeling and education on electronic monitoring in the swimming pools of Akureyri and Mosfellsbær was in a manner that was in accordance with the obligations of the municipalities according to the data protection legislation. The registered parties are warned that electronic monitoring is carried out before they enter the monitored area and are provided with information on the responsible party of the monitoring, the purpose of the processing and information on where to get further information on the monitoring, in accordance with the requirements of Act no. 90/2018 on Data Protection, Regulation (EU) 2016/679 and regulations no. 50/2023 on electronic monitoring.

At Akraneskaupstaður, the labels and education on electronic monitoring in the municipal swimming pools were not entirely in accordance with the requirements of Act No. 90/2018, Regulation (EU) 2016/679 and Rules No. 50/2023. The Data Protection Authority therefore proposed to Akraneskaupstaður to update the labels on electronic monitoring in the municipal swimming pools, so that the labels actively indicate where further education on the monitoring can be accessed, and the municipality was also required to update the education on electronic monitoring and make sure that it contains discussion on the rights of registered individuals.

As for the municipality Árborg, it was considered clear by the Data Protection Authority that until the initiative review was initiated, on September 16, 2024, the labeling and education on electronic monitoring in the swimming pools in Árborg had not been in accordance with Act No. 90/2018, Regulation (EU) 2016/679 and Rules No. 50/2023. In the field review by the Data Protection Authority it was found that the municipality had already updated the labeling and education on electronic monitoring in a way that is now in accordance with the obligations of the municipality according to the requirements of the Data Protection Act. It was therefore not considered to instruct the municipality to improve but it was deemed appropriate to grant the municipality Árborg a reminder for violation of the obligation of transparency and education in Act No. 90/2018 and Regulation (EU) 2016/679.

It was also concluded that the measures that the above municipalities are taking to ensure the security of personal data that are generated by electronic monitoring in the swimming pools they operate were in accordance with the provisions of Act No. 90/2018 and Regulation (EU) 2016/679. As stated above, the investigation by the Data Protection Authority was focused on the security of personal data, however limited to the length of time the data was stored and whether access control and action registration were carried out.

Decision on Akraneskaupstaður (in Icelandic)

Decision on Akureyri (in Icelandic)

Decision on Árborg (in Icelandic)

Decision on Mosfellsbær (in Icelandic)