Icelandic data protection authority (‘Persónuvernd’)-Hörpu tónlistar- og ráðstefnuhúss ohf. (3/8/2022)

The DPA had received a complaint regarding the concert hall’s collection of ID number and date of birth information as part of an electronic ticket purchase.

The incident occurred prior to the start of the Covid-19 pandemic, when the registration of personal data for contact tracking in the context of event visits was not yet required.
The DPA concluded that it would not have been necessary to collect the data for issuing a ticket, as it would have been possible to conclude a purchase contract even without this collection. For this reason, the DPA found that the concert hall had violated the principle of data minimization.