Processing personal data in Reykjavík recreational activities
This page explains how personal information is processed in Reykjavík City recreational activities, including recreation centers, community centers and after-school programs.
Education
This education is provided in accordance with the Personal Data Protection and Processing Act No. 90/2018 and European Parliament and Council Regulation (EU) 2016/679, which address the protection of individuals concerning personal data processing, the free movement of such information, and the rights of individuals involved in recreational activities.
This information applies to all City recreational activities. You can find more detailed information about each workplace's procedures on the workplace website or in materials from each after-school program or community center detailing their specific processing of personal data.
Here, 'parent' refers to those who have custody of a child according to the Children's Act Bo. 76/2003.
Responsible party
Reykjavík City serves as the data controller for the personal information of children and their parents.
Questions about handling personal information
Parents have the right to access their child's information. The limitations on the right to information follow the provisions of Article 17 of the Administrative Procedures Act No. 37/1993 and Article 9 of the Information Act No. 140/2012.
Parents who do not have custody of their child have the right to receive information about that child. Parents’ rights to information are covered by Article 52 of the Children's Act No. 76/2003, with subsequent amendments.
The guardian has the legal responsibility for a child until it is of legal age, cf. the fifth paragraph of Article 28 of the Children's Act No. 76/2003.
If you have questions about how your children's personal information is handled, you can contact your child's after-school program or community center, or Reykjavík City's Data Protection Officer.
It should be noted that before parents are given personal data to which they are entitled, they must confirm their identity.
Data Protection Officer
The Data Protection Officer's task is to monitor compliance and assist the controller and processors in complying with privacy legislation.
Purpose and legal basis for processing personal data
The primary purpose of processing personal information in Reykjavík City's recreational activities is to fulfill legal obligations. Reykjavík City is the data controller and has authority under sections 9(1) and 11(1) of the Data Protection Act to process personal information about children.
After-school program
After-school programs are defined under item (a) of the first paragraph of Article 33 of the Compulsory School Act No. 91/2008. This law states that all children in the lower grades of primary school must have the opportunity to access after-school program services. After-school programs serve as recreational spaces for children that emphasize children's choices, free play, and diversity in activities and surroundings. When planning after-school program services, each child's individual needs, development, and interests must be considered.
Municipalities have professional oversight of after-school programs and determine their organization and operation, with the integration of school and recreational activities and children's needs as guiding principles.
Reykjavík City has established regulations for after-school program services that cover the framework, application, and enrollment in Reykjavík City after-school programs, as well as the fees for participation in these programs.
Youth centers and youth centers for disabled children
Recreational and social activities are defined in Article 33 of the Compulsory School Act No. 91/2008. This law states that students in all primary schools must have the opportunity to participate in recreational and social activities. Municipalities may charge fees for these activities according to a special fee schedule they establish. Fee schedule decisions under this section may be appealed according to the provisions of Article 47.
Reykjavík City has established rules for youth center services that cover their operations as well as the application and enrollment process for Reykjavík City's youth centers for disabled children. The rules also cover fees for participation in the City's youth centers and youth centers for disabled children.
Photography in recreational activities
During recreational activities, photos and videos of students are taken as part of required activities, such as project work. Photos may also be taken for use in the program's electronic information system, Vala or Abler. In addition, image capture and use of image material may be necessary to ensure appropriate measures and correct response to life-threatening diseases, such as in the cases where a student has been diagnosed with acute allergies or epilepsy.
Taking photos or videos at public recreational events is generally permitted when they are group or wide-angle shots. If parents object to such photography, the manager will consider these comments and evaluate them on a case-by-case basis.
Occasionally, pictures of students are taken and published based on parental consent. These images are used to give parents and children insight into program activities and may be published on the workplace's website or other public platforms. Parents can revoke their consent at any time. The revocation of consent does not impact the legality of any photography and picture publication that occurred prior to the revocation. If consent has not been withdrawn, it remains valid while the child is enrolled in the recreational activity.
What personal data is processed?
After-school programs and youth centers typically process basic information about the child, including name, ID number, address, email, phone number, and information about immediate family; photos and videos; the primary school the child attends and their grade level; in addition to information about which recreational activity the child is enrolled in as well as attendance and absence data. General notes about events involving the child that occur during the program may also be recorded.
When necessary, sensitive personal data as defined by the Data Protection Act related to a student's health, such as medical and psychological diagnoses, are processed. In individual cases, and only when necessary, workplaces and parents may record sensitive personal information about a student's health in the Vala Leisure electronic information system during the application process. This can include emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.
Processing may involve: Children, parents, and staff, as well as any other categories of registered individuals that program staff determine must be included in the processing.
How the personal data is obtained or received
Information about children comes from parents through Vala Leisure when they apply for after-school programs or youth centers for disabled children.
After-school programs and youth centers can also share information through the Mentor recreation portal, which is linked to Registers Iceland.
Basic information about children needed to create an account in Abler is obtained from the Mentor or Námfús system; Reykjavík City extracts the necessary information from the Mentor/Námfús systems as an Excel file and enters it into Abler.
Who works with the personal data?
Sending personal data to third parties (processors)
Reykjavík City uses data processors to host the personal information handled in the City's recreational activities. Data processors include, for example, Infomentor ehf. for Vala Leisure, Infomentor, and Abler ehf. The same may apply to other types of IT Services. These entities may access personal data related to preschool operations, but their involvement is based on written agreements with Reykjavík City ensuring data security and confidentiality. To get more information about the above, contact the Data Protection Officer of Reykjavík City.
Information about using the Vala Leisure electronic information system
The Vala Leisure web system is an electronic information system consisting of several core units that work together to support Reykjavík City's after-school programs, youth centers, and the Department of Education & Youth office related to recreational activities.
The system provides parents with information about recreational activities. Parent email addresses are used for communication about recreational activities.
After-school program staff whose roles require access have access to the Vala Leisure system based on a processing agreement between the city and InfoMentor ehf. Parents and staff receive access to the information system when a child participates in recreational activities.
Personal information that can be recorded in Vala Leisure includes the following:
- Names of children and parents
- ID numbers of children and parents
- Home addresses and legal residence of children and parents
- Phone numbers of children and parents
- Email addresses of children and parents
- Child custody information from Registers Iceland
- Photos of children
- Hours of stay and attendance of children
- Food
- Absence records and attendance of children
- Children's immediate family
- Individuals authorized to pick up the child
- Messages from parents
- Settlement of fees
- IP addresses
- Devices used for login
- Activity logs
In certain cases, and only when specifically required, recreational services record sensitive personal information about children's health in Vala Leisure. This can include emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.
As a general rule, no sensitive personal information other than that described above should be recorded in Vala Leisure, such as information about illnesses or diagnoses. It could, however, contain a reference to illness or diagnosis records.
Vala Leisure connects automatically to Registers Iceland, and the registration page collects general personal information about users such as name, ID number, and legal residence. Billing is processed through the Agresso system. Basic information about children and parents is obtained from Registers Iceland through a connection to the legal residence registry, and a connection to the custody registry is planned.
Vala Leisure allows users to:
- Send emails to parents
- Register children for recreational activities
- View basic information about a child participating in recreational activities
More information about Vala Leisure
Automatic decision making No automated decision-making occurs in Vala Leisure.
Usage recording: All user logins to Vala Leisure are logged.
Information about using the Mentor electronic information system
Recreation program sites in Reykjavík have access to the recreation portal of the Mentor information system based on a processing agreement between the city and Infomentor ehf. Staff at these sites whose roles require it have access to information about students and their parents.
This access is used to share general information about recreational activities operated by the Department of Education & Youth via email to parents. Other parties to Reykjavík City's recreation card who offer organized recreational activities for children and youth in Reykjavík can also promote their activities in the recreation portal in coordination with the recreation center executive director and directors of after-school programs and community centers operated at the relevant primary schools.
Parents can choose whether they receive email from the recreation gateway.
Personal information that can be recorded in the Mentor recreation portal includes the following:
- Name of the child and their parents
- ID number of the child and their parents
- Child's language
- Home address of the child and their parents
- Parents' email
- Parents' phone number
- Information about immediate family that parents choose to record
- Emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.
In exceptional cases and only if there is a specific need, schools can register sensitive personal information about the student's health in Mentor. This can include emergency information about potentially life-threatening illnesses, such as acute allergies and epilepsy.
The main rule is not to register in Mentor other sensitive personal information than mentioned above, such as information about diseases or diagnoses. It could, however, contain a reference to illness or diagnosis records.
In the Mentor recreation portal you can do the following:
- Send emails to parents
- View basic information for all children at the relevant primary school.
More about the Mentor recreation portal:
Automatic decision making No automatic decision-making takes place in Mentor.
Usage recording: All user logins in the Mentor system are recorded or "logged".
The recorded IP addresses indicate the geographical location where they are recorded by specific companies. They only indicate a broad geographical location, not a precise location. Geographical location could be relevant if, for example, in cases where there are punishable actions such as system breaches.
Event logging is for security and property protection and is part of ensuring that all data in the system is protected against unauthorized access, alteration, and destruction, theft, or damage.
The collected information is only reviewed and used if there is a reason that aligns with the purpose for which the information was collected. This information will not be handed over to others without the consent of the recorded individual or a decision by the Icelandic Data Protection Authority. However, it may happen that the police are handed such information if there are suspicions of punishable actions. Strict access controls apply to InfoMentor for this data and all employees have signed confidentiality declarations.
Information about using Abler
The system is used exclusively for activity planning at youth centers. Specifically, this includes managing participation and planning for group activities, event attendance, and registration and payment for optional events. Events are created in the system, and children (or parents) can register for them. Parents can pay for fee-based events operated by youth centers through the system.
Basic information about children (name and ID number) needed to create a user in Abler is obtained from the Mentor or Námfús system, whereby Reykjavík City extracts the necessary information from the Mentor/Námfús systems and transfers it to Abler.
Community center staff whose roles require access have access to the Abler system based on a processing agreement between the city and Abler ehf. Parents and children receive access to the information system when a child participates in community center activities.
The following personal information about children and parents is processed in the system:
- Names of children and parents
- ID numbers of children and parents
- Birthdays of children and parents
- Home address/legal residence of children and parents
- Phone numbers of children and parents
- User names and passwords
- User profile pictures
- Children's family relationships
- Student lists from primary schools
- Parents' financial information
- User communications
- User IP addresses
- User cookies
The system is not intended for processing sensitive personal information. However, users can send private messages to the community center that might contain sensitive personal information. This practice is discouraged.
Personal information in Abler is not shared with external parties.
More about Abler:
Automatic decision making No automated decision-making is performed in Abler.
Usage recording:
Below are the items that are logged in the system. These logs are not actively monitored but may be reviewed to investigate specific incidents.
- System login:
- Service user search
- Mark attendance
- Send a message
- View group
- Search in Registers Iceland
- Download Excel file
- Event actions:
- Manually added to event by staff member
- Removed from event by staff member
- Services - ski trip
- When a staff member gives a price discount
- Changes price
- Manually adds individual
- Cancels subscription
IP addresses indicate a general, but not exact, geographic location because they are registered by specialized companies. IP addresses indicate a general, but not exact, geographic location because they are registered by specialized companies. Geographical location could be relevant if, for example, in cases where there are punishable actions such as system breaches. Service user IP addresses are recorded to protect the system from abuse and attacks. IP addresses are also recorded to prove service user identity if a service user denies responsibility for system abuse or denies having agreed to the terms.
Event logging is for security and property protection and is part of ensuring that all data in the system is protected against unauthorized access, alteration, and destruction, theft, or damage.
The collected information is only reviewed and used if there is a reason that aligns with the purpose for which the information was collected. This information will not be handed over to others without the consent of the recorded individual or a decision by the Icelandic Data Protection Authority. However, it may happen that the police are handed such information if there are suspicions of punishable actions. Abler maintains strict access controls for this data, and all employees have signed confidentiality agreements.
After-school program and youth center staff
Staff at workplaces who need the information to perform their duties have access to information about students and their parents.
Information sharing between preschools and after-school programs/youth centers
Preschools invite after-school programs to join transition meetings with primary schools. Parents must give permission for information sharing between preschools and after-school programs by completing a form.
Special transition meetings are often held between preschools, school support services, primary schools, and after-school programs when children have received special support. The same applies to information shared from primary schools or after-school programs to youth centers for disabled children.
Information sharing between primary schools and after-school programs/youth centers
If a child uses services from an after-school program or youth center, information about the child's absence from primary school may be shared. If there are valid reasons, the cause of the absence may be reported. Managers in recreational activities have access to information about children's absences from primary schools in the Mentor recreation portal.
Furthermore, a primary school can exchange general information about day-to-day communications with a child with an after-school program or a special youth center, if it serves the child's immediate interests.
Support for children
Article 16 of Act No. 38/2018 on services for disabled people with long-term support needs states that municipalities must offer disabled children and young people recreational services after their regular school day ends and, when applicable, before daily classes begin, as well as on days other than statutory holidays when schools are not operating. This service continues from general recreational services in primary school and ends when the individual finishes upper-secondary school. The service must be individualized and in the format that best suits the individual. Services related to a disability must be provided alongside general recreational offerings whenever possible. This service should generally be based on assessed support needs and be part of the individual service plan for the specific child or young person.
The Department of Education & Youth office receives information about children who need support from guardians when an individual plan is developed for them. Individual plans may contain sensitive personal information about children, such as diagnoses of disabilities, diseases, medications, and similar data. The Department of Education & Youth office allocates support funding based on information about service needs as outlined in children's individual plans, as well as on information gathered during site visits.
Primary school solution teams
Schools may have a solution team in place for teachers assisting students struggling with learning, behavioral, and social interaction difficulties. This team's role is to help the teacher identify problems, seek solutions, and address them. The team is made up of school representatives and representatives from the school service. Directors of after-school programs and youth centers attend solution team meetings at the primary schools where they work.
Student-protection councils of primary schools
Primary school student-protection councils address special interventions for individual students or student groups that have been brought before the council. The Council assesses what additional information is needed and invites to its meeting the class teacher and parents, as well as other parties involved if necessary.
Because of this, the head of the after-school program or youth center or others may also be invited to council meetings in line with Article 20 of Regulation No. 444/2019 on School Services.
Recreation specialists in primary schools
A recreation advisor who is an after-school program employee may work in the primary school during its operating hours.
The recreational consultants' task is primarily group work carried out in collaboration with primary school staff, aimed at strengthening social skills and self-image and increasing social activity among children. For recreation specialists to perform their duties, the primary school may need to share various general personal information about students in the group, such as names and other personal information relevant to group activities.
Working with children individually requires consultation with the principal, parents, and teachers.
Processing on the basis of the Administrative Procedure Act, Information Act, and other acts
After-school programs or youth centers may be required to provide data under the Administrative Procedure Act No. 37/1993, the Information Act No. 140/2012, or the Child Protection Act No. 80/2002, with reference to the second paragraph of Article 17 of the Data Protection Act No. 90/2018.
Statistics Iceland
Information may be shared with Statistics Iceland to fulfill legal obligations under Article 5 of Act No. 163/2007 on Statistics Iceland and official statistics.
Other processing
Recreational activities may involve other processing of personal information beyond what is specified in the list above, such as the use of apps. Parents are usually specially informed about such processing and they are encouraged to familiarize themselves with this processing when it occurs.
How is the safety of your personal data ensured?
The City of Reykjavík safeguards personal data through appropriate organizational and technical measures, including access controls and encryption.
Recreational activity staff and others involved in student matters must maintain complete confidentiality regarding the circumstances of children and their parents that they learn of through their work, according to the second paragraph of Article 12 of the Compulsory School Act.
What happens to personal data and how long is it stored?
After-school programs and youth centers are required to submit records under the Public Archives Act No. 77/2014. Therefore, they are not permitted to destroy documents and data that they receive or create without permission from the National Archives of Iceland. This requirement means that all documents and data received by or created at after-school programs and youth centers must be submitted to the National Archives of Iceland, where they are permanently preserved. Electronic records, databases, and document storage systems must also be transferred to the National Archives. Therefore, personal data that is subject to the above is stored indefinitely.
Rights
You may have the right to access the personal data that the City of Reykjavík processes in connection with your application. You may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format.
More information about your rights can be found in Reykjavík City's privacy policy.
Note that if you do not wish for Reykjavík City to process your personal data you can always contact the Reykjavík Data Protection Officer or send a message to the Icelandic Data Protection Authority (DPA).