The Privacy Surgeon lodges formal data protection complaint against Iceland’s “Yule Lads” trolls

yule lads

By Simon Davies

Following complaints from a number of readers, the Privacy Surgeon has lodged a formal Request for Investigation with the Prime Minister of Iceland over the activities of a criminal enterprise known in Icelandic folklore as “The Yule Lads” (jólasveinarnir). This gang of trolls has been terrorizing Iceland’s population for centuries, but they have now been implicated in unlawful “goodness” behavioural surveillance of all EU citizens. The complaint is set out below.


10th December 2015


Sigmundur Davíð Gunnlaugsson,

Prime Minister,

The Alpingi,

150 Reykjavik,



Dear Prime Minister,

I am writing to express my deep concern about Iceland’s infamous “Yule Lads” and to ask that you investigate actions by them that have breached Icelandic laws on privacy and data protection.

You will, of course, be aware that these thirteen trolls have been active in Iceland for several hundred years, terrorising young people and causing extreme discomfort to your citizens. The existence of an organised band of criminal entities who constantly monitor the “goodness and “badness” of your people cannot be healthy for any society. Data Protection is designed to restrict such intrusive surveillance.

In this age we would not tolerate a mafia-style operation monitoring people with the intention of securing information for the purposes of blackmail or intimidation. Nor should we allow a troll gang to hide under beds and in rafters to conduct wide scale surveillance

I agree that this scenario is common in other parts of the world on account of the privacy invading Santa Claus (who also illegally monitors the behaviour of the entire civilian population), but I regret to say that the Yule Lads are a substantially greater threat to personal privacy.

This complaint is directed in particular at four of these trolls, namely: (1) Askasleikir, who hides under beds waiting for people to put down their ‘askur’ bowls; (2) Bjúgnakrækir, who hides in the rafters and snatches smokes sausages; (3) Gluggagægir, a voyeur who looks through windows in search of things to steal, and (4) Kertasníkir, who follows children in order to steal their candles.

In this complaint I will use the English short-form of these identities: the Bowl Licker, the Sausage Swiper, the Window Peeper and the Candle Stealer. We also have concerns about the Sheep Harasser and the Doorway Sniffer, but I will postpone complaints about those trolls.

The trigger for writing to you is that on the morning of December 25th last year, a young Privacy Surgeon reader from Germany – who at the time was visiting Reykjavik for a short holiday – had an unfortunate encounter with one of the Yule Lad trolls. She left her shoes outside the apartment (which I understand is conventional practice in Iceland) and in the morning discovered that they had been filled with rotten potatoes. As you know, the Yule Lads are renowned for leaving rotten potatoes in the shoes of young people who have not behaved nicely over the past year.

This reader then complained to the Privacy Surgeon. Her parents later admitted to us the girl had been “bad” throughout the year. Indeed she had been so bad that the parents needed to quickly take her away from Berlin to avoid police intervention.

But that’s not the point. In terms of data protection, it is clear that the trolls were collecting behavioural information on this girl even while she was living in Germany.

Iceland is not permitted to collect and process data on EU nationals without assurances of adequate protection of that data – and it certainly cannot do so in any circumstance where consent has not been given. I am sorry to advise that it is our view that the trolls are monitoring the activities of all EU citizens in this manner, in violation of data protection rules.

Iceland enjoys data adequacy status with the European Union, but the trolls operate outside the required guidelines. As inhabitants of Icelandic folklore they appear to be entirely outside the law. How, for example, are people able to lodge a Subject Access Request for their data when there is no address for communication other than “The Mountains”? Technically, there aren’t any mountains in Iceland, and the postal service has confirmed to us that it would be unable to deliver correspondence to such an address.

How too are Icelandic authorities able to properly enforce data protection standards if there is no possibility of serving notices on the troll data processors? This is a matter of some concern. Indeed the last known address for the Yule Lads was the thirteenth century mountain abode of their mother, the giantess Gryla, who also monitored behaviour and made a habit of making a stew of children she felt were badly behaved.

The Privacy Surgeon has also received a number of other complaints from Icelandic citizens, all of whom argued that the collection of data by the trolls is unfair, unnecessary and disproportionate.

In this age we would not tolerate a mafia-style operation monitoring people with the intention of securing information for the purposes of blackmail or intimidation. Nor should we allow a troll gang to hide under beds and in rafters to conduct wide scale surveillance, even if the justification is the mere stealing of smoked sausages.

I respectfully urge you to take action on these violations before they get even more out of hand. When the trolls get their hands on new technologies of surveillance there may be an escalation of this intrusive activity.

Yours sincerely,

Simon Davies

The Privacy Surgeon