GDPR Guide to National Implementation: Iceland

The relevant pre-GDPR legislation has been repealed in full.

Q2/ Personal data of deceased persons

Does national law make specific rules regarding the processing of personal data of deceased persons?

The Data Protection Act applies to the processing of personal data of deceased persons, as applicable, for a period of five years from the date of their death, or longer if it is reasonable to keep the personal data confidential.

Q3/ Legal bases for processing

(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?

There are no specific rules governing this issue.

(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?

Under the Data Protection Act, the following rules apply regarding processing of personal data for research, statistics or archiving carried out in the public interest:

• Arts. 15, 16, 18 & 21 GDPR do not apply when the processing of personal data is carried out solely in the interest of science or history or for statistical purposes, insofar as those rights make it impossible or prevent the relevant goals from being achieved; and
• Arts. 15, 16 & 18-21 GDPR do not apply when the processing of personal data is carried out solely for archiving in the public interest insofar as those rights make it impossible or prevent the relevant goals from being achieved.

(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?

Under the Data Protection Act, Arts. 13 & 14 GDPR do not apply when authorities transfer personal data to another authority in accordance with their legally prescribed role and information is transferred only to the extent necessary to fulfil the legal obligation of the authority.

(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?

There are no specific additional criteria governing this issue.

Q4/ Consent of children

At what age can a child give their consent to processing in relation to ISS?

13 years of age.

Q5/ Processing of sensitive personal data

(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?

All sensitive personal data can be processed if the data subject’s valid consent has been obtained.

b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:

(i) Employment, social security and/or social protection law

There are no specific rules on processing this category of data.

(ii) Substantial public interest

There are no specific rules on processing this category of data.

(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services

There are no specific rules on processing this category of data.

(iv) Public interest in the area of public health

There are no specific rules on processing this category of data.

(v) Archiving purposes, scientific or historical research purposes or statistical purposes

(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?

There are no specific rules on processing this category of data.

Q6/ Data relating to criminal offences or convictions

Under what conditions does national law permit the processing of personal data relating to criminal convictions?

Under the Data Protection Act, public authorities are not permitted to process data containing information about criminal behaviour unless it is necessary in the interest of their legally prescribed roles.

Data containing information about criminal behaviour cannot be disclosed unless:

• the data subject has given explicit consent;
• the disclosure is necessary to protect the legitimate interests of the government or a private party, where these interests obviously outweigh the interests of keeping the data secret, taking into consideration the interests of the data subject;
• the disclosure is necessary in the interest of a legally prescribed role of the authority or in order for an administrative decision to be made; or
• the disclosure is necessary to carry out a task which the government has assigned to a private party.

Private parties cannot process data regarding criminal behaviour unless:

• the data subject has given explicit consent; or
• the processing is necessary to achieve a legitimate interest which clearly outweighs the fundamental rights and freedoms of the data subject.

Q7/ Exemptions

(a) Does national law specify exemptions to a data subject’s right to erasure?

There are no specific exemptions to the right to erasure.

(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?

There are no specific exemptions to the right to be provided information.

(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?

There are no specific exemptions to the right to not be subject to automated individual decision-making.

Q8/ Restrictions on data subjects’ rights

Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?

Under the Data Protection Act, Arts. 13(1)-(3), 14(1)-(4) & 15 GDPR do not apply where urgent interests related to the data, including the interests of the data subject, outweigh the purpose of the envisaged processing.

The application of Arts. 13-15 GDPR may be restricted if such a restriction respects fundamental rights and freedoms and is considered necessary in a democratic society to:

• ensure national security;
• ensure national defence;
• ensure public safety;
• prevent, investigate or prosecute criminal offences or enforce criminal penalties, including to protect against, and prevent, threats to public safety;
• protect public interests, specifically economic and financial goals (including in relation to foreign currency matters, national budget and fiscal matters, public health and national insurance);
• ensure the protection of the data subject, urgent public interests or the fundamental rights of others;
• protect civil law claims; or
• protect legal provisions on obligations to observe secrecy.

These restrictions can be applied to personal data in working files that are used to prepare decisions by the controller, where the personal data has not been distributed to others, to the extent that the data is necessary to ensure the preparation of the applicable decision.

Data handled by public authorities may be exempt from the right of access under Art. 15 GDPR under the same exemptions as the right to information granted under the Information Act No. 140/2012 and the Administrative Procedures Act No. 37/1993.

Art. 34 GDPR does not apply when restrictions are necessary to ensure national security, or to prevent, investigate or prosecute criminal offences or carry out criminal penalties, including to protect against, and prevent, threats to public safety.

Q9/ Joint controllership

Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?

There are no additional rules on apportionment of liability between joint controllers.

Q10/ Processor

In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?

There are no additional pieces of legislation.

Q11/ Impact Assessments

Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?

Under the Data Protection Act, the DPA must publish a list covering the types of processing for which an Impact Assessment is required.

The DPA can also decide to publish a list covering the type of processing operations for which an Impact Assessment is not required.

Q12/ Prior authorisation and public interest

Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?

When the processing of personal data is related to a project in the public interest that risks violating the rights and freedom of data subjects, the DPA can decide that processing may not commence without prior review and authorisation by the DPA. The DPA can waive this authorisation requirement when general rules and safety standards are in place.

Q13/ DPOs

(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?

DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.

(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?

Under the Data Protection Act, DPOs are prohibited from disclosing any confidential information obtained at their respective organisation.

The confidentiality obligation does not apply if the data subject has given its consent to waive confidentiality, nor when disclosure is necessary for the performance of the DPO’s duties.

Q14/ International data transfers

(a) Does national law make specific rules about transfers of personal data from public registers?

Data transfers from public registers are not subject to specific rules.

(b) Does national law restrict the transfer of specific categories of personal data to third countries?

Data transfers are not subject to restrictions beyond those set out in the GDPR.

Q15/ DPAs

(a) Details of the DPA(s).

• Name of DPA: Persónuvernd
  • Address: Rauðarárstígur 10, 105 Reykjavík, Iceland
  • Website:personuvernd.is

  (b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?

  Not applicable as there is only one DPA.

  (c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?

  (d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?

  Under the Data Protection Act, the DPA can request assistance from the police if anyone tries to prevent it from exercising its authority during the course of an investigation.

  Further, where a controller or a processor is found to be processing data in violation of the GDPR, the DPA may request that the police temporarily put a stop to operations by the relevant entity and seal the entity’s offices.

  (e) What national appeals process exists to enable parties to challenge the decisions of the DPA?

  Challenges can be submitted as claims before the relevant courts, but administrative appeals cannot be brought.

  (f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?

  Under the Data Protection Act, the DPA has a right to request information or access to offices or computer systems and such access cannot be limited based on obligations of professional secrecy.

  Q16/ Claims by not-for-profit bodies

  Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?

  There are no not-for-profit bodies that are specifically mandated to bring such claims.

  Q17/ Administrative fines, penalties and sanctions

  (a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?

  There are no specific rules regarding fines for public authorities (i.e., public authorities can be fined in the same manner as individuals and legal entities).

  (b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?

  Under the Data Protection Act, an individual may be sentenced to up to three years of prison for an especially serious breach of the Data Protection Act.

  The representative of a legal entity, or its employees, can be sentenced to prison in addition to being subject to an administrative fine.

  A DPO, or an employee of the DPA, who violates obligations of secrecy can be sentenced to up to one year of imprisonment or, in special circumstances, up to three years.

  Q18/ Freedom of expression and information

  (a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?

  A controller may depart from the provisions of the Data Protection Act to the extent that the envisaged processing is necessary for exercising its right to freedom of expression in the interest of media, art or literature.

  Where processing is carried out solely for journalistic purposes or for the purpose of academic artistic or literary expression, only Arts. 5(1)-(2), 24, 26, 28-29, 32, 40-43 & 82 GDPR and Arts. 48 & 51 of the Data Protection Act will apply.

  (b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?

  Q19/ National identification numbers

  Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?

  The use of national identification numbers (kennitala) is permitted for “objective purposes” and when it is necessary to ensure secure personal identification. The DPA can forbid or authorise the processing of national identification numbers. “Objective purposes” are not specifically defined in the Data Protection Act. The preparatory work behind the Data Protection Act only states that the requirement of “objective purposes” will not be met unless other identifiers, such as the data subject’s name, address or customer number, are incomplete. In assessing the “objective purposes” it is necessary to, inter alia, consider whether a secure personal identification is important for the data subject, for the guarantor or for the public interest.

  Q20/ Processing in the context of employment

  (a) For what purposes can employees’ personal data in the employment context be processed under national law?

  There are no specific provisions governing the processing of employee data.

  (b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?

  There are no specific safeguards of this nature.

  Q21/ Other material derogations

  Are there any other material derogations from, or additions to, the GDPR under national law?

  There are no other material derogations.

  Q22/ Current legal challenges

  Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?

  There are no current legal challenges ongoing.

  Q23/ Enforcement

  Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?

  The DPA has taken enforcement action for breaches of the GDPR in the following cases:

  • the DPA decided that an online database where information from tax registers for the year 2016 were made accessible should be erased since none of the conditions for lawfulness of processing applied. It was also stated that the DPA would look into whether an administrative fine would be imposed (Case No. 2018/1507, 29 November 2018). Later, on 28 March 2019, the DPA decided not to impose a fine (Case No. 2018/1507); and
  • the DPA concluded that the Ministry of Social Affairs had violated the Data Protection Act by publishing a report about the Ministry’s assessment in relation to complaints from three child protection committees against the Government Agency for Child Protection and its director. The DPA directed the Ministry to:
    • take particular care when processing personal data where it has plans to publish or make the data available to the public by other means; and
    • to make sure that the data does not contain information that can be used to identify individuals (Case No. 2018/1514, 11 March 2019).

    The DPA has not imposed any fines yet. Nevertheless, a significant number of cases are currently pending before the DPA.

    Q24/ Regulatory Guidance

    Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?

    At present, the DPA has not issued any formal guidance but currently provides a page with frequently answered questions on its website (see here).

    Jonsson & Hall contributors

    

    Geir Gestsson
    Partner, Jonsson & Hall
    T +354 414 4108
    E geir@law.is

    Geir is a partner at Jonsson & Hall in Reykjavík and specialises, amongst other areas, in Data Protection and Privacy Law.

    Geir is a Supreme Court Attorney with expertise in litigation before courts and in handling administrative proceedings before authorities. Geir has handled numerous cases and complaints before the Icelandic DPA on behalf of the firm’s clients, both for individuals and legal entities.

    

    Linda Ramdani
    Associate, Jonsson & Hall
    T +354 414 4115
    E linda@law.is

    Linda is an associate at Jonsson & Hall. She is a District Court Attorney and also specialises in Data Protection and Privacy Law.

    Linda advises the firm’s clients with matters related to data protection, especially with general compliance issues as well as assisting international clients regarding the Icelandic Data Protection Act and the processing of personal data specifically.

    Other chapters

    • Foreword and issue-by-issue comparison
    • Country-by-country guides: