Publications & Events
Article

GDPR Guide to National Implementation: Iceland

A practical guide to national GDPR compliance requirements across the EEA

Iceland

Other chapters

Foreword and issue-by-issue comparison

Austria

Belgium

Bulgaria

Croatia

Cyprus

Czech Republic

Denmark

Estonia

Finland

France

Germany

Greece

Hungary

Iceland

Ireland

Italy

Latvia

Liechtenstein

Lithuania

Luxembourg

Malta

Netherlands

Norway

Poland

Portugal

Romania

Slovakia

Slovenia

Spain

Sweden

United Kingdom

Glossary

[back to top of page]

 

Get your copy

Request a hard copy of the GDPR Guide to National Implementation »

 

In this chapter:

Q1/ Applicable legislation

Q2/ Personal data of deceased persons

Q3/ Legal bases for processing

Q4/ Consent of children

Q5/ Processing of sensitive personal data

Q6/ Data relating to criminal offences or convictions

Q7/ Exemptions

Q8/ Restrictions on data subjects’ rights

Q9/ Joint controllership

Q10/ Processor

Q11/ Data protection Impact Assessments

Q12/ Prior authorisation and public interest

Q13/ DPOs

Q14/ International data transfers

Q15/ DPAs

Q16/ Claims by not-for-profit bodies

Q17/ Administrative fines, penalties and sanctions

Q18/ Freedom of expression and information

Q19/ National identification numbers

Q20/ Processing in the context of employment

Q21/ Other material derogations

Q22/ Current legal challenges

Q23/ Enforcement

Q24/ Regulatory Guidance

———

[back to top of page]

 

 

Q1/ Applicable legislation

(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?

New legislation has been passed.

———

(b) Relevant legislation includes:

  • Act No. 90/2018 on Data Protection and the Processing of Personal Data (in Icelandic: Lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga) (the “Data Protection Act”)
    • Date in force: 15 July 2018
    • Link: In Icelandic: 
      see here
       

———

(c) What is the status of national pre-GDPR data protection law?

The relevant pre-GDPR legislation has been repealed in full.

———

[back to top of page]

 

 

Q2/ Personal data of deceased persons

Does national law make specific rules regarding the processing of personal data of deceased persons?

The Data Protection Act applies to the processing of personal data of deceased persons, as applicable, for a period of five years from the date of their death, or longer if it is reasonable to keep the personal data confidential.

———

[back to top of page]

 

 

Q3/ Legal bases for processing

(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?

There are no specific rules governing this issue.

———

(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?

Under the Data Protection Act, the following rules apply regarding processing of personal data for research, statistics or archiving carried out in the public interest:

  • Arts. 15, 16, 18 & 21 GDPR do not apply when the processing of personal data is carried out solely in the interest of science or history or for statistical purposes, insofar as those rights make it impossible or prevent the relevant goals from being achieved; and
  • Arts. 15, 16 & 18-21 GDPR do not apply when the processing of personal data is carried out solely for archiving in the public interest insofar as those rights make it impossible or prevent the relevant goals from being achieved.

———

(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?

Under the Data Protection Act, Arts. 13 & 14 GDPR do not apply when authorities transfer personal data to another authority in accordance with their legally prescribed role and information is transferred only to the extent necessary to fulfil the legal obligation of the authority.

———

(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?

There are no specific additional criteria governing this issue.

———

[back to top of page]

 

 

Q4/ Consent of children

At what age can a child give their consent to processing in relation to ISS?

13 years of age.

———

[back to top of page]

 

 

Q5/ Processing of sensitive personal data

(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?

All sensitive personal data can be processed if the data subject’s valid consent has been obtained.

———

b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:

(i) Employment, social security and/or social protection law

There are no specific rules on processing this category of data.

(ii) Substantial public interest

There are no specific rules on processing this category of data.

(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services

There are no specific rules on processing this category of data.

(iv) Public interest in the area of public health

There are no specific rules on processing this category of data.

(v) Archiving purposes, scientific or historical research purposes or statistical purposes

See Q3(b) above.

———

(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?

There are no specific rules on processing this category of data.

———

[back to top of page]

 

 

Q6/ Data relating to criminal offences or convictions

Under what conditions does national law permit the processing of personal data relating to criminal convictions?

Under the Data Protection Act, public authorities are not permitted to process data containing information about criminal behaviour unless it is necessary in the interest of their legally prescribed roles.

Data containing information about criminal behaviour cannot be disclosed unless:

  • the data subject has given explicit consent;
  • the disclosure is necessary to protect the legitimate interests of the government or a private party, where these interests obviously outweigh the interests of keeping the data secret, taking into consideration the interests of the data subject;
  • the disclosure is necessary in the interest of a legally prescribed role of the authority or in order for an administrative decision to be made; or
  • the disclosure is necessary to carry out a task which the government has assigned to a private party.

Private parties cannot process data regarding criminal behaviour unless:

  • the data subject has given explicit consent; or
  • the processing is necessary to achieve a legitimate interest which clearly outweighs the fundamental rights and freedoms of the data subject.

———

[back to top of page]

 

 

Q7/ Exemptions

(a) Does national law specify exemptions to a data subject’s right to erasure?

There are no specific exemptions to the right to erasure.

———

(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?

There are no specific exemptions to the right to be provided information.

———

(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?

There are no specific exemptions to the right to not be subject to automated individual decision-making.

———

[back to top of page]

 

 

Q8/ Restrictions on data subjects’ rights

Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?

Under the Data Protection Act, Arts. 13(1)-(3), 14(1)-(4) & 15 GDPR do not apply where urgent interests related to the data, including the interests of the data subject, outweigh the purpose of the envisaged processing.

The application of Arts. 13-15 GDPR may be restricted if such a restriction respects fundamental rights and freedoms and is considered necessary in a democratic society to:

  • ensure national security;
  • ensure national defence;
  • ensure public safety;
  • prevent, investigate or prosecute criminal offences or enforce criminal penalties, including to protect against, and prevent, threats to public safety;
  • protect public interests, specifically economic and financial goals (including in relation to foreign currency matters, national budget and fiscal matters, public health and national insurance);
  • ensure the protection of the data subject, urgent public interests or the fundamental rights of others;
  • protect civil law claims; or
  • protect legal provisions on obligations to observe secrecy.

These restrictions can be applied to personal data in working files that are used to prepare decisions by the controller, where the personal data has not been distributed to others, to the extent that the data is necessary to ensure the preparation of the applicable decision.

Data handled by public authorities may be exempt from the right of access under Art. 15 GDPR under the same exemptions as the right to information granted under the Information Act No. 140/2012 and the Administrative Procedures Act No. 37/1993.

Art. 34 GDPR does not apply when restrictions are necessary to ensure national security, or to prevent, investigate or prosecute criminal offences or carry out criminal penalties, including to protect against, and prevent, threats to public safety.

———

[back to top of page]

 

 

Q9/ Joint controllership

Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?

There are no additional rules on apportionment of liability between joint controllers.

———

[back to top of page]

 

 

Q10/ Processor

In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?

There are no additional pieces of legislation.

———

[back to top of page]

 

 

Q11/ Impact Assessments

Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?

Under the Data Protection Act, the DPA must publish a list covering the types of processing for which an Impact Assessment is required.

The DPA can also decide to publish a list covering the type of processing operations for which an Impact Assessment is not required.

———

[back to top of page]

 

 

Q12/ Prior authorisation and public interest

Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?

When the processing of personal data is related to a project in the public interest that risks violating the rights and freedom of data subjects, the DPA can decide that processing may not commence without prior review and authorisation by the DPA. The DPA can waive this authorisation requirement when general rules and safety standards are in place.

———

[back to top of page]

 

 

Q13/ DPOs

(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?

DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.

———

(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?

Under the Data Protection Act, DPOs are prohibited from disclosing any confidential information obtained at their respective organisation. 

The confidentiality obligation does not apply if the data subject has given its consent to waive confidentiality, nor when disclosure is necessary for the performance of the DPO’s duties.

———

[back to top of page]

 

 

Q14/ International data transfers

(a) Does national law make specific rules about transfers of personal data from public registers?

Data transfers from public registers are not subject to specific rules.

———

(b) Does national law restrict the transfer of specific categories of personal data to third countries?

Data transfers are not subject to restrictions beyond those set out in the GDPR.

———

[back to top of page]

 

 

Q15/ DPAs

(a) Details of the DPA(s).

  • Name of DPA: Persónuvernd
    • Address: Rauðarárstígur 10, 105 Reykjavík, Iceland
    • Website: personuvernd.is

———

(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?

Not applicable as there is only one DPA.

———

(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?

Not applicable.

———

(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?

Under the Data Protection Act, the DPA can request assistance from the police if anyone tries to prevent it from exercising its authority during the course of an investigation.

Further, where a controller or a processor is found to be processing data in violation of the GDPR, the DPA may request that the police temporarily put a stop to operations by the relevant entity and seal the entity’s offices.

———

(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?

Challenges can be submitted as claims before the relevant courts, but administrative appeals cannot be brought.

———

(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?

Under the Data Protection Act, the DPA has a right to request information or access to offices or computer systems and such access cannot be limited based on obligations of professional secrecy.

———

[back to top of page]

 

 

Q16/ Claims by not-for-profit bodies

Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?

There are no not-for-profit bodies that are specifically mandated to bring such claims.

———

[back to top of page]

 

 

Q17/ Administrative fines, penalties and sanctions

(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?

There are no specific rules regarding fines for public authorities (i.e., public authorities can be fined in the same manner as individuals and legal entities).

———

(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?

Under the Data Protection Act, an individual may be sentenced to up to three years of prison for an especially serious breach of the Data Protection Act.

The representative of a legal entity, or its employees, can be sentenced to prison in addition to being subject to an administrative fine.

A DPO, or an employee of the DPA, who violates obligations of secrecy can be sentenced to up to one year of imprisonment or, in special circumstances, up to three years.

———

[back to top of page]

 

 

Q18/ Freedom of expression and information

(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?

A controller may depart from the provisions of the Data Protection Act to the extent that the envisaged processing is necessary for exercising its right to freedom of expression in the interest of media, art or literature.

Where processing is carried out solely for journalistic purposes or for the purpose of academic artistic or literary expression, only Arts. 5(1)-(2), 24, 26, 28-29, 32, 40-43 & 82 GDPR and Arts. 48 & 51 of the Data Protection Act will apply.

———

(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?

See Q18(a) above.

———

[back to top of page]

 

 

Q19/ National identification numbers

Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?

The use of national identification numbers (kennitala) is permitted for “objective purposes” and when it is necessary to ensure secure personal identification. The DPA can forbid or authorise the processing of national identification numbers. “Objective purposes” are not specifically defined in the Data Protection Act. The preparatory work behind the Data Protection Act only states that the requirement of “objective purposes” will not be met unless other identifiers, such as the data subject’s name, address or customer number, are incomplete. In assessing the “objective purposes” it is necessary to, inter alia, consider whether a secure personal identification is important for the data subject, for the guarantor or for the public interest.

———

[back to top of page]

 

 

Q20/ Processing in the context of employment

(a) For what purposes can employees’ personal data in the employment context be processed under national law?

There are no specific provisions governing the processing of employee data.

———

(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?

There are no specific safeguards of this nature.

———

[back to top of page]

 

 

Q21/ Other material derogations

Are there any other material derogations from, or additions to, the GDPR under national law?

There are no other material derogations.

———

[back to top of page]

 

 

Q22/ Current legal challenges

Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?

There are no current legal challenges ongoing.

———

[back to top of page]

 

 

Q23/ Enforcement

Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?

The DPA has taken enforcement action for breaches of the GDPR in the following cases:

  • the DPA decided that an online database where information from tax registers for the year 2016 were made accessible should be erased since none of the conditions for lawfulness of processing applied. It was also stated that the DPA would look into whether an administrative fine would be imposed (Case No. 2018/1507, 29 November 2018). Later, on 28 March 2019, the DPA decided not to impose a fine (Case No. 2018/1507); and
  • the DPA concluded that the Ministry of Social Affairs had violated the Data Protection Act by publishing a report about the Ministry’s assessment in relation to complaints from three child protection committees against the Government Agency for Child Protection and its director. The DPA directed the Ministry to:
    • take particular care when processing personal data where it has plans to publish or make the data available to the public by other means; and
    • to make sure that the data does not contain information that can be used to identify individuals (Case No. 2018/1514, 11 March 2019).

The DPA has not imposed any fines yet. Nevertheless, a significant number of cases are currently pending before the DPA.

———

[back to top of page]

 

 

Q24/ Regulatory Guidance

Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?

At present, the DPA has not issued any formal guidance but currently provides a page with frequently answered questions on its website (see here).

———

[back to top of page]

 

 

Jonsson & Hall contributors

Geir Gestsson

Geir Gestsson
Partner, Jonsson & Hall
T +354 414 4108
E [email protected]

Geir is a partner at Jonsson & Hall in Reykjavík and specialises, amongst other areas, in Data Protection and Privacy Law.

Geir is a Supreme Court Attorney with expertise in litigation before courts and in handling administrative proceedings before authorities. Geir has handled numerous cases and complaints before the Icelandic DPA on behalf of the firm’s clients, both for individuals and legal entities.

Linda Ramdani

Linda Ramdani
Associate, Jonsson & Hall
T +354 414 4115
E [email protected]

Linda is an associate at Jonsson & Hall. She is a District Court Attorney and also specialises in Data Protection and Privacy Law.

Linda advises the firm’s clients with matters related to data protection, especially with general compliance issues as well as assisting international clients regarding the Icelandic Data Protection Act and the processing of personal data specifically.

———

[back to top of page]

 

 

Other chapters

———

See also:

Our Global Data, Privacy & Cybersecurity Practice »

GDPR Handbook: Unlocking the EU General Data Protection Regulation »

———

[back to top of page]

 

 

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP