View source for Persónuvernd (Iceland) - 2022020332 and 2021112244

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

<pre>
Solutions

Processing of personal information by Íslandspósts ohf

Case no. 2022020332 and 2021112244

7.10.2022

Personal protection ruled in the cases of two unanimous complaints from parties about the processing of personal information about them by Íslandspósts ohf. when handling letters from abroad. More specifically, the complainant believed that Íslandspóstur maintained a special register of stamp collectors, including himself.

The conclusion of the Personal Protection Agency was that it was considered unproven that Íslandspóst's processing of the complainant's personal information violated the law.

Ruling



On June 20, 2022, Personal Protection issued the following ruling in cases no. 2022020332 and 2021112244:

i
Procedure
1.
Complaint and procedure

On November 24, 2021 and February 15, 2022, Personal Protection received complaints from [A] (hereinafter the complainant) about the processing of Íslandspósts ohf. on personal information about him, when handling correspondence from abroad. The complainant considered Íslandspóst ohf. maintain a separate register of stamp collectors including themselves.

Personal protection invited Íslandspósti ohf. to comment on the complaint by letter, dated May 10, 2022, and the company's answers were received by letter, dated May 31, 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

Personal protection invited Íslandspósti ohf. to comment on the complaint by letter, dated May 10, 2022, and the company's answers were received by letter, dated May 31, 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

2.
Complainant's point of view

The complainant relies on the fact that Íslandspóst's Customs Agency maintains a special register of stamp collectors, including itself, for the purpose of taking all mail that the complainant and other Icelandic stamp collectors receive from abroad for customs processing. In the complainant's opinion, it cannot be considered normal that all mail he receives from abroad is taken for customs processing, regardless of whether it is traceable or general letters.

3.
Sjónarmið Íslandspósts ohf.

Íslandspóstur ohf. therefore refuses to maintain a separate register of Icelandic stamp collectors. In the aforementioned letter of Íslandspósts ohf. states that all product shipments to Iceland are subject to customs duties according to the customs law. Íslandspóstur ohf. it is therefore appropriate that over time the employees of Íslandspóst ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing. On behalf of Íslandspósts ohf. it is specifically stated that it follows from the provisions of the Customs Act and Íslandspóst's duties as a customs broker to be alert for all shipments arriving in the country, even if they are marked as gifts or sent as ordinary letters.

II.
Conclusion

Scope of law no. 90/2018, on personal protection and processing of personal data, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic.

The complainant believes that Íslandspóstur ohf. maintain a special register of stamp collectors, including himself, for the purpose of taking all correspondence received by the complainant from abroad for customs processing. Íslandspóstur ohf. therefore refuses to maintain a separate register of stamp collectors, but accepts that over time the employees of Íslandspósts ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing.

With reference to this, there is no evidence that personal data has been processed in violation of Act no. 90/2018, cf. regulation (EU) 2016/679. In addition, Personal Protection does not consider it necessary for the organization to use additional powers, which are given to it in Act no. 90/2018, in order to investigate it further.

Ruling:

It is unproven that the processing of personal information about the complainant took place at Íslandspósti ohf. which violated law no. 90/2018, on personal protection and processing of personal information.

Privacy, October 7, 2022

Helga Sigríður Þórhallsdóttir                     Edda Þuríður Hauksdóttir
</pre>