Persónuvernd - 2020031337

Persónuvernd - 2020031337
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 6 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	16.02.2021
Published:	16.02.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	2020031337
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Personuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA (Persónuvernd) held that a public institution was, on the basis of the Icelandic Act on Public Archives, not permitted to delete the complainant's personal information.

English Summary

Facts

The DPA received a complaint regarding the processing of personal information by Landsnet, a public institution. The complainant unsuccessfully applied for a job with Landsnet. After the application process ended, he requested his personal data at Landsnet to be deleted. Landsnet rejected his request on the grounds that on the basis of Act no. 77/2014 on public archives, it was not permitted to discard any document in the company's archives except on the basis of an approval of a national archivist, the rules of the National Archives of Iceland or on the basis of a special legal provision.

Holding

The DPA dismissed the part of the complaint concerning the rejection of the complainant's request for the deletion of personal information and decided only on Landsnet's authorization to retain the information.

In the opinion of the DPA, the storage of complainant's personal information by Landsnet can take place on the basis of the Act no. 44/2014, Coll. 3. tölul, Paragraph 1 Article 9 Act no. 90/2018 and point c of the first paragraph, and Article 6 Regulation (EU) 2016/679.

In addition to the authorization according to the above, the processing of personal information must satisfy all the basic requirements of the first paragraph. . In the opinion of the Data Protection Authority, it cannot be seen that the processing of personal information by Landsnet was in conflict with the basic requirements of Article 8. Act no. 90/2018 and Article 5. Regulation (EU) 2016/679.

The DPA concluded that Landsnet's retention of personal information about the complainant was in accordance with Act no. 90/2018.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Retention of personal information in a public institution
Case no. 2020031337
16.2.2021
The Data Protection Authority has ruled in a case where a complaint was made about the retention of personal information by a public institution. The ruling concluded that the Agency was not permitted to delete the information in question on the basis of the Act on Public Archives and that the processing of personal data about the complainant was in accordance with the Act on Personal Data Protection and Processing.

Ruling

On January 25, 2021, the Data Protection Authority issued a ruling in case no. 2020031337:

I.
Procedure

1.
Complaints and correspondence
On March 29, 2020, the Data Protection Authority received a complaint from [A] (hereinafter referred to as "the complainant") regarding the processing of personal information about him by Landsnet hf. (here after Landsnet).
The complaint states that the complainant applied for a job with Landsnet, but did not get the job. After the application process ended, he requested that personal information about him at Landsnet be deleted. It is also stated that Landsnet rejected his request on the grounds that the company was a party subject to delivery on the basis of Act no. 77/2014 on public archives and that the company was therefore not permitted to discard or discard any document in the company's archives except on the basis of an approved national archivist, the rules of the National Archives of Iceland or on the basis of a special legal provision.

By letter dated On 14 September 2020, Landsnet was invited to submit comments on the complaint. Landsnet's reply was received by letter dated 24. cm By letter dated On 19 November this year, the complainant was given an opportunity to comment on the responses of the responsible party, but a reply was received by letter dated. 26. cm By letter dated On 9 December, further information was requested from the responsible party, but a reply was received by letter dated. January 4, 2021

In resolving the case, all of the above documents have been taken into account, although not all of them are specifically described in the following ruling.

2.
The complainant's views
The complainant states that he submitted a request for removal orally but that it was refused. In the complainant's opinion, Landsnet is not permitted to store personal information about him after it was clear that he would not be hired for the job in question. Therefore, personal information about him stored by the company should be deleted.

3.
Landsnet's views
Landsnet's reply states, among other things, that on the basis of the principles of Act no. 90/2018 shall not store personal information for longer than is appropriate with regard to the purpose of processing, cf. 5. tölul. Paragraph 1 Article 8 of the Act. It is also stated that if the preservation of the information is provided for in other laws, then that preservation is considered relevant. On the basis of Act no. 44/2014, the company is not permitted to discard or discard any document in its archives and that this is stated, among other things, in Article 7. the company's privacy policy which is accessible on its website.

It is also stated that Landnet received an inquiry from the complainant on 27 January 2020, requesting information on the retention period of job applications with the company. The complainant was answered on the same day as he was informed that due to the provisions of Act no. 44/2014, Landnet was not permitted to discard or discard any document in the company's archives and the information was therefore stored indefinitely. In subsequent communications between Landsnet and the complainant, he was advised, among other things, to contact the National Archives regarding authorizations for gauze as well as Landsnet's privacy representative. Landsnet's reply letter states that from these communications it cannot be deduced that the complainant requested that the job application be deleted, it was only a question of retention by the company, but the communication in question accompanied Landsnet's reply letter to the Data Protection Authority.

In view of the above, Landsnet considers that the company is obliged to preserve the personal information and that the company would not be allowed to delete the personal information contained in the complainant's job application if the company were to receive a request to that effect.

II.
Assumptions and conclusion

1.
Delimitation of case - membership
This case concerns, on the one hand, Landsnet's retention of personal information about the complainant and, on the other hand, Landsnet's refusal of the complainant's request for the deletion of personal information.

According to the 1st sentence. Paragraph 2 Article 39 Act no. 90/2018, every registered individual has the right to lodge a complaint with the Data Protection Authority if he or she considers that the processing of personal data about him or her violates Regulation (EU) 2016/679 or the provisions of the Act. The Data Protection Authority then rules on whether a breach has taken place.

On behalf of the complainant, it has been stated that he has verbally requested that Landsnet delete personal information about him that is stored by the company. Landsnet therefore denies that the complainant made such a request. This is stated word for word and the Data Protection Authority does not have grounds to take a position on whether such a request has been submitted to Landsnet.

In view of the above, the part of the complaint concerning the rejection of the complainant's request for the deletion of personal information is therefore dismissed and only a decision will be made on Landsnet's authorization to retain the information.

2.
Scope - Responsible party
Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or are to become part of a file.

Personal information includes information about a person who is personally identifiable or personally identifiable, and an individual is considered personally identifiable if it is possible to identify him or her, directly or indirectly, with reference to his or her identity or one or more factors that are characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation.

Processing refers to an operation or series of operations in which personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 of the Act and point 2. Article 4 of the Regulation.

This case concerns the storage of Landsnet's personal information about the complainant in the company's archives. In this respect and in the light of the above provisions, this case concerns the processing of personal information which falls within the competence of the Data Protection Authority.

The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. 7. tölul. Article 4 of the Regulation. As such, Landsnet is considered to be responsible for the processing in question.

3.
Legality of processing
All processing of personal information, incl. á m. their preservation, must be subject to one of the authorization provisions of Article 9. Act no. 90/2018, Coll. Article 6 Regulation (EU) 2016/679. It may be mentioned that personal information may be processed if it is necessary to fulfill a legal obligation that rests with the responsible party, cf. 3. tölul. Article 9 of the Act and point c of the first paragraph. Article 6 of the Regulation.

Landsnet is a party subject to delivery on the basis of the second paragraph. Article 14 Act no. 44/2014, which means that the company is obliged to hand over its documents to the public archives when they have reached a certain age, cf. Paragraph 4 the same articles as the first paragraph. Article 15 of the Act. Then it says in the 1st paragraph. Article 24 of the Act that parties subject to delivery are not permitted to disuse or discard any document in their archives unless this is done on the basis of an approved national archivist, certain rules established on the basis of the Act or a special legal provision.

In the opinion of the Data Protection Authority, the storage of Landsnet's personal information about the complainant can take place on the basis of the above-mentioned provision of Act no. 44/2014, Coll. 3. tölul. Paragraph 1 Article 9 Act no. 90/2018 and point c of the first paragraph. Article 6 Regulation (EU) 2016/679.

In addition to the authorization according to the above, the processing of personal information must satisfy all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. It stipulates, inter alia, that personal data shall be obtained for clearly stated, lawful and objective purposes and not further processed for other and incompatible purposes (point 2); and that they shall be preserved in such a way that it is not possible to identify registered persons for longer than is necessary for the purpose of processing (point 5). In the opinion of the Data Protection Authority, it cannot be seen that the processing of personal information by Landsnet was in conflict with the basic requirements of Article 8. Act no. 90/2018 and Article 5. Regulation (EU) 2016/679.

In view of the above, as well as in light of the ruling of the Board of the Data Protection Authority, dated 14 December 2017, in case no. 2016/1433, the conclusion of the Data Protection Authority is that Landsnet's retention of personal information about the complainant is in accordance with Act no. 90/2018, on personal protection and processing of personal information.


Ú r s k u r ð a r o r ð:
The aspect of complaint [A] concerning Landsnet's refusal of his request for the deletion of personal data is dismissed.

Preservation of Landsnet hf. on personal information about [A] due to compliance with Act no. 90/2018, on personal protection and processing of personal information.


In Privacy, January 25, 2021


Þórður Sveinsson Vigdís Eva Líndal