Persónuvernd (Iceland) - 2022020332 and 2021112244: Difference between revisions
From GDPRhub
Gauravpathak (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Iceland |DPA-BG-Color= |DPAlogo=LogoIS.png |DPA_Abbrevation=Persónuvernd |DPA_With_Country=Persónuvernd (Iceland) |Case_Number_Name=20220203...") |
(Really good summary! The only thing I would watch out for is to use active instead of passive voice wherever possible.) |
||
| Line 63: | Line 63: | ||
}} | }} | ||
The Icelandic DPA rejected complaints | The Icelandic DPA rejected complaints which alleged that the Icelandic postal service unlawfully processed personal data by maintaining a special register for stamp collectors for lack of evidence. The DPA held that no violation of the GDPR was proven. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
On 24 November 2021 and 15 February 2022, a complaint | On 24 November 2021 and 15 February 2022, a data subject complaint to the Icelandic DPA regarding the processing of personal data by Íslandspóstur, i.e. the Icelandic postal authority. The Icelandic postal authority is the controller. | ||
The | The data subject alleged that the controller maintained a special register of stamp collectors, including the data subject. The allegation was based on the claim that all postage to the data subject from abroad was subjected to customs check, regardless of whether it was general or traceable letters. | ||
In reply, the controller stated that it was not maintaining a special register. It also stated that as per law, all shipments to Iceland are subject to customs duties, | In reply, the controller stated that it was not maintaining a special register. It also stated that, as per law, all shipments to Iceland are subject to customs duties and, as a customs broker, the postal authority is required to do customs processing. In addition, the controller added that with experience the employees of the postal authority gain knowledge about assessing high-value items. | ||
=== Holding === | === Holding === | ||
The Icelandic DPA | The Icelandic DPA noted that Article 4(1) GDPR applies to "the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." It added that there was no evidence of a special register for stamp collectors and that, therefore, also no evidence existed for GDPR-infringing personal data processing. | ||
Thus, the DPA rejected the complaint | Thus, the DPA rejected the complaint. The DPA did not consider it necessary to use its additional powers to carry out any further investigations. | ||
== Comment == | == Comment == | ||
Revision as of 09:40, 25 October 2022
| Persónuvernd - 2022020332 and 2021112244 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 2(1) GDPR Article 4(1) Data Protection and the Processing of Personal Data |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 24.11.2021 |
| Decided: | 20.06.2022 |
| Published: | 07.10.2022 |
| Fine: | n/a |
| Parties: | Íslandspóstur |
| National Case Number/Name: | 2022020332 and 2021112244 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Persónuvernd (in IS) |
| Initial Contributor: | gauravpathak |
The Icelandic DPA rejected complaints which alleged that the Icelandic postal service unlawfully processed personal data by maintaining a special register for stamp collectors for lack of evidence. The DPA held that no violation of the GDPR was proven.
English Summary
Facts
On 24 November 2021 and 15 February 2022, a data subject complaint to the Icelandic DPA regarding the processing of personal data by Íslandspóstur, i.e. the Icelandic postal authority. The Icelandic postal authority is the controller.
The data subject alleged that the controller maintained a special register of stamp collectors, including the data subject. The allegation was based on the claim that all postage to the data subject from abroad was subjected to customs check, regardless of whether it was general or traceable letters.
In reply, the controller stated that it was not maintaining a special register. It also stated that, as per law, all shipments to Iceland are subject to customs duties and, as a customs broker, the postal authority is required to do customs processing. In addition, the controller added that with experience the employees of the postal authority gain knowledge about assessing high-value items.
Holding
The Icelandic DPA noted that Article 4(1) GDPR applies to "the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." It added that there was no evidence of a special register for stamp collectors and that, therefore, also no evidence existed for GDPR-infringing personal data processing.
Thus, the DPA rejected the complaint. The DPA did not consider it necessary to use its additional powers to carry out any further investigations.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Processing of personal information by Íslandspósts ohf Case no. 2022020332 and 2021112244 7.10.2022 Personal protection ruled in the cases of two unanimous complaints from parties about the processing of personal information about them by Íslandspósts ohf. when handling letters from abroad. More specifically, the complainant believed that Íslandspóstur maintained a special register of stamp collectors, including himself. The conclusion of the Personal Protection Agency was that it was considered unproven that Íslandspóst's processing of the complainant's personal information violated the law. Ruling On June 20, 2022, Personal Protection issued the following ruling in cases no. 2022020332 and 2021112244: i Procedure 1. Complaint and procedure On November 24, 2021 and February 15, 2022, Personal Protection received complaints from [A] (hereinafter the complainant) about the processing of Íslandspósts ohf. on personal information about him, when handling correspondence from abroad. The complainant considered Íslandspóst ohf. maintain a separate register of stamp collectors including themselves. Personal protection invited Íslandspósti ohf. to comment on the complaint by letter, dated May 10, 2022, and the company's answers were received by letter, dated May 31, 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. Personal protection invited Íslandspósti ohf. to comment on the complaint by letter, dated May 10, 2022, and the company's answers were received by letter, dated May 31, 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. 2. Complainant's point of view The complainant relies on the fact that Íslandspóst's Customs Agency maintains a special register of stamp collectors, including itself, for the purpose of taking all mail that the complainant and other Icelandic stamp collectors receive from abroad for customs processing. In the complainant's opinion, it cannot be considered normal that all mail he receives from abroad is taken for customs processing, regardless of whether it is traceable or general letters. 3. Sjónarmið Íslandspósts ohf. Íslandspóstur ohf. therefore refuses to maintain a separate register of Icelandic stamp collectors. In the aforementioned letter of Íslandspósts ohf. states that all product shipments to Iceland are subject to customs duties according to the customs law. Íslandspóstur ohf. it is therefore appropriate that over time the employees of Íslandspóst ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing. On behalf of Íslandspósts ohf. it is specifically stated that it follows from the provisions of the Customs Act and Íslandspóst's duties as a customs broker to be alert for all shipments arriving in the country, even if they are marked as gifts or sent as ordinary letters. II. Conclusion Scope of law no. 90/2018, on personal protection and processing of personal data, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic. The complainant believes that Íslandspóstur ohf. maintain a special register of stamp collectors, including himself, for the purpose of taking all correspondence received by the complainant from abroad for customs processing. Íslandspóstur ohf. therefore refuses to maintain a separate register of stamp collectors, but accepts that over time the employees of Íslandspósts ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing. With reference to this, there is no evidence that personal data has been processed in violation of Act no. 90/2018, cf. regulation (EU) 2016/679. In addition, Personal Protection does not consider it necessary for the organization to use additional powers, which are given to it in Act no. 90/2018, in order to investigate it further. Ruling: It is unproven that the processing of personal information about the complainant took place at Íslandspósti ohf. which violated law no. 90/2018, on personal protection and processing of personal information. Privacy, October 7, 2022 Helga Sigríður Þórhallsdóttir Edda Þuríður Hauksdóttir
