Persónuvernd (Iceland) - 2022020333

Persónuvernd - 2022020333
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 5(1) GDPR Article 5(2) GDPR Article 6 GDPR Article 32(1) GDPR Act no. 32/2009 Article 2(2) Act no. 32/2009 Article 7(1(d))
Type:	Complaint
Outcome:	Upheld
Started:	07.02.2022
Decided:	14.12.2022
Published:
Fine:	n/a
Parties:	Íslandsbanki (Bank of Iceland)
National Case Number/Name:	2022020333
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Icelandic
Original Source:	Personuvernd (in IS)
Initial Contributor:	Nur-Khmeydan

The Icelandic DPA ruled that controllers obligated by national provisions to disclose certain information about a data subject also have a duty of due diligence which includes an obligation to verify the accuracy of information found in registration books.

English Summary

Facts

The controller in this matter was the Bank of Iceland and the data subject was the owner of an appartment in a building. The controller communicated information about the data subject’s debt status to people who owned real estate in the same building as the data subject according to the official owner registration books. Specifically, the controller sent the balance of two mortgage bonds.

The controller stated that it had to do so under a national law (Article 7(1(d)) Act no. 32/2009). It relied on registration books established by a public authority.

However, in this case, the registration books had placed 25 people as registered owners of the property whereas the data subject was the only unconditional owner. The controller explained that it believed it was reasonable to rely onthe registration book. It also considered that the data processed was not sensitive data within the meaning of Article 3(3) Act no. 90/2018.

Holding

The DPA agreed that there was a legal obligation on the controller arising from the national provision to notify owners of the property in the registration book within the context of Act no 32/2009 Article 2(2). The processing was therefore lawfull under Article 6(1) GDPR.

It considered that registration books can usually be relied on for the authenticity of the information. However, in this case, the data subject had 100% ownershop while the other 25 people mentionned in the registration book only had property lease agreement. The data controller therefore had every reason to examine and furthur investigate the registration book before sending notifications under their legal duties. Indeed, the controller was the responsible party for taking appropriate technical and organizational security measures to ensure adequate security of personal data.

Consequently, the DPA held that the controller did not fulfill its duty of diligence and pursuant Article 58(2)(c) GDPR, it asked the data controller to take measures to ensure the appropriate security of personal information to be maintained when sending notifications, and no fine was imposed on the data controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Processing of personal information by Íslandsbanki hf.

Case no. 2022020333

14.12.2022

One of the main obligations of those who work with personal data is to ensure its security. In this case, appropriate security was not observed when sharing information, which resulted in it being shared with unauthorized parties.

----

The Swedish Data Protection Authority ruled in a case where there was a complaint about the processing of personal data by Íslandsbanki. More specifically, the complaint was based on the fact that Íslandsbanki had shared information about the complainant's debt status to others who owned real estate in the same building as the complainant.

The conclusion of the Personal Protection Authority was that Íslandsbanki had not taken appropriate security measures when sharing the complainant's personal information, and the institution recommended that Íslandsbanki take measures to ensure that appropriate security measures will subsequently be implemented.

Ruling

about a complaint about the processing of personal data by Íslandsbanki hf. in case no. 2022020333:

i
Procedure
1.
Outline of a case

On February 7, 2022, Personal Protection received a complaint from [A] (hereinafter the complainant). The complaint was based on the fact that Íslandsbanki hf. (hereafter Íslandsbanki) had communicated information about the complainant's debt status to unauthorized parties by letter. More specifically, Íslandsbanki had sent the balance of two mortgage bonds to others who owned real estate in the same building as the complainant.

Personal Protection invited Íslandsbanki to comment on the complaint in a letter dated 24 October 2022 and the bank's answers were received by email on 8 November s.á.

When resolving the case, the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

2.
The main points of view of the parties

There is a dispute over the legality of the processing of personal information about the complainant by Íslandsbanki, which involved sharing information about his debt status to others who owned real estate in the same building as the complainant.

The complainant essentially relies on the fact that Íslandsbanki carried out the mediation in question without authorization.

On the part of Íslandsbanki, it is based on the fact that the processing in question was based on point d of paragraph 1. Article 7 Act no. 32/2009, on guarantors, which obliges the bank to send the loan guarantor a notification about the status of the loan for which the guarantor stands and an overview of guarantees after each year's end. The bank points out that when making such notifications, information about the issuers of mortgage debt and security bonds is compared with the owners of real estate according to the registration books of the commissioners, and if the issuer is other than the owner of the property, it is a so-called mortgage, which the bank is obliged to notify the owner of the property about according to the aforementioned provisions of the law on guarantors. In the case complained of, the registration in the registration book was in such a way that all apartment owners in the complainant's house were registered registered owners of his property. Íslandsbanki points out that the case was investigated by the commissioner after the bank received a comment from the complainant regarding the case. According to the commissioner's explanations, it appears that the registration in question was made in connection with the registration of an amendment to the land lease agreement, and the registration was corrected following the bank's comments.

Íslandsbanki believes that it was possible to rely on the registration of the registration book when broadcasting the announcements, as such registrations are generally reliable. Íslandsbanki also believes that the processing in question was not a breach of security in the sense of the privacy legislation, as the bank believed it was relying on the reliable owner registration of a public entity. Finally, Íslandsbanki relies on the fact that the personal information in question is not sensitive, as it is registered in an official registration in the notary register.

Íslandsbanki sent Personal Protection a copy of the mortgage statement for the complainant's real estate, dated May 9, 2021, in support of his case preparation. According to the mortgage summary, the complainant was the registered owner of 100% of the property according to a conditional ownership authorization, i.e. purchase agreement, but another person was registered as the owner of 100% of the property according to an unconditional right of ownership, i.e. waiver According to the mortgage summary, 25 other individuals were also registered owners according to the land lease agreement, but their share of ownership was not specified.

II.
Conclusion
1.
Scope - Guarantor

Scope of law no. 90/2018, on personal protection and processing of personal data, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic.

This case concerns Íslandsbanki's dissemination of information about the complainant's debt status to others who owned real estate in the same building as the complainant. It concerns the processing of personal data that falls under the authority of the Personal Protection Agency.

Information on debt status is not sensitive personal information, as defined in section 3. Article 3 Act no. 90/2018, cf. Paragraph 1 Article 9 of Regulation (EU) 2016/679, but financial information may concern people's pure private interests. The information that this case concerns, i.e. real debt status, are not officially registered in the registration book, as Íslandsbanki claims, since the mortgage bond statement only shows the initial amount of mortgage bonds. The mortgage statement therefore does not reflect the actual debt position at any given time, contrary to the announcements that this case concerns.

As stated here, Íslandsbanki is considered to be the responsible party for the processing in question according to Act no. 90/2018, on personal protection and processing of personal data, and Regulation (EU) 2016/679.

2.
Lawfulness of processing

All processing of personal data must be covered by one of the authorized provisions of Article 9. Act no. 90/2018, cf. Article 6 of regulation (EU) 2016/679. Has Íslandsbanki referred to the fact that the processing discussed here was necessary to fulfill the legal obligation that rests on the bank according to law no. 32/2009, on guarantors, cf. Number 3. of the legal provision, cf. c-point 1. paragraph of the regulatory provision.

In addition to authorization according to the above, the processing of personal data must be compatible with all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Article 5 of regulation (EU) 2016/679. The principles stipulate, among other things, that personal data must be processed in such a way that the appropriate security of the personal data is guaranteed (section 6 of the legal provision). The responsible party is responsible for ensuring that the processing of personal information is always compatible with the principles and must be able to demonstrate this, cf. Paragraph 2 Article 8 of the law, cf. Paragraph 2 Article 5 of the regulation.

More detailed provisions regarding the security of personal information can be found in Article 27. Act no. 90/2018 and Article 32 of regulation (EU) 2016/679. According to paragraph 1 of both clauses, the responsible party must take appropriate technical and organizational security measures to ensure adequate security of personal data that takes into account the nature, scope, context and purpose of the processing and the risk to the rights and freedoms of data subjects. When assessing adequate security, the risk that processing entails must be taken into account, among other things that access to personal information is granted without permission, cf. Paragraph 2 of the regulatory provision.

When assessing legality according to the aforementioned provisions, other relevant legal rules must also be taken into account.

According to Íslandsbanki's explanations, the processing of personal information discussed here is based on point d of paragraph 1. Article 7 Act no. 32/2009, on guarantors. The provision stipulates that the lender must send the guarantor a notification at the end of each year about the status of a loan for which he is a guarantor. According to paragraph 2 Article 2 of the same law, the term guarantor includes, among other things, a person who pledges his specified property as security for the borrower's performance, subject to further conditions being met.

It is also to be considered that according to the non-statutory rule of notarization law, notarization books have what has been called real authenticity. This means that there is usually a chance that the information in the registration books is correct. In cases where there is no full agreement between the registered rights over property and the real rights, for example due to a mistake by the notary manager during registrations, the reliability of the information recorded in the registration books can generally be relied upon.

Íslandsbanki's case preparation will be understood to mean that the bank considered the persons who were specified as the owners of the complainant's property in the registration book, as the guarantors of the mortgage debts that rested on the complainant's property within the meaning of paragraph 2. Article 2 Act no. 32/2009 and therefore the bank had to send them a notification about the status of the loan according to point d of paragraph 1. Article 7 of the same law.

Law no. 32/2009 neither reserve nor forbid that registered ownership is taken into account when assessing whether a person has become liable for a mortgage debt by mortgaging their property. According to that, it is clear that lenders can decide to take account of notarization books for this purpose and can normally assume that such an arrangement leads to secure processing of personal information, in light of the unwritten rule of notarization law about the real reliability of notarization books.

However, notarized owner registration may give lenders a special reason for further investigation before notifications according to Act no. 32/2009 are sent, if that is the case. This can, for example, apply when it is obvious that the registration books contain incorrect information about ownership. In this connection, what is described above regarding the nature of the information that appears in notifications of this nature is taken into account, i.e. that this is financial information that may concern the pure private interests of people and is not registered in the official register. It calls for the lender to pay special attention to the security of the information, including that unauthorized parties do not get access to them, taking into account the provisions of Article 27. Act no. 90/2018 and Article 32 of regulation (EU) 2016/679. Therefore, the lender cannot rely entirely on information from registration books for the purpose of sending out notices according to Act no. 32/2009.

In the mortgage summary, which Íslandsbanki took into account when sending the notices in the present case, there are a total of 27 registered owners. It states that the complainant has 100% ownership in the property in question according to the purchase agreement, while another person has the corresponding ownership according to a waiver. Furthermore, the mortgage summary states that the ownership of the other 25 is a land lease agreement and their share of ownership is not specified. In the opinion of the Data Protection Authority, these points, i.e. the number of registered owners, their ownership and lack of ownership share, Íslandsbanki has every reason to examine the owner registration in the registration book before notifications were sent to anyone other than the waiver holder. However, from the bank's explanations, it cannot be seen that this was done, but on the contrary, it relied entirely on the notarized ownership registration for this purpose.

Considering the above, the Personal Protection Authority does not believe that it is possible to agree with Íslandsbanki that the processing in question was based on a legal obligation, cf. Number 3. Article 9 Act no. 90/2018 and point c of paragraph 1. Article 6 Regulation (EU) 2016/679, as the information was not only communicated to those whom Íslandsbanki could in good faith consider to be guarantors within the meaning of Act no. 32/2009. This also means that the bank has not demonstrated that the appropriate security of the personal information has been ensured, cf. Number 6. Paragraph 1 and paragraph 2 Article 8 of the law, cf. point f, paragraph 1 and paragraph 2 Article 5 of the regulation, cf. also Article 27 of the Act and Article 32 of the regulation.

In accordance with this conclusion, and with reference to item 4. Article 42 Act no. 90/2018, cf. point d, paragraph 2 Article 58 regulation (EU) 2016/679, Íslandsbanki is asked to take measures to ensure that the appropriate security of personal information will subsequently be maintained in connection with the sending of notifications according to law no. 32/2009. The measures shall be aimed at preventing unauthorized access to personal information during such shipments. They can, for example, consist of warnings in information systems, which may be used during such processing, that owner registration in registration books warrants special consideration before a notification is sent.

Confirmation that these instructions have been complied with, together with a description of the contents of the measures taken on this occasion, shall be received by Personal Protection no later than January 23, 2023.

Ruling:

Mediation Íslandsbanki hf. on the personal information of [A], which consisted in the fact that unauthorized parties were sent information about his debt status according to two mortgage bonds that he had issued to the bank, was neither based on authorization nor compatible with the principles of Act no. 90/2018, on personal protection and processing of personal data and Regulation (EU) 2016/679, on the security of personal data.

In accordance with this conclusion, and with reference to item 4. Article 42 Act no. 90/2018, cf. point d, paragraph 2 Article 58 regulation (EU) 2016/679, is submitted to Íslandsbanki hf. to take measures to ensure that the appropriate security of personal information will subsequently be implemented in connection with the sending of notifications according to Act no. 32/2009 on guarantors. Confirmation that these instructions have been complied with, together with a description of the contents of the measures taken on this occasion, shall be received by Personal Protection no later than January 23, 2023.



Privacy, December 14, 2022

Helga Þórisdóttir Bjarni Freyr Rúnarsson