Persónuvernd (Island) - 2022050850

Persónuvernd - 2022050850
[[File:|center|250px]]
Authority:	Persónuvernd (Island)
Jurisdiction:	Iceland
Relevant Law:	Article 6(1)(c) GDPR Article 9(2)(a) GDPR Article 9(2)(e) GDPR Article 13(4) GDPR Article 14(5) GDPR Elections Act no. 112/2021
Type:	Complaint
Outcome:	Rejected
Started:	12.05.2022
Decided:	21.12.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2022050850
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	personuvernd.is (in IS)
Initial Contributor:	co

The Icelandic DPA held that a law establishing that political parties' ombudsmen wear a badge indicating the party they represent during elections constituted lawful processing under Article 6(1)(c) GDPR and Article 9(2) GDPR.

English Summary

Facts

A data subject, who was the ombudsman of a political party running for Iceland’s National Elections in 2022, was requested by the Kópavogur electoral board to carry with him an identification document specifying the political party he represented. In the data subject’s view, this constituted unlawful processing of his personal data under Article 9 GDPR and he filed a complaint with the Icelandic DPA.

The National Electoral Commission, as a controller, submitted that it is obliged under the National Elections Act no. 112/2021 to oversee the carrying out of elections and to supervise the implementation of the law. Among its responsibilities is ensuring that local electoral commissions and the appointed ombudsmen and other agents that are involved in the election process also act in accordance with the law. In this, it is important that both the electoral commission and the voters know who the ombudsmen are and which political party they represent. Further the controller referred to its "Instruction of the National Electoral Commission on agents' credentials" issued on 11 May 2022 to the local electoral commissions, according to which the name of the candidate for whom electoral agents work must be indicated on their badge during elections.

Holding

The Icelandic DPA first determined that the National Electoral Commission is to be regarded as the controller in this case.

Then it considered that personal data can be processed for fulfillment of a legal obligation in accordance with Article 6(1)(c) GDPR and it underlined the fact that political opinions constitute a special category of personal data under Article 9(1) GDPR and their processing must meet the conditions set out in Article 9(2) GDPR.

The DPA then considered Article 53 of Elections Act no. 112/2021 which regulates the submission of candidate lists and foresees that the local electoral boards must prepare the credentials to be shown on the basis of the instructions of the National Electoral Commission. The latter refer to the instructions of 11 May 2022 outlined above. For these reasons, the DPA concluded that the processing was lawfully based on Article 6(1)(c) GDPR.

Further, the DPA assessed whether the processing was compatible with the principles of processing and the special conditions that apply to the processing of special categories of personal data.

As regards the political opinions of the data subject, the DPA ascertained that first, the data subject was informed about the information that would be shown on his badge and he consented thereto; secondly, it was established that he was a candidate for that party and deputy in a constituency for the same party in the past, so that his political views were already made public. Hence, the DPA held that the political opinion of the data subject was being processed in accordance with Article 9(2)(a) and (e) GDPR.

With respect to the principles of processing, the DPA held that the requirement of fairness and transparency under Article 5(1)(a) GDPR was fulfilled to the extent that the controller is not obliged to provide information to the data subject under Article 13(4) GDPR if the latter already has knowledge of the information to be disclosed. Also, under Article 14(5) GDPR, the controller was exempt from providing information to the data subject, since the processing was clearly foreseen by law.

Thus, the DPA concluded that the processing of the data subject’s personal data by the National Electoral Commission was compatible with the GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Processing of personal information by the National Electoral Commission and the Chief Electoral Commission of Kópavogur for the 2022 elections

Case no. 2022050850

21.12.2023

The National Electoral Commission has the duty to issue instructions on the identity cards that agents of political organizations must use in their work. The credentials should specify who is authorized to act as agents, both so that the staff of the electoral commissions and the voters know who the agents are and for which political organization they work. In this case, an agent complained about being required to carry an identity card with information about the political organizations he represented during the conduct of elections.

---

Personal data protection ruled in a case where a complaint was made about the processing of personal information by the National Electoral Commission and the Chief Electoral Commission of Kópavogur for the 2022 elections. More specifically, there was a complaint about the fact that agents are required to carry identification with the name of the political party for which the agent in question appears.

The processing of personal information about the complainant's political views was based on a legal authorization and the complainant was informed about the relevant processing of his personal information when a photo of him was requested for use in issuing the identification documents. The conclusion of the Personal Protection Agency was that the processing complied with the provisions on personal protection and the processing of personal information.

Ruling

about a complaint about the processing of personal information by the National Electoral Commission and the Chief Electoral Commission of Kópavogur in case no. 2022050850:

i

Procedure

On 12 May 2022, Personal Protection received a complaint from [A] (hereinafter the complainant) about the processing of personal information about him by the National Electoral Board and the Chief Electoral Board of Kópavogur regarding the 2022 elections.

More specifically, there is a complaint that ombudsmen are required to carry identification with the name of the political party for which the respective ombudsman appears.

Personal protection sent the complainant a letter dated June 14, 2023, and informed him that the arrangement he complained about was based on Election Law no. 112/2021. Personal protection also requested information on whether the complainant nevertheless requested a substantive resolution to his complaint. On the 22nd Personal Protection received the complainant's reply in which he reiterated his wish for a substantive resolution of his complaint and provided further justification. Personal protection invited the National Electoral Commission and the Chief Electoral Commission of Kópavogur to comment on the complaint in letters dated 28 August 2023 and their answers were received on 13 and 14 September s.á. Since there is a clear legal basis for the processing, the Personal Protection Authority, as in the case here, considered it unnecessary to give the complainant the opportunity to express comments on the answers of the National Electoral Commission and the Chief Electoral Commission of Kópavogur, cf. Article 13 administrative law no. 37/1993. By e-mail on September 20, 2023, the Personal Protection Agency specifically requested that the Kópavogur Chief Electoral Commission inform the Personal Protection Authority about how the information about the complainant was obtained before the issuance of the identity documents in question. Received a response from the Kópavogur Chief Electoral Commission by email on the 22nd p.m.

When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

The processing of the case has been delayed due to the heavy workload at Personal Protection.

___________________

There is a dispute as to whether there was an authorization for the requirement that during the conduct of elections political party proxies carry an identity card stating which political party the respective proxies represent.

The complainant considers it unreasonable and therefore questionable that there is an authorization for publishing sensitive personal information by obliging agents to reveal their political views despite the legal authority to that effect.

The National Electoral Commission is based on the fact that, according to paragraph 1 Article 12 electoral law no. 112/2021, it is an independent administrative committee that oversees the conduct of elections and handles the implementation of the law. According to paragraph 1 Article 15 of the Elections Act, the election commissions are local governments that manage the conduct of elections in constituencies and municipalities according to the detailed instructions of the Elections Act. Local electoral commissions are election commissions during elections according to. electoral law, cf. b-point 2. paragraph Article 15 of the Electoral Act and they oversee the implementation of local government elections in their respective municipalities. Issuance of the identity documents and the processing of personal data for them is necessary to satisfy the legal obligation that rests on the responsible party, cf. Paragraph 3 Article 53 electoral law. The National Electoral Commission therefore has the duty to issue instructions on the identity cards that agents of political organizations must use in their work. The credentials should specify who is authorized to act as agents, both so that the staff of election commissions and voters know who the agents are and for which political organization they work. Agents have considerable authority over the general public to study the data and conduct of electoral commissions during the conduct of elections, and it is extremely important both for electoral commissions and voters that it is clear which persons exercise the rights that the electoral law confers on agents of political organizations. It is also stated in the answers of the National Electoral Commission that credentials are not issued to agents, unless their approval is available, cf. Paragraph 1 Article 53 electoral law. By signing, the agent agrees to carry out the tasks assigned to agents according to the electoral law and also to carry out the duties that come with the tasks. In the case of official work, as a representative during voting outside the election meeting, during voting on election day and during the counting of votes. During the monitoring tasks that are included in the work of an ombudsman, neither the voters nor the chief election boards, district election boards and sub-election boards, can be in doubt as to who the ombudsmen are, as long as it is a monitoring role based on a clear legal authority. It is also the nature of the ombudsman's work that they represent the political organizations that have nominated them for the job. It will not be seen that the nomination of an agent who has agreed to carry out the work is information that should be kept secret, but on the contrary, such information must be public and suitable for promoting transparency in the implementation and preparation of elections. It must be considered that when an ombudsman agrees to take on the role of ombudsman according to the electoral law, he also agrees that the information will be made public. The National Electoral Commission also points out that it was believed that the complainant was second on the candidate list for the Pirates for the local elections in 2022 in Kópavogur and a deputy for the South West Constituency from 2021 for the same political organization.

The electoral board of Kópavogur is based on the fact that according to paragraph 3. Article 53 electoral law no. 112/2021, the Chief Electoral Board of a constituency and the Chief Electoral Board of a municipality are obliged to prepare special credentials for agents of candidate lists according to further instructions of the National Electoral Board. Agents are required to carry this document in their activities according to the law, and similar provisions apply to agents' assistants. According to the instructions issued by the National Electoral Commission, dated May 11, 2022, the name of the candidate for whom the agent works must be indicated on the back of the credentials. The instructions also say that ID cards must be designed in such a way that they can be carried in such a way that they are visible, e.g. as a badge or in a plastic bag that can be hung around the neck. The obligation for agents to carry an identity card that marks the candidacy they represent during the conduct of elections is therefore in accordance with the provisions of the law and government orders. On the basis of paragraph 3 Article 53 in accordance with the election law and the aforementioned instructions of the National Electoral Commission, the Kópavogur electoral committee has prepared an identity card in a plastic bag with the candidate's name on the back for candidates' representatives in Kópavogur, which they have been required to carry in front of them during the local elections on May 14, 2022.

During the handling of the case, the Personal Protection Agency requested more information from the Kópavogur Chief Electoral Board from where the complainant's personal information was obtained for the issuance of the identity cards. In its response to Personal Protection, Kópavogur's Chief Electoral Commission stated that political organizations that offer candidates in elections must submit a notification about who the agents of the list are when candidate lists are submitted in accordance with paragraph 2. Article 39 electoral law no. 112/2021. That notification should contain contact information (e-mail address) so that they can be sent a meeting invitation with the National Electoral Commission about the validity of the candidate lists according to the provisions of the law. When the National Electoral Commission's instructions on the credentials of agents were issued, an e-mail was sent to the agents where they were informed about the content of the instructions and they were asked to submit a photo in order to print on the credentials as the instructions require.

II.

Conclusion

This case concerns the publication of information about the complainant's political views on his credentials as an agent of a political organization during the conduct of elections. It concerns the processing of personal data that falls under the authority of the Personal Protection Agency.

The person responsible for the processing of personal information is compatible with Act no. 90/2018 is the named responsible party. According to number 6 Article 3 Act no. 90/2018 refers to an individual, legal entity, government or other entity that alone or in cooperation with others determines the purposes and methods of processing personal data, cf. Number 7. Article 4 of regulation (EU) 2016/679. The National Electoral Commission issued an administrative instruction to the election commissions on 11 May 2022 with the title "Instruction of the National Electoral Commission on credentials of agents", which states how the issuing of credentials of agents should be done. Is the National Electoral Commission therefore considered to be the party responsible for the processing in question according to Act no. 90/2018, on personal protection and processing of personal data, and Regulation (EU) 2016/679.

All processing of personal information must be covered by one of the authorized provisions of Article 9. Act no. 90/2018, cf. Article 6 of regulation (EU) 2016/679. For example, it is possible to work with personal data if it is necessary to fulfill a legal obligation that rests on the responsible party, cf. Number 3. of the legal provision and point c of the regulatory provision. In addition, the processing of sensitive personal data must be compatible with one of the additional conditions of paragraph 1. Article 11 of the law, cf. Paragraph 2 Article 9 of the regulation. According to point a of 3. no. Article 3 of the law, political opinions are considered sensitive personal data, but a complaint will determine that, among other things, information about the complainant's political opinions has been processed.

When evaluating authorization for processing, provisions in other laws that are applicable in each case must also be taken into account. In particular, election law no. 112/2021. The relevant provisions of the law will be mentioned below as appropriate.

In addition to authorization according to the above, the processing of personal data must be compatible with all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Paragraph 1 Article 5 of regulation (EU) 2016/679. The principles stipulate, among other things, that personal data must be processed in a lawful, fair and transparent manner towards the data subject, cf. Number 1. of the legal provision and point a of the regulatory provision, that they must be obtained for a clearly specified, legitimate and relevant purpose and not further processed for other and incompatible purposes, cf. Number 2. of the legal provision and point b of the regulatory provision and that they must be sufficient, appropriate and not beyond what is necessary based on the purpose of the processing, cf. Number 3. of the legal provision and point c of the regulatory provision.

It is clear that in Article 53 electoral law no. 112/2021 lays down the rights and obligations of agents when submitting a candidate list. It states, among other things, that the Chief Electoral Board of the electoral district and the Chief Electoral Board of a municipality prepare special credentials for agents according to further instructions of the National Electoral Board and that agents are obliged to carry said credentials during their activities, cf. Paragraph 3 of the provision. It is also known that the National Electoral Commission issued an instruction on May 11, 2022 on how such IDs should be processed. There comes i.a. provided that on the back of the credentials of the agents, the name of the candidate for which the agent works must be specified. It is therefore the opinion of the Personal Protection Agency that the processing that is to be resolved can rely on item 3. Article 9 Act no. 90/2018, cf. c-point 1. paragraph Article 6 of regulation (EU) 2016/679, if other conditions of the law and the regulation are met.

It will then be considered whether the processing meets any of the special additional conditions for the processing of sensitive personal information. As in the above articles, the rights and duties of the representative of a political organization during the conduct of elections are legislated. According to paragraph 1 Article 53 electoral law no. 112/2021, it is stipulated that each list of candidates must be accompanied by a notification from the head of the list to the national electoral board or the chief electoral board of a municipality about who the two people are the representatives of the list, together with their approval. According to the National Electoral Commission's answers, ID cards are not issued unless such approval is available. It is also known that the complainant sent a photo of himself to the Chief Electoral Commission of Kópavogur for the purpose of using it for identification according to the instructions of the National Electoral Commission. The complainant was also second on the list of candidates for the political organization in question for the local government elections in 2022 in Kópavogur and a deputy for the South West Constituency from 2021 for the same political organization, and his political views were therefore already public. It is therefore the opinion of the Data Protection Authority that the complainant has consented to the processing in question, which also only included information that the complainant himself had obviously made public, cf. 1. and 5. numbers. Paragraph 1 Article 11 Act no. 90/2018, cf. a- and e-points 1. paragraph Article 9 of regulation (EU) 2016/679.

The requirement for fair and transparent processing of personal information includes, among other things, states that individuals should be aware when personal information about them is collected, used, viewed or processed in another way. They should also be clear to what extent personal data is or will be processed. In order to assess whether the condition of transparency has been met during the processing of personal data, it may be necessary to refer to provisions on the obligation to educate, cf. Article 17 Act no. 90/2018 and 12.-14. art. of regulation (EU) 2016/679.

When personal information is obtained from the registered person, the obligation to provide information according to Article 13. of the regulation and when personal information is obtained from another source, the obligation to provide information according to Article 14. of the regulation. Responsible party's educational obligation, i.e. the obligation to provide the data subject with information about the processing of his personal data generally applies regardless of the legal basis on which the processing is based.

According to paragraph 4 Article 13 regulation (EU) 2016/679, however, the responsible party's obligation to educate does not exist if and to the extent that the data subject has already received knowledge of the matters that must be disclosed based on the provision, cf. also point a of paragraph 5. Article 14 of the regulation. It also says in point c of paragraph 5. Article 14 of the regulation that the educational obligation according to the provision does not exist if and to the extent that the collection or dissemination of the information is clearly prescribed in the laws of the member state to which the responsible party is subject and which stipulate appropriate measures to protect the legitimate interests of the data subject

With reference to the above, it will be considered that the complainant has received knowledge of the processing of the personal data to which the complaint relates on the basis that it was based on the applicable law. Furthermore, the Personal Protection Authority believes that, in general, those who agree to take on the role of an agent must be aware that it is an element of security in the conduct of elections that they are marked by the political organization that nominated them for the job, in addition to the fact that the complainant was informed of the instructions of the National Electoral Commission on the publication of the ID when a picture of him was requested. With reference to the above, it is the conclusion of the Data Protection Authority that the National Electoral Commission did not have to educate the complainant specifically about the above-mentioned processing of personal information, since the exemption clause of paragraph 4. Article 13 and paragraph 5 Article 14 of the regulation applied. With reference to the above, it must be considered that the said processing of personal data has been fair and transparent towards the data subject. Then it will not be seen that the processing has violated other principles of the law or regulation.

With respect to all the above, the processing is considered to have complied with Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679.

Ruling:

The processing of personal information about political opinion [A] by the National Electoral Commission and the Chief Electoral Commission of Kópavogur was in accordance with the provisions of Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679.

Privacy, December 21, 2023

Edda Úríður Hauksdóttir Rebekka Rán Samper