Persónuvernd - 2020051604

Persónuvernd - nr. 2020051604
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 2 GDPR Article 4(1) GDPR Information Act no. 140/2012 Privacy Act no. 90/2018
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:
Published:	13.05.2020
Fine:	None
Parties:	Dictorate of Labour
National Case Number/Name:	nr. 2020051604
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Persónuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act which implements the GDPR in Iceland. The DPA clarified that the information in question is personal data and that processing of personal data requires a legal ground as per Article 6 GDPR.

English Summary

Facts

The Icelandic Directorate of Labour holds companies’ information using partial compensation schemes and employees’ information on their applications for unemployment benefits in accordance with Act no. 54/2006 on unemployment insurance (part-time work under Corona crises).

The Directorate received a letter asking about the disclosure of companies’ and employees’ information under the Information Act no 140/2012 and asked the DPA’s opinion on the lawfulness of such disclosure under the Privacy Act, for example by sharing or publishing only a list of larger companies, for example based on the number of employees and information on the number of employees who applied for unemployment benefits.

Holding

The DPA clarified the interplay between the two legal text and pointed out that the Privacy Act does not limit the right of access laid down in the Information Act. The DPA noted that the disclosure of companies’ information under the Information Act no. 140/2012 is not under its jurisdiction, but that they are competent to issue decisions under the Icelandic Privacy Act no. 90/2018 on privacy and processing of personal data.

The DPA pointed out that information about who applied for unemployment benefits is personal data and that processing of personal data, including sharing and publishing, requires a legal ground as per Article 6 GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar
Response of the Data Protection Authority to the Directorate of Labor regarding the publication of information on utilization of partial compensation schemes
Case no. 2020051604

05/13/2020

On May 11, 2020, the Directorate of Labor received a letter from the Directorate of Labor regarding the publication and dissemination of information about the companies that have employees who have used so-called partial compensation schemes in accordance with Act no. 54/2006 on unemployment insurance. The letter posed questions related to the disclosure of the information in question and how it complied with the Privacy Act. In the response of the Data Protection Authority, it is stated, among other things, that the Agency believes that the publication and dissemination of the information in question is in accordance with the Information Act no. 140/2012 and that the Data Protection Authority does not rule on the legality of the disclosure of information under that Act. However, it is the position of the Data Protection Authority that Act no. 90/2018 on privacy and processing of personal information did not prevent the information in question from being published.


Reykjavik, May 12, 2020

Subject: Response to the Directorate of Labor

Privacy refers to the letter from the Directorate of Labor, dated. May 11, 2020. The letter traces the amendments made to Act no. 54/2006 on unemployment insurance in March 2020, which transposes the provision for so-called part-time work. The move included encouraging employers to maintain employment and temporarily reduce their employment rate rather than retrench. The Directorate of Labor has now received a request to hand over and publish a list of the companies that have agreed with their employees on a reduced rate of employment, together with the number of their employees who applied for unemployment benefits at the Directorate of Labor. The letter also states that the Directorate of Labor will pay unemployment benefits to individuals on the basis of applications from them, but that companies are not paid benefits on the basis of the aforementioned partial compensation in Act no. 54/2006.

The letter also states that the Directorate of Labor has not considered itself permitted to submit or publish information from the unemployment register without clear legal basis. Although information on companies, such as this, has been requested, there is an overwhelming likelihood that such disclosure will involve the processing of personal information, which includes which individuals will receive unemployment benefits or the likelihood that they will be accept unemployment benefits at the same time as reduced employment rates.

In view of this, the Directorate of Labor requested the Privacy Protection Opinion on the questions discussed in Chapter 2.
1.
General points of view

According to the first paragraph. Article 13 Information Act, no. 140/2012, the government is required to provide the public with information on its activities on a regular basis, such as through the electronic publishing of reports, summaries of important projects or the publication of other documents. Then the second paragraph of Art. the provision that the government should work systematically to make records of cases, list of case documents and the data itself accessible by electronic means. The same applies to databases and files. Care should be taken that disclosure does not go against private or public interest.

In the comments on the provision in the memorandum with a bill that became Act no. 140/2012 states, among other things, that it is important to promote that the government can, on its own initiative, inform about the issues they are pursuing at any time, without compromising privacy or important public interests. As a result of the provision, the government can, on its own initiative, decide to make public much of the information they have available, provided that the provisions of the Confidentiality and Privacy Act do not therefore interfere.

The Data Protection Authority considers that the Directorate of Labor must decide on requests made on the basis of a cited provision. In this connection, the Data Protection Authority also points out that according to par. Article 5 Act no. 90/2018 on Privacy and the Processing of Personal Information does not limit the right of access laid down in the Information Act. As stated in Section 2.1, Act no. 90/2018 in addition not to legal persons.

The aforementioned provisions result in a self-interest assessment being made before access to information is provided. Among other things, it is necessary to assess whether these are data on interests that are fair and natural for secrecy. Such an interest assessment must also take into account privacy considerations as well as public interests.

Privacy Protection believes that it must be based on public interest to provide information about the companies that have employees who applied for benefits at the Directorate of Labor on the basis of XIII. Provisional provision in Act no. 54/2006, will be made available. In this context, it is noted that high economic interests are tied to the payment of benefits under the provision. It must also be considered that such access can create restraint for companies that choose to reduce the proportion of their employees, with a view to receiving benefits based on the provision. Finally, it is considered to be a government-specific measure that covers a broad group of people.
In addition, the Data Protection Authority must bear in mind that information about the persons receiving benefits under XIII. Provisional provision in Act no. 54/2006 cannot be considered as sensitive personal information within the meaning of Paragraph 3. Article 3 Act no. 90/2018.
2.
Answers to questions from the Directorate of Labor
2.1.

First of all, the Directorate of Labor is asked whether the Data Protection Authority considers that information about the employers of the individuals who applied for payments from the Directorate of Labor is considered to be personal information within the meaning of item 2. Article 3 Act no. 90/2018.

Privacy notes that in the comments on Art. in a memorandum with a bill that became Act no. 90/2018 states, among other things, that the concept of personal information is comprehensive and covers all information, opinions and opinions that may be directly or indirectly linked to a particular person, ie. information that is personally identifiable or identifiable. The comments also state that the regulation assumes that the concept of personal information applies only to information about individuals but not to organizations, companies or other legal entities.

Privacy is of the opinion that information on companies that have employees who receive benefits from the Directorate of Labor on the basis of XIII should be based on information. Provisional provision in Act no. 54/2006 is not considered to be personal information as it is inherently related to companies. Nonetheless, Privacy Protection considers it appropriate to point out that in some cases personal information may be derived from such information, for example in the case of companies with few employees or in the case of companies with a relatively high number of employees. accept compensation on the basis of the provision.
2.2.

Second, the Directorate of Labor asks if the Data Protection Authority considers it sufficient action to ensure that it is not possible to identify applicants for unemployment benefits, that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.

Privacy may agree that, by disclosing information on small businesses, it may be easier to derive personal information from those applying for the above benefits. However, to see that the purpose of making the information in question accessible is to safeguard the public interest and promote corporate restraint. In the opinion of the Data Protection Authority, it is likely that this purpose will not be fully achieved if a company with few employees is completely excluded from the publication or if the number of employees who do not receive benefits on the basis of XIII is not disclosed. Provisional provision in Act no. 54/2006. In this connection, the Data Protection Authority points out that there is not always a connection between the number of companies and their financial position.
2.3.

Thirdly, the Directorate of Labor asks if the Data Protection Authority considers that the processing in question is authorized in accordance with Article 9. Act no. 90/2018 having regard to the purpose of the disclosure of the information.

The Data Protection Authority reiterates its position that the request is processed in accordance with the provisions of Information Act no. 140/2012. As discussed before, in making this decision, a self-interest assessment must be carried out where private and public interests are examined. Among other things, needs to consider privacy considerations in that assessment.

The Data Protection Authority points out that in the case of the processing of personal data that falls within the scope of Act no. 90/2018 must be considered to be able to process personal information if it is necessary for a work that is in the public interest, cf. Item 5 Article 9 Act no. 90/2018 and paragraph 3 e. Article 6 Regulation (EU) 2016/679.
3.
Conclusion

Privacy protects that it does not rule on the legitimacy of the provision of information pursuant to the Information Act no. 140/2012. However, it is the position of the Data Protection Authority that Act no. 90/2018 on Privacy and Processing of Personal Information did not prevent the disclosure or disclosure of information about companies that have employees who have used a partial benefit scheme under XIII. Provisional provisions in Act no. 54/2006.

For the Data Protection,

Helga Þórisdóttir Þórður Sveinsson