Persónuvernd (Island) - Mál nr. 2021091751

Persónuvernd - Mál nr. 2021091751
[[File:|center|250px]]
Authority:	Persónuvernd (Island)
Jurisdiction:	Iceland
Relevant Law:	Article 17 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	14.12. 2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Mál nr. 2021091751
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Mál nr. 2021091751 (in IS)
Initial Contributor:	sh

The Icelandic DPA rejected a complaint about the Icelandic police allegedly failing to delete personal data on their own initiative.

English Summary

Facts

During the police investigation against the data subject, data was copied from electronic devices in his possession, i.e. of phone and computer. After the investigation against the data subject was stopped, he sent a request to the police, and requested that the personal information stored about him be deleted and a list of those who had access to it be sent to him. The police responded that they would do so, but according to the data subject, he did not receive an answer.

The data subject complained to the DPA that the Icelandic police had kept his personal information even after an investigation against him was cancelled. Moreover, in his opinion, his requests for the deletion of the information were not answered within a reasonable time.

The DPA invited the police to respond to the complaint. The police replied that the data subject's personal data had already been deleted with the exception of 80 recordings that were found on his phone and had been specially marked as evidence. It is also said that the data subject was informed of the above by letter.

In light of the fact that the police had already agreed to the data subject's request for the deletion of the information by letter, the data subject was asked by the DPA whether there was still a dispute. The data subject replied that his complaint was based on the fact that he had to request that personal information about him, which had been irrelevant to the investigation, be deleted instead of it being deleted at the initiative of the police department. In addition, the police should have taken less time to reply to him.

The police then submitted further evidence, arguing that the data subject had requested the deletion of the information by e-mail dated 28 July 2021, and that it had been dealt with and the data subject informed by the 16 September 2021. The reason for the delay was that during the investigation of the criminal case, it was not known whether all electronic data had weight. Moreover, the summer vacation and illness of the staff affected the delivery time. In their opinion, the data was deleted as quickly as possible.

The DPA took all this information into account and made a decision.

Holding

The Icelandic DPA rejected the complaint and held that the the processing of the deletion request was in accordance with the GDPR and national law on the processing of personal information for law enforcement purposes.

First, the personal information of the data subject that was not part of the investigation of the case was deleted at the request of the prosecutor about two and a half months after the case ended. It was clear that despite the investigation ending, it was not known whether the evidence from the investigation carried weight or not and that this would delay the deletion process. It was also clear from the case file that the data subject was informed of this fact by the police. Therefore, the data would have been deleted by the police. It is not that the data subject had to motivate them to delete the data in the first place.

Second, the delays did not violate the data subject's rights. The documents that were not considered as evidence and did not become part of the relevant case were destroyed as quickly as possible. Processing time was affected by the summer vacation and staff illness. Therefore, the data was deleted 'without undue delay' in compliance with the GDPR.

Comment

This complaint would have perhaps benefited from being read under Article 5 (data minimisation) rather than Article 17 (right to erasure).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Processing of requests for the deletion of personal information by the Police in the capital area

Case no. 2021091751

2.1.2024

Personal information collected for the purpose of an investigation by the competent authorities, but later found to be unrelated to the matter in question, must be deleted without undue delay. In cases where a person's request for correction, deletion or restriction of personal data processing is refused, in part or in whole, he must be notified of the refusal as well as the reasons for it.

----

Privacy has ruled in a case where a complaint was made that the Police in the capital region had kept the complainant's personal information after the investigation against him at the office was cancelled. The complaint was based on the fact that the complainant had to request that personal information about him, which had been irrelevant to the investigation, be deleted instead of it being deleted at the initiative of the police department. In addition, his requests for the deletion of the information would not have been answered within a reasonable time.

Personal information about the complainant that was not part of the investigation was deleted at the request of the prosecutor two and a half months after the investigation was completed. The complainant was then informed by letter that his request for data deletion had been partially refused, as well as the reason for this. The conclusion of the Data Protection Authority was that the retention of the complainant's personal information by the Police in the capital area and the processing of his request for the deletion of personal information had been in accordance with the law on the processing of personal information for law enforcement purposes.

Decision

On December 14, 2023, the Board of Personal Protection made the following decision in case no. 2021091751, due to a complaint about the retention of personal information by the Police in the capital area and delays in responses due to a request for the deletion of information:

i

Procedure

On 10 September 2021, Personal Protection received a complaint from [A] (hereafter complainant) that the Metropolitan Police (hereafter LRH) had kept his personal information after the investigation against him at the office was cancelled. The complaint also stated that his request for data deletion had not been answered by LRH within a reasonable time.

The complaint states that during LRH's investigation against the complainant, data was copied from electronic devices in his possession, i.e. of phone and computer. Various confidential data were collected by the devices that were not relevant to the investigation. The complainant refers to the fact that after the investigation against him was stopped, he sent a request to LRH, dated July 28, 2021, where he requested that the personal information stored about him be deleted and a list of those who had access to it be sent to him. The complaint also states that the complainant had received answers from LRH that his message would be answered, but he had not yet received a substantive answer.

Personal protection invited LRH to comment on the complaint by letter, dated October 4, 2021. In LRH's answer, dated 26. s.m., says that personal information about the complainant obtained for the purpose of the investigation has already been deleted with the exception of 80 recordings that were found on his phone and had been specially marked as evidence. It is also said that the complainant was informed of the above by letter dated 16 September s.á.

In light of the fact that LRH had already agreed to the complainant's request for the deletion of the information by letter dated On November 12, 2021, the complainant's position was requested as to whether there was still a dispute, which the Personal Protection Agency would like to resolve, and what that dispute consisted of. In the complainant's reply, dated On December 3rd, he expressed his point of view that there was still a conflict, which consisted in the fact that he had to request that personal information about him, which had been irrelevant to the investigation, be deleted instead of having it been destroyed at LRH's initiative. In addition, his requests for the deletion of the information would not have been answered within a reasonable time.

By letter, dated August 24, 2022, reiterated by letter, dated On 3 October 2016, the Personal Protection Agency requested information from LRH regarding the reasons for the delays that occurred in processing the complainant's case and LRH's position on whether those delays had been unnecessary, in the sense of paragraph 2. Article 14 Act no. 75/2019 on the processing of personal information for law enforcement purposes. A reply was received with a letter from LRH, dated 19 October s.á. The reply letter states that the complainant requested the deletion of the information by e-mail dated 28 July 2021, and if his mission was dealt with by letter, dated 16 September s.á. It is stated that LRH agreed to his request for the deletion of the information, with the exception of certain recordings that would have been considered evidence in the case and the police are therefore obliged to preserve them.

LRH also refers to the fact that during the investigation of the criminal case, it was not known whether all electronic data had weight. Once the case had been concluded and the appeal deadline had expired, a position would have been taken on the weight of the data. It is the opinion of the office that the time that passed between the request of the complainant and until the data was deleted was not unnecessary, but the data was deleted as quickly as possible. Also, summer vacation and illness of the staff affected the delivery of the mission.

By letter, dated On December 19, 2022, the complainant was given the opportunity to comment on LRH's responses and received the complainant's response by email on January 3, 2023. The complainant's response reiterates previous comments to the effect that LRH should have deleted his personal information on its own initiative during the investigation had been stopped, as well as comments on delays in processing his request.

When resolving the case, all of the above-mentioned data have been taken into account, although not all of them are separately explained in the following decision.

II.

Conclusion

1.
Legal environment

This case concerns whether LRH was required to delete, on its own initiative, personal information about the complainant, which was obtained in connection with the investigation of a criminal case at the office, and whether delays in processing the complainant's case violated his rights.

Law no. 75/2019, on the processing of personal information for law enforcement purposes, cf. Paragraph 1 Article 3 of the law. Competent authority is defined in section 11. Article 2 of the Act as a public authority responsible for or entrusted by law with the task of preventing, investigating, detecting or prosecuting criminal offenses or enforcing criminal sanctions, including to protect against and prevent threats to public safety. The police departments are specifically defined as competent authorities under the provision. Regarding this issue, the processing of personal data that falls under the scope of Act no. 75/2019 and thereby the authority of Personal Protection, cf. Paragraph 1 Article 30 of the same law.

LRH is considered to be the responsible party for the processing of personal data to which the complaint relates, according to law no. 75/2019.

In Article 4 Act no. 75/2019, on the processing of personal information for law enforcement purposes, states that when processing personal information, all the principles of the provision must be observed, which stipulate, among other things, that personal information is processed in a lawful and fair manner and that processing is necessary for the competent authority due to projects for law enforcement purposes, cf. . point a, paragraph 1 of the provision, and that they are preserved in such a way that it is not possible to identify registered persons for longer than is necessary based on the purpose of the processing, cf. point e, paragraph 1 of the provision. Then it says in paragraph 1. Article 14 of the Act that the preservation of personal information is subject to the Act on Personal Protection and Processing of Personal Information and the Act on Public Archives. In paragraph 2 of the same provision states that the data subject has the right to have personal data concerning him deleted without undue delay if it turns out that their processing has violated Article 4 or 6. of the same law, where the principles of processing personal information and the processing of sensitive personal information and the use of personal profiles are discussed, or if the responsible party is obliged by law to delete the information. In the comments to paragraph 2 of the provision in the drafting of the bill says that in light of the principle of Icelandic law regarding the preservation of documents, according to the Act on Personal Protection and the Act on Public Archives no. 77/2014, it must be considered that this exception regarding the deletion of information should be explained quite narrowly so that it does not lead to the deletion of documents that are required to be delivered to a public archive.

LRH is considered a party obliged to deliver within the meaning of section 3. Paragraph 1 Article 14 Act no. 77/2014 and must hand over their documents to the National Archives of Iceland, cf. Paragraph 4 the same articles. However, the documents that have been seized but which later turn out not to be related to the case in question are not considered part of the archives of the party liable for delivery. That data is therefore not covered by the law on public archives.

According to paragraph 1 Article 20 Act no. 90/2018, on personal protection and processing of personal information, the registered person has the right to have the responsible party delete personal information about him without undue delay according to the detailed conditions of 16.-19. art. of regulation (EU) 2016/679. In point a of paragraph 1 Article 17 of the regulation, it is stipulated that the registered person shall have the right to have the responsible party delete personal information concerning him without undue delay and the responsible party is obliged to delete the personal information without undue delay if the information is no longer necessary for the purpose behind its collection or other processing their

In Article 17 Act no. 75/2019 on the processing of personal data for law enforcement purposes, the responsible party must notify the data subject, but it states that in cases where the data subject's request for correction, deletion or restriction of the processing of personal data is refused, in whole or in part, the responsible party must notify the registered person about the refusal as well as the reasons for it.

According to Article 18 of the same law, the responsible party must furthermore take appropriate measures that take into account the nature, scope, context and purpose of the processing as well as the rights of the data subject to ensure and demonstrate that the processing of personal data meets the requirements of the law.

2.

Lawfulness of processing

In the case, it is known that the personal information about the complainant, which was obtained for the purpose of investigating a criminal case but later turned out to be irrelevant to the case, has already been deleted. However, there is a dispute as to whether LRH was required to delete the complainant's personal information on its own initiative and whether delays in handling the complainant's case violated his rights.

As above, the data subject has the right to have the personal data concerned deleted without undue delay if it turns out that their processing has violated Article 4 or 6. Act no. 75/2019, on the processing of personal information for law enforcement purposes, or if the responsible party is obliged by law to delete the information, cf. Paragraph 2 Article 14 of the law.

In the case, it is known that LRH's investigation against the complainant ended on May 26, 2021. LRH's decision to stop the investigation of the case was not appealed to the State Prosecutor based on paragraph 6. Article 52 Act no. 88/2008 on the handling of criminal cases, and the case was therefore considered closed a month later, or on June 26, 2008. In LRH's answers, it has been stated that the personal information of the complainant that was not part of the investigation of the case was deleted at the request of the prosecutor on September 14th, or about two and a half months after the case ended. It is also clear from the case file that the complainant was informed by e-mail on August 3 and 10, 2021 that his case was being processed by the Prosecution Division. The complainant was also informed about it by email, dated 27. s.m. and 10 September s.á., that due to unforeseen circumstances it would be delayed in processing his mission as certain information was awaited. It has also been stated by LRH that the documents that were not considered as evidence and thus did not become part of the relevant case were destroyed as quickly as possible, but also that the summer vacation and illness of the staff affected the processing time. Finally, the complainant was informed, with a letter dated LRH. 16 September 2021, that his request for data deletion had been partially refused as well as the reason for this, in accordance with Article 17. Act no. 75/2019 on the processing of personal information for law enforcement purposes.

As stated here up to and including reference to all of the above, it is the conclusion of the Data Protection Authority that the complainant's personal information has been deleted without undue delay. Furthermore, it is the conclusion of the Personal Protection Agency that there were no delays in processing the complainant's case according to the provisions of the law that have been outlined here. LRH's processing of the complainant's personal information was therefore in accordance with Act no. 75/2019 on the processing of personal information for law enforcement purposes.

Decisions:

The retention of the personal information of [A] by the Police in the capital area and the processing of his request for the deletion of personal information was in accordance with Act no. 75/2019 on the processing of personal information for law enforcement purposes.

Privacy, December 14, 2023

Ólafur Garðarsson
chairman

Árnína Steinunn Kristjánsdóttir                Björn Geirsson

Vilhelmína Haraldsdóttir