Persónuvernd (Iceland) - Case no. 2021010248
| Persónuvernd - Case no. 2021010248 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 6(1)(e) GDPR Article 6(1)(f) GDPR Article 17(1) GDPR Article 17(3)(d) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 05.12.2022 |
| Published: | 05.12.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Case no. 2021010248 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (in IS) |
| Initial Contributor: | n/a |
The Icelandic DPA rejected a complaint of a data subject which demanded the enforcement of the data subject's right to erasure against a controller's genealogical database. The DPA decided that the controller's processing was justified pursuant to Article 6(1)(f) GDPR and that it was within its rights to refuse the erasure request pursuant to Article 17(3) GDPR.
English Summary
Facts
The controller maintained the website "Íslendingabók". The website was a database containing genealogical information about the inhabitants of Iceland, dating back more than 1,200 years. A data subject sent a request for deletion of her and her minor child's personal data to the controller. The controller rejected the request, prompting the data subject to complain to the Icelandic DPA. The data subject asked the DPA to decide that the controller was not allowed to register, save, process, publish, and share personal information about her and her child in any possible way.
The data subject argued that she did not give her consent for personal information about her and her minor child to be recorded and published in the Íslendingabók. In addition,she was not informed about that in advance.
The controller, on the other hand, responded that since the database concerned genealogical research, which is a type of scientific and historical research, its data processing could be conducted under the legal basis of Article 6(1)(e) GDPR. The controller also argued that it had a legitimate interest in processing the personal data which overrode the interests of the data subjects to have their data deleted. The controller pointed out that they promote genealogical research in Iceland by running the database: "Genealogical research, which has been carried out in Iceland for centuries, is very popular with the public and is one of the main pillars of the nation's cultural heritage. In addition, genealogical research is one basis and prerequisite for extensive research in the field of human genetics in this country."
In its rejection of the data subject's erasure request, the controller relied on Article 17(3)(d) GDPR. The provision allows controllers to reject erasure requests if the personal data concerned is processed for archiving purposes in the public interest, scientific, historical research or statistical purposes
Holding
The Icelandic DPA rejected the complaint.
The DPA held that processing for the benefit of the field of genealogy may rely on the legal basis of Article 6(1)(f) GDPR. It noted that the provision stated that personal data may be processed if it is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, that require the protection of personal data, outweigh the other interests. In its decision to declare that the interests and fundamental rights of the data subjects are not outweighing the legitimate interests of the controller, the DPA relied on one of its former decisions (case no. 2004/568), which came to the conclusion that the publication of general demographic information (such as name, social security number, names of descendants, parents and current spouses) in genealogical and biographical publications is hardly avoidable.
As regards to the right to erasure of data subjects granted by Article 17(1) GDPR, the DPA noted that Article 17(3) GDPR provides an exception to the right. Namely, as already stated by the controller, when the continued processing is necessary for archiving in the public interest, research in the field of science or history, or for statistical purposes. The DPA held that the exception applies in the concerned case. In its reasoning, it solely referred to its decision on the same issue in the case no. 2021020473 which was published on January 25, 2022.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Processing of personal information by Íslenskr gerenálys ehf. Case no. 2021010248 5.12.2022 In general, individuals may have the right to have their personal information deleted. The right of individuals to delete personal data does not apply to the extent that their processing is necessary. In this case, it was considered that it was permissible to refuse the request for the deletion of personal information, since its processing was deemed necessary for genealogical research and it was processed for historical purposes. ---- Personal protection ruled in a case in which a complaint was made about the refusal of Íslenskr gegenanalysi ehf. on a request for deletion of personal information about the complainant and her minor child from the Íslendingagbók. At the same time, the demand was confirmed that it would be decided that Íslendingagbók was not allowed to register, save, process, publish and share personal information about her and her child in any possible way. The conclusion of the Personal Protection Agency was that Íslenskri genetic analysis ehf. was allowed to refuse the complainant's request for the deletion of personal information about her and her minor child from the database and from the Íslendingagbókar website. Ruling about a complaint about the refusal of a request for the deletion of personal information by Íslenskr gergenálys ehf. in case no. 2021010248: i Procedure On January 28, 2021, Personal Data Protection received a complaint from [A] (hereinafter the complainant) about the refusal of Íslenskr gegenályna ehf. on her request for deletion of personal information about her and her minor child from Íslendingagbók. In the letter of the complainant's lawyer, dated On September 26, 2022, the demand was also reaffirmed that it would be decided that Íslendingagbók was not allowed to register, save, process, publish, and share personal information about her and her child in any possible way. Icelandic genetic analysis ehf. maintains Íslendingabók together with Friðrik Skúlasyn ehf. Personal protection invited both companies to comment on the complaint by letter, dated May 31, 2022, and responses were received by Íslenskar geðanálys ehf., on behalf of both companies, by letter dated 15 July s.á. The complainant was then given the opportunity to provide comments on the answers of Íslenskar gegenágás ehf. by letter, dated 9 August s.á., and they were received with a letter from the complainant's lawyer, dated 26 September s.á. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. ___________________ There is a dispute about the authority of Íslenskr genetágání ehf. and Friðriks Skúlason ehf. for the processing of personal information about the complainant and whether the complainant has the right to have personal information about her and her minor child deleted from the database and from the Íslendingagbókar website. The complainant believes that the Íslenskri geðiräði ehf., which maintains Íslendingabók together with Friðrik Skúlasyn ehf., has according to Article 20. Act no. 90/2018, on personal protection and processing of personal information, and Article 17 Regulation (EU) 2016/679, her request for the deletion of personal information about her and her minor child from the database and website of Íslendingabók has to be granted. However, the company refused the request on January 5, 2021. The complainant then refers to the fact that she did not give her consent for personal information about her and her minor child to be recorded and published in the Íslendingagbók, in addition to the fact that she was not informed about that in advance. Icelandic genetic analysis ehf. bases the authorization for processing personal information about the complainant for the benefit of the Íslendingagbókar website on item 5. Article 9 Act no. 90/2018, cf. point e, paragraph 1 Article 6 of regulation (EU) 2016/679, on processing in the public interest. It is pointed out that genealogical research is one type of scientific and historical research that falls under the provision's processing authority, cf. comments on item 5. Article 9 in the report by law no. 90/2018. Also considers Íslensk gēnīgānī ehf. it is not necessary for the basis of the processing to be laid down directly in the law, since that understanding will not be included in the provisions of paragraph 3. Article 6 regulation (EU) 2016/679 that a legal basis is also reserved for processing based on point e of paragraph 1. Article 6 of the regulation. Icelandic genetic analysis ehf. considers that the processing of personal information about the complainant for the benefit of the Íslendingabókar website can also be supported by section 6. Article 9 Act no. 90/2018, cf. point f, paragraph 1 Article 6 of regulation (EU) 2016/679. Reference is made to the fact that the company promotes genealogical research in Iceland by running the Íslendingabókar. Genealogical research, which has been carried out in Iceland for centuries, is very popular with the public and is one of the main pillars of the nation's cultural heritage. In addition, genealogical research is one basis and prerequisite for extensive research in the field of human genetics in this country. Icelandic genetic analysis ehf. therefore has a legitimate interest in the processing that outweighs the interests of the complainant. Also, Íslensk gēnīgārīn ehf. also on the fact that the company was authorized to refuse the complainant's request for the deletion of personal information about her and her minor child on the basis of point d of paragraph 3. Article 17 of regulation (EU) 2016/679. II. Conclusion This case concerns the processing of a request for the deletion of information about individuals from the database and from the Íslendingagbókar website. It concerns the processing of personal data that falls under the authority of the Personal Protection Agency. Islensk genetic analysis ehf. and Friðrik Skúlason ehf. be jointly responsible parties for said processing according to law no. 90/2018, on personal protection and processing of personal data, and Regulation (EU) 2016/679. All processing of personal data must be covered by one of the authorized provisions of Article 9. Act no. 90/2018, cf. Article 6 of regulation (EU) 2016/679. One example is that personal data may be processed if the processing is necessary for work carried out in the public interest, cf. Number 5. of the legal provision and point e of the regulatory provision, or if the processing is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, cf. Number 6. of the legal provision and section f of the regulatory provision. In comments with Article 9 of the bill that became law no. 90/2018 states, among other things, that processing can be considered to be in the public interest if it takes place for historical, statistical or scientific purposes. Genealogical research can be considered to be carried out for historical purposes, and it is clear that the processing carried out in connection with the Íslendingagbók website has significance for a wide group of people. If other conditions are met, the processing could thus be based on the fact that it is carried out in the public interest. In order to do this, however, it should be considered that the processing of personal information can be supported by item 5. Article 9 Act no. 90/2018, cf. point e of Article 6 of the regulation, the basis of the processing must be laid down in law, cf. Paragraph 3 Article 6 of the regulation. The provision also states that the purpose of processing must be determined on the basis of the law or, with regard to the processing referred to in point e of paragraph 1, be necessary for the implementation of a project carried out in the public interest. It also says that the legal basis can i.a. been specific provisions to adjust the application of the rules of the regulation, i.a. on general conditions regarding the legal processing of the responsible party, the type of data that the processing concerns, the registered persons concerned, limitation due to purpose, etc. It is therefore not necessary that special laws or legal provisions apply to each individual processing, but it may be sufficient to have laws as the basis for various processing operations when processing is necessary for a project carried out in the public interest. No law has been passed on genealogical research or its implementation in this country, and therefore, as is the case here, it is not possible to consider that the basis of the processing is laid down in law. For that reason, it is the opinion of the Personal Protection Agency that in the current legal environment, the processing that takes place in connection with the Íslendingagbók website cannot rely on section 5. Article 9 Act no. 90/2018, cf. point e of Article 9 of the regulation. However, in the opinion of the Personal Protection Authority, processing for the benefit of genealogy can rely on section 6. Article 9 Act no. 90/2018, cf. Article 6(f) Regulation (EU) 2016/679, which states that the processing of personal data is permitted if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh, provided that it is compatible with otherwise the provisions of the law and the regulation. In its previous findings, the Data Protection Authority has considered that people can barely avoid the fact that in genealogical and biographical publications general demographic information appears about them, such as name, social security number, names of descendants, parents and current spouses, cf. i.a. the institution's decision in case no. 2004/568. According to paragraph 1 Article 20 Act no. 90/2018, the registered person has the right to have the responsible party delete personal information about him without undue delay according to the detailed conditions of Article 17. of regulation (EU) 2016/679. According to paragraph 1 of the regulation provision, the registered person shall have the right to have the responsible party delete personal information concerning him without undue delay, and the responsible party shall be obliged to delete the personal information without undue delay if one of the reasons listed in points a-f of the provision apply. In paragraph 3 Article 17 of the regulation, there is an exemption from paragraphs 1 and 2. of the provision. Thus, the latter paragraphs do not apply if processing is necessary for archiving in the public interest, research in the field of science or history or for statistical purposes in accordance with the protection measures according to paragraph 1. Article 89, to the extent that it is likely that the right to delete personal data makes it impossible or significantly hinders the achievement of the goal of processing, cf. point d, paragraph 3 Article 17 of the regulation. As is the case in the present case, the Personal Protection Authority believes that Íslenskri gegenarnísi ehf. was authorized to refuse the complainant's request for the deletion of personal information about her and her minor child from the database and from the Íslendingagbókar website with reference to point d, paragraph 3. Article 17 of regulation (EU) 2016/679. In this regard, reference is made to the grounds for the decision in the institution's opinion from January 25, 2022 in case no. 2021020473 which concerns the same issue that is tried in the present case. When, for that reason, there is no need to consider whether the provisions of paragraph 1. 17 of the regulation created the complainant's right to deletion. Ruling: Icelandic genetic analysis ehf. was allowed to refuse [A's] request for the deletion of personal information about her and her minor child from the database and from the Íslendingagbókar website. Privacy, December 5, 2022 Helga Þórisdóttir Helga Sigríður Þórhallsdóttir
