Persónuvernd - 2020051604

Persónuvernd - nr. 2020051604
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 2 GDPR Article 4(1) GDPR Information Act no. 140/2012 Privacy Act no. 90/2018
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:
Published:	13.05.2020
Fine:	None
Parties:	Dictorate of Labour
National Case Number/Name:	nr. 2020051604
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Persónuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA (Persónuvernd) issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act, implementing the GDPR. Although the Persónuvernd was not competent to rule on the lawfulness of a disclosure of personal data under the Information act, it ruled that the Privacy Act does not prevent the information in question from being published.

English Summary

Facts

The Icelandic Dictorate of Labour holds companies’ information using partial compensation schemes and employees’ information on their applications for unemployment benefits in accordance with Act no. 54/2006 on unemployment insurance (part-time work under Corona crises).

The Dictorate of Labour received a request to publish the companies’ and employees’ information under the Information Act no 140/2012. Following this access request, the Dictorate asked the Data protection authority’s opinion on the lawfulness of the disclosure.

More precisely, the Dictorate asked whether it will be compliant with the Privacy Act that the Directorate of Labor submits or publishes only a list of larger companies, e.g. based on the number of employees, and the information on the number of employees who applied for unemployment benefits.

Holding

First, the authority clarified the interplay between the two legal text and pointed out that the Privacy Act does not limit the right of access laid down in the Information Act. The data protection authority held that the disclosure of companies’ information under the Information Act no. 140/2012 is not under its jurisdiction. However, the data protection authority is competent to issue decision under the Privacy Act no. 90/2018 on privacy and processing of personal information.

Then, the authority pointed out that companies’ information about who applied for unemployment benefits is a personal data. Indeed, the authorized held that the concept of personal data does not only apply to information about individuals but also to organizations, companies or other legal entities.

Moreover, the authority held that the purposes of the disclosure of the companies’ information using the partial compensation schemes are to safeguard the public interest and promote corporate restraint. In this regard, the authority pointed out that to exclude from the publication small businesses will not fulfill the purposes of partial compensation schemes.

Lastly, the authority ruled that there is onthing in the Privacy Act which prevent the information in question from being published. Thus, the authority answered that the Privacy Act which does not prevent the information about companies using a partial benefit scheme from being published.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.