Persónuvernd - 2020010604

Persónuvernd - 2020010604

Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 12 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	10.03.2021
Published:	26.03.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	2020010604
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Personuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA held thatt Lögheimtun ehf. was not permitted to disclose personal information about the complainant from the judgment of the District Court to Creditinfo Lánstraust hf. when the appeal deadline had not expired. Additionally, Creditinfo Lánstrausti hf. was not permitted to register and have information on the complainant's claim in its default register.

English Summary

Facts

On March 26, 2019, the DPA received complaint regarding the processing of personal information about a complainant by Lögheimtun ehf. and Creditinfo Lánstrausti hf. The complain concerned the brokerage of the complainant's personal information by Lögheimtun to the financial information agency Creditinfo Lánstraust and the listing of Creditinfo Lánstraust of the complainant's financial information in the default register, despite the fact that she had sent her objections to the financial information office within the stated deadline.

The complainant based her complaint on the fact that Lögheimtun ehf. was not permitted to share her personal information with Creditinfo Lánstraust hf. for the purpose of having it registered on the default register and that Creditinfo Lánstrausti hf. was not allowed to register the complainant on the default register according to the request of Lögheimtun ehf.

Dispute

Holding

The Icelandic DPA held thatt Lögheimtun ehf. was not permitted to disclose personal information about the complainant from the judgment of the District Court to Creditinfo Lánstraust hf. when the appeal deadline had not expired. Additionally, Creditinfo Lánstrausti hf. was not permitted to register and have information on the complainant's claim in its default register.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Processing of information at Lögheimtun and Creditinfo Lánstraust's registration of information on disputed debt on the default register is considered prohibited
Case no. 2020010604
26.3.2021
The Data Protection Authority has ruled in a case concerning, on the one hand, Lögheimtun's authority to disclose personal information to Creditinfo Lánstraust and, on the other hand, the latter's authority to register the same party's personal information on the default register on the basis of a court decision. In light of the fact that this was a disputed debt, the Data Protection Authority considers that neither party was authorized to process the above.

The Data Protection Authority came to the conclusion that a final court decision had not been available and therefore the complainant's debt had been controversial within the meaning of Creditinfo Lánstraust's operating license. Therefore, it would not have been permitted to share information with Creditinfo Lánstraust. The conclusion is mainly based on the fact that the complainant had objected to the registration within the time limit and the time limit for appeal of the judgment in question had not expired. It is also concluded that Creditinfo Lánstraust was not allowed to register the complainant's personal information, due to a disputed debt, in the company's default register.

The Data Protection Authority also emphasized that the deadline, whether based on a 14-day deadline according to Creditinfo Lánstraust's operating license or a longer deadline that the financial institution chooses to grant to its clients, does not begin to expire until the day after Creditinfo Lánstraust's letter of notification. but at midnight last Friday.

Ruling

On March 10, 2021, the Board of the Data Protection Authority issued a ruling in case no. 2020010604 (formerly no. 2019030762):

I.
Procedure

1.
Outline of case
On March 26, 2019, the Data Protection Authority received complaint [A] (hereinafter referred to as the complainant) regarding the processing of personal information about itself by Lögheimtun ehf. and Creditinfo Lánstrausti hf.

More specifically, on the one hand, there are complaints about the brokerage of Lögheimtun ehf. on the complainant's personal information to the financial information agency Creditinfo Lánstraust hf. and on the other hand there are complaints about the listing of Creditinfo Lánstraust hf. on the complainant's financial information on the default register, despite the fact that she had sent her objections to the financial information office within the stated deadline.

2.
Correspondence
By letters dated August 28, 2019, Lögheimtun ehf. and Creditinfo Lánstrausti hf. provided an opportunity to comment on the complaint. Lögheimtan ehf. by letter dated 17 September, and Creditinfo Lánstraust hf. by letter dated 18. cm By letter dated On 7 October 2019, the complainant was invited to comment on the contents of the above-mentioned letters. The complainant's comments were received by letter dated 28. cm The Data Protection Authority also requested further explanations on specified issues, in a letter to Creditinfo Lánstraust hf., Dated December 8, 2020. The company's responses were received on January 5, 2021.

All the above documents have been taken into account in resolving the case, although not all of them are specifically mentioned in this ruling.

The handling of this case has been delayed due to heavy work at the Data Protection Authority.

3.
The complainant's views
The complainant bases his complaint on the fact that Lögheimtun ehf. was not permitted to share her personal information with Creditinfo Lánstraust hf. for the purpose of having it registered on the default register and that Creditinfo Lánstrausti hf. was not allowed to register the complainant on the default register according to the request of Lögheimtun ehf.

More specifically, the complainant relies in the first place on the fact that Lögheimtan ehf. has based its claim on the decision of the district court in the complainant's case and forwarded it to Creditinfo Lánstraust hf. when the deadline for appealing the judgment has not passed. Secondly, the complainant relies on the fact that Creditinfo Lánstraust hf. has published information about it on the company's default register, despite its objections, which were received by the financial information agency before the stated deadline had passed.

The complainant is based on the fact that the 17-day deadline, which was specified in the company's notification letter, dated 18 February 2019, did not pass until midnight at the beginning of the day 8 March s.á. but not at midnight at the beginning of the day 7 cm, as Creditinfo Lánstraust hf. maintains. The complainant therefore comments that at the time when the registration of information about her on the default register took place, there was still a full day left of the specified deadlines. Registration of Creditinfo Lánstraust hf. on information about the complainant on the default register had therefore been requested before the deadline had passed. The complainant also comments on the statement of Creditinfo Lánstraust hf. that its objection to the proposed listing did not reach the company until after the listing was published in the default register. The complainant claims that her objection to the registration was received by the company in 1.5 hours. before the listing was published and just over a day before the deadline for comments expired.

The complainant also comments on the reference to the rulings of the Data Protection Authority in case no. 2016/303 and 2017/1620. In the first case, the basis of the case is completely different and therefore does not set a precedent in its case. Regarding the reference to the ruling of the Data Protection Authority in case no. 2017/1620, the complainant refers to the fact that it was based on the fact that the final decision of the courts had not been available when the disputed registration was made. On the other hand, there had been delays in the handling of the case due to a great deal of work by the Data Protection Authority, and during that procedure a new judgment had been handed down in a district court which had been appealed to the National Court. The judgment of the National Court has since confirmed the decision of the district court. Despite the fact that the judgment of the National Court in the aforementioned case was available when the ruling of the Data Protection Authority was pronounced, the case was not resolved on the basis of that position at that time, maintains the status quo at the time the complaint was lodged. At that time, there was only a judgment of the district court, but the time limit and remedies to have that judgment overturned had not been exhausted. In the ruling of the Data Protection Authority, only a position was taken on the registration of a default register from the time the registration was opposed to Creditinfo Lánstraust hf. and until the time when the judgment of the National Court on the dispute between the parties was announced, but not after that time, as the complaint did not reach it. In the ruling of the Data Protection Authority, only a position was taken on the registration of the default register from the time the registration was opposed to Creditinfo Lánstraust hf. and until the time when the judgment of the National Court on the dispute between the parties was announced, but not after that time, as the complaint did not reach it. In the ruling of the Data Protection Authority, only a position was taken on the registration of a default register from the time the registration was opposed to Creditinfo Lánstraust hf. and until the time when the judgment of the National Court on the dispute between the parties was announced, but not after that time, as the complaint did not reach it.

The complainant further refers to the fact that in the grounds of the ruling in case no. 2017/1620 states that in view of the objectives of the Personal Data Protection Act, the Data Protection Authority considers that a judgment which does not constitute a final decision in a court case or which can be subject to review cannot include confirmation of a debt within the meaning of the operating license provision. Says in the premise that this applies equally to a judgment in an existing case that is to be reopened, as well as a judgment that can still be appealed.

The complainant therefore also bases his complaint on the fact that Creditinfo Lánstrausti hf. had not been allowed to accede to Lögheimtunn ehf.'s request to register a claim against it in the default register, during the period 7.-13. March 2019, in light of her objections to the registration and the fact that the appeal deadline has not expired.

The complainant, in support of her case, refers to the fact that a judgment in her case has been handed down in the District Court […] on [dated] 2019. By letter dated 18. cm, if Creditinfo Lánstraust hf. notified the complainant of the planned registration in the default register due to the claim of Lögheimtun ehf. and given her the opportunity to object to the registration within 17 days, i.e. before 7 March 2019. The complainant had objected to the registration in question with a complaint on the service website mitt.creditinfo.is, the 6th cm, on the grounds that the deadline for appealing the aforementioned judgment to the National Court had not passed. Creditinfo Lánstraust hf. has subsequently requested confirmation from Lögheimtun ehf. on the complainant's objections and the reasons behind them or the complainant's confirmation of the appeal of the case. The 7th cm, the claim was registered in the default register contrary to the complainant's objections and not deregistered until the 12th cm when the complainant had sent Creditinfo Lánstrausti hf. confirmation by the National Court of its appeal. The complainant specifically opposes the point of view of Lögheimtun ehf. had to apply for leave to appeal as the claims in the complainant's case had not reached the amount of the appeal. With Articles 152 and 153 Act on Civil Procedure no. 91/1991 is specifically authorized to apply for leave to appeal in such cases and the complainant has exercised that authorization. Therefore, the situation was the same for the complainant and the complainant in case no. 2017/1620, i.e. that a time limit for appeal had to be sought in both cases and that the time limit for doing so had not expired when the entry was published in the default register. It also does not matter whether the decision of the district court is subject to appeal or appeal directly to the National Court or whether it is necessary to apply for permission to do so, as the same deadline applies. It is therefore not until after those deadlines or, as the case may be, that a decision has been reached on a permit application, that it can first be clear whether the decision of the district court will be final or not. Furthermore, the complainant specifically objects to the views of Lögheimtun ehf. that it is in the important interest of society to be able to register individuals on the default register when it is clear that the claims on which they are based are disputed and that the dispute has not been finally resolved.

The complainant also objects to the dissemination of information by Lögheimtun ehf. to Creditinfo Lánstraust hf. had been in accordance with the provisions of the Personal Data Protection Act and the operating license of Creditinfo, as Lögheimtan was aware that the appeal deadline had not passed and its significance as Lögheimtan ehf. has been involved in litigation on behalf of the complainant's counterparty in the court case in question and also in those litigation, the ruling of the Data Protection Authority in case no. 2017/1620 bowed to. The complainant also refers to the reference of Lögheimtun ehf. to the ruling of the Data Protection Authority in case no. 2016/303 and reiterates its views that in the aforementioned case the premises are completely different and therefore a meaningless precedent for resolving her case.

Finally, the view that court rulings are in any case published on the courts' website before the appeal deadline has been rejected as meaningless. Such publication is by no means universal and the district court in question, in the case of the complainant no. E- [case number], not published on the websites of the courts. In addition, the rules of the Data Protection Act also apply to such publication, as can be deduced from the rulings of the Data Protection Authority in cases no. 2016/1783, 2017/711 etc., in addition to which those rules also cover the disclosure of information by third parties on the publication of judgments, cf. ruling in case no. 2018/30.

4.
The views of Creditinfo Lánstraust hf.
Creditinfo Lánstraust hf. refers to the fact that in Article 2.2. The company's current operating license from 29 December 2017 (case no. 2017/1541) deals with what information can be entered in the company's default register. This includes court information on debtors according to Art. pronounced judgments. It is also stated in the same article that information may be recorded from the subscriber that the debtor has been ordered to pay a debt by a judgment, ruling or signed policy. The operating license of the Financial Information Office also contains a provision (Article 2.4.1 Article) on what the data subject shall be educated about in the notification in question. It stipulates, among other things, that if there is no confirmed court action that confirms the correctness of information about default, it shall be stated in the instruction that it will be deleted from the register, the person in question turns to the company and objects to the existence of a claim or its amount.

Creditinfo Lánstraust hf. also refers in its letter to Article 2.4. in the operating license (case no. 2016/1626) which was valid when the registration in question was entered in the default register. It states that the financial information agency shall send the data subject a notification of the planned listing no later than 14 days before the company disseminates the information for the first time. This procedure has been used for years at Creditinfo Lánstrausti hf. to provide a broader deadline in notifications of proposed registrations than provided for in the operating license provisions. or 17 days. Notifications of proposed listings, which are posted on the same day or the day after the request for registration has been received by Creditinfo Lánstrausti hf., State that defaults will be registered in the default register 17 days after the date of the letter. The date on which registration of the default register will take place is also specified. In the announcement in question, dated 18 February 2019, the date 7 March s.á. be specified as the date when the complainant's case would be entered in the default register. On March 6, 17 days had passed since the date of the letter, but Creditinfo Lánstraust hf. consider the beginning of the day to begin at midnight. It can only be seen that the data subject could have been clear from the clear wording of the letter that the deadline expires at the end of March 6, 2019. The financial information agency's announcement does not state what the deadline expires, but the data subject can assume that from the beginning of that day, i.e. from midnight, he can expect the entry to be recorded. The announcement also does not state that comments and objections must be received before the end of normal office hours if they are to be responded to within the day. On the other hand, it is stated in a letter from Creditinfo Lánstraust hf. that if the Financial Information Office has not received information on the settlement of a case or an objection due to claims that have not been confirmed by a public trial on the last deadline, entries are registered electronically in the default register with night runs, ie. on the planned registration date. If an objection is received to a claim that has not been confirmed by a public court action, the entry is deregistered the next morning and its effect is eliminated so that it does not affect the credit rating of the data subject. that if the Financial Information Office has not received information on the settlement of a case or an objection due to claims that have not been confirmed by a public trial on the last deadline, entries are registered electronically in the default register with night runs, ie. on the planned registration date. If an objection is received to a claim that has not been confirmed by a public court action, the entry is deregistered the next morning and its effect is eliminated so that it does not affect the credit rating of the data subject. that if the Financial Information Office has not received information on the settlement of a case or an objection due to claims that have not been confirmed by a public trial on the last deadline, entries are registered electronically in the default register with night runs, ie. on the planned registration date. If an objection is received to a claim that has not been confirmed by a public court action, the entry is deregistered the next morning and its effect is eliminated so that it does not affect the credit rating of the data subject.

The claim in question was registered on [date] 2019 from Lögheimtun ehf. who is a subscriber to Creditinfo Lánstrausti hf. In accordance with Article 2.4 of the company's operating license, the complainant was sent a letter on the 18th cm regarding the planned registration stating that the company would not receive a confirmation of payment of the claim within 17 days from the date of the letter, ie. before 7 March s.á. On the 6th cm at At 10.30 pm, the complainant had contacted Creditinfo Lánstraust hf. through the service website mitt.creditinfo.is and objected to the registration of the claim on the grounds that the deadline for appeal had not passed. The transaction had been registered at midnight on March 7 and the objection had therefore been received by Creditinfo Lánstrausti hf. after the entry has been published in the default register.

Creditinfo Lánstraust hf. so that an accompanying document with an operating license issued on 28 February 2017 discusses what is considered a disputed debt in the sense of the operating license. It states, among other things, that the Data Protection Authority considers that when there is a judgment on the obligation to pay which entails recognition of a claim and prescribes its collection by enforcement, it is reasonable to consider that such confirmation exists. Creditinfo Lánstraust hf. to the effect that from the ruling of the Data Protection Authority in case no. 2016/303, it can be concluded that it is not enough that there is a possibility of having an enforceable decision reviewed, but something must be available in that connection, such as the district commissioner agreeing to the protests of the respondent.

Creditinfo Lánstraust hf. so that in case no. 2017/1620 from the Data Protection Authority, to which the complainant refers in support of his case, it had been established that the complainant had requested a reopening of the judgment and had agreed to the reopening request. Therefore, in that case, the data subject would have taken a legal step to have a coercive decision overturned. If Creditinfo Lánstraust hf., After the publication of the ruling of the Data Protection Authority in the case, has followed the procedure of objecting to the registration of a pronounced judgment on the premise that a judgment should be appealed, whether the objection is received before or after the entry has been published on the default register, it is deregistered when the company has received confirmation that an application for leave to appeal has been applied for, ie. has taken a legal step to overturn the enforcement order. Creditinfo Lánstraust hf. this procedure shall be in accordance with the operating license of the company and the data subject in favor, provided that confirmation is only required that the application for appeal has been submitted regardless of whether it is approved. The entry is then re-registered if a court rejects an application for leave to appeal or a higher court confirms a default on a claim. The complainant's entry in this case was deregistered on 12 March 2019, when confirmation was received by the company that the complainant had applied for leave to appeal.

5.
The views of Lögheimtun ehf.
Lögheimtan ehf. refers to the fact that it is a law firm that looks after the interests of its clients, here Landsbankinn hf. who was a plaintiff in the cited district court case. She had disseminated information about the aforementioned court decision to Creditinfo Lánstraust hf. in accordance with the provisions of the Act on Personal Data Protection and Processing of Personal Data no. 90/2018 and point 3. Article 2.2.1 of the operating license of Creditinfo Lánstraust hf. from 29 December 2017, which states that the company may collect information on debts that individuals have been required to pay in court, provided that the amount of the debt is at least ISK 50,000. to principal.

The complainant's argument that the processing of information on the decision of the court is not permitted on the basis of the third paragraph. Article 2.1 of the operating license of Creditinfo Lánstraust hf., which states that the processing of information on disputed debts is not permitted, is objected to. Says that the cited provision specifically states that a debt is controversial when it "has not been confirmed by an enforceable judgment […]".

Lögheimtan ehf. that enforcement of the claim may have been carried out following the judgment on 1 March 2019, cf. Paragraph 1 Article 5 Act no. 90/1989 on enforcement. The registration on the default register, however, did not take effect until some time later or the 7th cm. Therefore, the debt was not considered controversial in any sense.

Furthermore, Lögheimtan ehf. to an accompanying document with the operating license of Creditinfo Lánstraust hf. from 28 February 2017. That document deals specifically with debts that are considered controversial, including that a claim is no longer disputed when a court has reached a decision on liability, as the Data Protection Authority states that a claim is considered undisputed when the district commissioner's decision has been revoked. . Therefore, the Data Protection Authority's understanding of the above seems to be that until the time the decision is revoked, it is considered controversial, even if a case for the annulment of a district commissioner's decision is pending before a district court. Since the judgment of the district court on the obligation to pay must be considered a stronger confirmation of the legitimacy of the claim than the decision of the district commissioner, the same views must prevail in this case.

Lögheimtan ehf. to the effect that the district court in question in this case could not have been appealed without leave to appeal, cf. Articles 152 and 153 Act on Civil Procedure no. 91/1991. The complainant had requested leave to appeal on 12 March 2019, but her request had been rejected by a decision of the National Court […].

Finally, Lögheimtan ehf. stated that it is Creditinfo Lánstraust hf. which is responsible for the default register and that it is within the remit of the company to enter information about the district court's decision on the default register when the appeal deadline has passed, the conclusion of the Data Protection Authority is that it was illegal before that time. Lögheimtan ehf. has only brokered Creditinfo Lánstrausti hf. the information that with the judgment in question, which had fallen on a certain date, the complainant had been ordered to pay a certain amount of principal.

This case has been delayed due to extensive work by the Data Protection Authority.

II.
Assumptions and conclusion

1.
Scope - Responsible party
Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679 (hereinafter referred to as the Regulation), cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or are to become part of a file.

Personal information includes information about a person who is personally identifiable or personally identifiable, and an individual is considered personally identifiable if it is possible to identify him or her, directly or indirectly, with reference to his or her identity or one or more factors that are characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation.

Processing refers to an action or series of actions in which personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 of the Act and point 2. Article 4 of the Regulation.

This case concerns, on the one hand, the mediation of Lögheimtun ehf. on behalf of Landsbankinn hf. on information about the complainant from the judgment of the District Court […] from [dated] 2019 in case no. E- [case number] to Creditinfo Lánstraust hf. and on the other hand to the listing of Creditinfo Lánstraust hf. on the information on the default register. In this respect and in the light of the above provisions, this case concerns the processing of personal information which falls within the competence of the Data Protection Authority.

The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. 7. tölul. Article 4 of the Regulation.

It is known that Lögheimtan ehf. provided information on the complainant for registration with Creditinfo Lánstrausti hf. but also that this communication was a part of the company's work for Landsbankinn hf. In this connection, the position of Lögheimtun ehf. as a collection party according to the Collection Act no. 95/2008, including the obligation of such a party to obtain a license for its activities according to Art. of the Act, as well as for the purchase of professional liability insurance according to Art. of the Act. As stated in the ruling of the Data Protection Authority no. 2016/1687, it will be concluded from this that independent decisions are made by the debt collector on how the debt is to be collected. In light of this, the Data Protection Authority considers Lögheimtuna ehf. be responsible for the processing of personal information which involved the dissemination of personal information about the complainant to Creditinfo Lánstraust hf.

2.
Legality of processing - Controversial debt
All processing of personal data must be subject to one of the authorization provisions of Article 9. Act no. 90/2018. It has been considered that the processing of information on financial matters and creditworthiness can, among other things, be based on point 6. of that article, i.e. on the grounds that the processing is necessary due to legitimate interests that the responsible party or a third party may pursue, unless the interests or fundamental rights and freedoms of the data subject are overridden.

In addition, as always when processing personal data, all the basic requirements of Article 8 must be complied with. Act no. 90/2018, th. á m. that personal information shall be processed in a lawful, fair and transparent manner (point 1); that they shall be obtained for clearly defined, legitimate and objective purposes and not further processed for other and incompatible purposes (paragraph 2); that they shall be sufficient, appropriate and not in excess of what is necessary for the purpose of the processing (paragraph 3); and that they shall be reliable and up-to-date as necessary, but that personal data which are unreliable or incomplete, as to the purpose of their processing, shall be deleted or corrected without delay (paragraph 4).

According to the first paragraph. Article 2 of Regulation no. 246/2001 on the collection and dissemination of information on financial matters and creditworthiness, cf. now the second paragraph. Article 15 Act no. 90/2018, the collection and registration of such information about individuals, in order to share it with others, is not permitted without the permission of the Data Protection Authority. It is stated in the first paragraph. Article 3 of the Regulation that the holder of such a license, called a financial information agency, is only permitted to process information that, by its nature, is of decisive importance in assessing the financial and creditworthiness of the data subject.

Creditinfo Lánstraust hf. is in charge of the processing of personal information on the basis of licenses from the Data Protection Authority according to Regulation no. 246/2001, Coll. now license, dated. 29 December 2017 (case no. 2017/1541), which was in force when the events of this case took place. According to para. Article 2.1 of the license, the processing of information on disputed debts is not permitted. This applies, among other things, if the debtor has demonstrably lodged an objection to the debt with the creditors, informed him of the reason for the objections and the debt has not been confirmed by an enforceable judgment.

In assessing whether the complainant's claim was controversial when information about it was communicated to Creditinfo Lánstraust hf. and it is entered in the default register, within the meaning of the aforementioned operating license provision, it must be assessed on the one hand whether the complainant objected to the registration in question and stated the reason for the objections and on the other hand whether the claim was confirmed when the complainant's information was entered in the register.

It is known that on [dated] 2019, a judgment was handed down in the complainant's case no. E- [case number] in the District Court […] and she then had four weeks to apply for leave to appeal to the National Court. The [date]. sm sent Lögheimtan ehf. information on a claim according to the aforementioned court decision to Creditinfo Lánstraust hf. for registration in the company's default register or […] before the deadline for appeals from the court or the deadline for applying for leave to appeal. The complainant was sent a letter about the planned registration a day later, or 18 cm, and given the opportunity to object to the registration within 17 days or before 7 March. The 6th cm sent the complainant a message to mitt.creditinfo.is and a copy to the e-mail address of Lögheimtun ehf. as it objected to the registration on the ground that the time-limit for lodging an appeal had not expired. At the beginning of the next day, i.e. its 7 cm, registered Creditinfo Lánstraust hf. the complainant's claim on the company's default register.

According to para. Article 2.1 of the operating license does not suffice for a judgment to be enforceable in order for a claim not to be disputed, but the judgment must also include confirmation of the claim. The operating license provision must be interpreted in the light of the objective of Act no. 90/2018 to promote the handling of personal information in accordance with basic principles and rules on personal protection and privacy and to ensure the reliability and quality of such information, cf. Paragraph 1 Article 1 of the Act. In view of this, the Data Protection Authority considers that a judgment that does not constitute a final decision in a court case or that can be subject to review cannot include confirmation of a debt within the meaning of the operating license provision. This applies equally to a judgment in an existing case that is to be reopened, as well as a judgment that can still be appealed, cf. also the interpretation of the Data Protection Authority from 25 January 2019 in case no.

In order for it to be possible to conclude that a court decision includes confirmation of a claim, the time limit for appeal to a higher court, where the claim can be reviewed, must have passed. If a judgment is appealed, the judgment will not be upheld or overturned until the decision of a higher court. If the time limit for appeal passes without an appeal being appealed, that decision shall be deemed to have been upheld.

It is known that the deadline for appeals by the district court in the complainant's case did not expire until [dated] 2019. It cannot be seen that the ruling in question included confirmation of the complainant's claim when personal information about her financial matters was shared from Lögheimtunn ehf. to Creditinfo Lánstraust hf. and they are entered in that company's default register on the 7th cm. their reception.

With reference to this and other of the above, the conclusion of the Data Protection Authority is that Lögheimtun ehf. was not permitted to disclose personal information about the complainant from the judgment of the District Court […] no. E- [case number] to Creditinfo Lánstraust hf. when the appeal deadline had not expired. Also that Creditinfo Lánstrausti hf. was not permitted to register and have information on the complainant's claim on the default register of Creditinfo Lánstraust hf. from the date on which they were registered, ie. March 7, 2019 to 12 cm, when the company deregistered the complainant's information on the register.

As this case has grown, the conclusion of the Data Protection Authority is that there are no preconditions for the application of a fine authority, cf. Article 46 Act no. 90/2018, due to the above.

3.
Deadline for objections
On behalf of Creditinfo Lánstraust hf. states that the complainant sent his objection, through the service website mitt.creditinfo.is, on 6 March 2019 at 22.30 , due to the planned registration of a claim against it on the company's default register. The complainant's objection, however, did not reach the company until after midnight, i.e. after the registration of the claim in the default register has taken place.

It is known that Creditinfo Lánstraust hf. sent the complainant a notification of the proposed listing on the default register, [dated] 2019. With the announcement, the financial information agency granted the complainant 17 days, from the date of the letter, to object to the listing.

In the first paragraph. Article 8 of the Administrative Procedure Act no. 37/1993 states that where a time limit is provided for by law, the day from which the time limit is counted is not included in the time limit. It is clear that this provision concerns deadlines in the field of administration and that the activities of Creditinfo Lánstraust ehf. can not be considered to fall under it directly. On the other hand, it is clear that much of the operations of Creditinfo Lánstraust hf. is by nature obligatory to the administration in light of the requirements that apply to it, e.g. á m. according to the terms of the operating license, and the Data Protection Authority considers that in connection with deadlines prior to registration with the company, the provision should be taken into account so that the deadline is calculated in accordance with its rules.

This is referred to by Creditinfo Lánstraust hf. that according to Article 2.4 of the operating license, the data subject shall be notified of the proposed registration no later than 14 days before the company disseminates the information for the first time. Creditinfo Lánstraust hf. states that the company gives in its notifications a deadline of 17 days from the date of the letter, and that in a letter to the complainant, [dated] 2019, the date of 7 March s.á. be specified as the date when the complainant's case would be entered in the default register.

The Data Protection Authority considers that it must be borne in mind that the registration of a default register is burdensome for the data subject and that this is one of the reasons why all doubts about the planned entry of information in the register must be interpreted in favor of the data subject. The Data Protection Authority also believes that the fact that Creditinfo Lánstraust hf. gives the registered person a more spacious deadline but is not obliged to change it. It is also considered that it is the responsibility of the responsible party to take appropriate measures to provide the registered person with sufficient information in connection with the processing of personal information about him in a transparent, clear and accessible language, cf. Paragraph 1 Article 12 of the Regulation, so that he can respond and safeguard his interests in a satisfactory manner, but this educational obligation of the responsible party, in this case the Financial Information Office, is also discussed in Article 2.4 of the operating license. If there is any doubt as to when the time limit for objecting to registration expires, such a body must bear the loss and interpret the doubt in favor of the registered person. This view applies to the announcement made by Creditinfo Lánstraust hf. sent the complainant and the discrepancy stated in the wording of the notification, i.e. that, on the one hand, it was stated that information would be entered in the register when 17 days had elapsed from the date of the letter, but that at the same time it had been stated that the entry in the register would take place the day before this 17-day deadline.

In accordance with the above, the complainant's deadline for raising objections did not begin until [dated] 2019, the day after the date of the announcement of Creditinfo Lánstraust hf. and did not end until after March 7, i.e. at the beginning of the day 8. cm Creditinfo Lánstraust hf. because the complainant objected just over a day before the deadline for objections had passed. Irrespective of whether the disputed claim in question, cf. discussion in this regard in Chapter 2 above, it was therefore not permitted to record the information at the time in question.

Ú r s k u r ð a r o r ð:
It was not permitted to have information about a claim against [A], which was adjudicated [dated] 2019 in the District Court […], in case no. E- [case number], on the default register of Creditinfo Lánstraust hf. from 7 to 12 March 2019.

The brokerage of Lögheimtun ehf. on information about the complainant for their entry on the default register of Creditinfo Lánstraust hf., as well as that company's entry of the information on the register on 7 March 2019, did not comply with Act no. 90/2018.

In Privacy, March 10, 2021

Ólafur Garðarsson
acting chairman

Björn Geirsson Vilhelmína Haraldsdóttir

Þorvarður Kári Ólafsson