Persónuvernd - 2020010671
From GDPRhub
| Persónuvernd - 2020010671 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5 GDPR Article 6(1)(e) GDPR Article 6(1)(f) GDPR Article 18 GDPR Act no. 90/2018 n personal data protection and the processing of personal data |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 25.11.2020 |
| Published: | 21.12.2020 |
| Fine: | None |
| Parties: | Heilbrigðiseftirlit Suðurlands |
| National Case Number/Name: | 2020010671 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Icelandic |
| Original Source: | Persónuvernd (in IS) |
| Initial Contributor: | n/a |
Icelandic DPA held that the Health Inspectorate of the South complied with the provisions of the GDPR when collecting information on the movable property of a complainant.
English Summary
Facts
On 14 September 2019, the DPA received a complaint regarding the visit of a representative of the South Iceland Health Inspectorate at the complainant's home which included taking pictures of the property. The complainant argued that his wife present during the visit was not sufficiently informed about its purpose.
The South Iceland Health Inspectorate explained the legal basis for the visit. The Inspectorate stated that it had sent a letter to the complainant afterwards where it indicated the right to object its actions in accordance with the administrative law. It stressed that access to documents and pictures created during supervision limited to health representatives who perform these tasks.
Dispute
Was the processing of personal information about the complainant by the South Iceland Health Inspectorate in accordance with Icelandic data protection laws?
Holding
The DPA held that the registration and processing of personal information about the complainant by the Health Inspectorate of the South were justified by the legal authorization envisaged by point 3. Article 9 Act no. 90/2018.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Ruling On 25 November 2020, the Data Protection Authority issued a ruling in case no. 2020010671 (formerly 2019091723). I. Procedure 1. Outline of case On 14 September 2019, the Data Protection Authority received a complaint from [A] (hereinafter referred to as "the complainant") regarding the visit and photography of a representative of the South Iceland Health Inspectorate at the complainant's home to […]. By letter dated September 30, 2019, further clarification of the complaint was requested. The answer was sent by e-mail on October 9, 2019. By letter dated On 22 October 2019, the Health Inspectorate of the South was invited to submit explanations regarding the complaint. The reply was received by letter dated 19 November 2019. By letter dated On 23 July 2020, the complainant was given an opportunity to comment on the above explanations of the Health Inspectorate of the South. The answer was sent by e-mail on 18 August 2020. All the above documents have been taken into account in resolving the case, although not all of them are specifically described in the following ruling. This case has been delayed due to work by the Data Protection Authority. 2. The complainant's views The complainant states that he was not at home when a representative of the South Iceland Health Inspectorate visited the yard and that his wife, who was at home, was not provided with sufficient information about the reason for the representative's visit. The complainant believes that the health officer took photographs of real estate and movable property at the home without permission. The complainant largely believes that there is a serious threat of confiscation of personal property, even the demolition of houses that are being repaired. He considers it perfectly illogical to threaten it, without at least offering explanations or objections. He considers that this is a violation of his fundamental right as a person. The complainant also claims that he has not been informed of the manner in which the case is being kept and handled and requests that data from the on-site visit of a representative of the South Iceland Health Inspectorate be deleted in his presence. 3. Perspectives of the Health Inspectorate of the South Heilbrigðiseftirlit Suðurlands states that in regulation no. 737/2003 on waste treatment, the occupiers of plots and land are obliged to keep them clean and tidy and that the health committee supervises general cleaning and outdoor hygiene and takes part in carrying out general cleaning of plots and land for cleaning purposes. During a site visit to the complainant's home, a clean-up operation was underway in the South. The campaign was decided at the general meeting of the South Iceland Health Committee, under the slogan "Clean South" in 2019 and was a joint effort in all 14 member municipalities of the South Iceland Health Inspectorate. The campaign has been well publicized by all member municipalities and has also found its way into the media. The Health Inspectorate states that the procedures for the inspection are in such a way that there is co-operation with the employees of the municipalities on specifics. The office or representatives of the health inspectorate will receive tips on uncleanliness on plots and lands. After that, a health representative will go to the scene and assess whether there is a reason to comment on the treatment. If necessary, a representative of the health inspectorate goes to the occupier / site owner and introduces himself and the project, before taking photographs, of what he deems necessary to remove due to uncleanliness, risk of pollution or damage to the environment. In this case, the complainant's wife, who had been at home, had been interviewed and had taken the message well and had not commented on the health officer's inspection and photography. Following the on-site visit, the Health Inspectorate sent the complainant a letter with comments, together with photographs taken during the on - site visit of its representative, to the complainant's home at […], regarding the handling of the plot and land. The letter refers to Regulation no. 941/2002 on hygiene. It is said that the pictures show, among other things, numberless cars, car wrecks and unused work machines, which in the opinion of the health inspectorate are detrimental to the environment. With the letter, the health inspectorate challenged the complainant to clean the plot and gave the complainant a deadline to do so. Attention was drawn to the fact that if the plot was not cleaned, it would be done at the expense of the complainant according to Act no. 7/1998 on hygiene and pollution prevention and Regulation no. 737/2003, on waste treatment. The Health Inspectorate instructed on the complainant's right to refer a decision on the appropriation of his plot and land to the Appellate Committee for Environment and Natural Resources. The Health Inspectorate also pointed out that the complainant was authorized according to the Administrative Procedure Act no. 37/1993 to submit written comments to that effect. Heilbrigðiseftirlit Suðurlands finally states that access to letters and pictures that are created during supervision is limited to health representatives who perform these tasks. II. Assumptions and conclusion 1. Scope - Responsible party Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 Act no. 90/2018 and thereby the powers of the Data Protection Authority, cf. Paragraph 1 Article 39 Act no. 90/2018, covers the processing of personal data that is partly or wholly automated and the processing by other methods than automatic of personal data that are or are to become part of a file. Personal information includes information about a person who is personally identifiable or personally identifiable, and an individual is considered personally identifiable if it is possible to identify him / her, directly or indirectly, with reference to his or her identity or one or more factors that are characteristic of him or her, cf. 2. tölul. Article 3 Act no. 90/2019 and point 1. Article 4 Regulation (EU) 2016/679. Processing refers to an action or series of actions in which personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 Act no. 90/2018 and point 2. Article 4 Regulation (EU) 2016/679. It can be assumed that the taking of movable property can be considered the processing of personal data, which falls within the scope of the Personal Data Protection Act, if it is possible to identify movable property and thus link it to information about an individual who owns it, e.g. with car number. This case also concerns the registration of information on movable property on the complainant's site in connection with a site visit by a health representative as well as the custody of the documents in question following the visit. In this respect and in view of the above provisions, this case concerns the processing of personal data which falls within the competence of the Data Protection Authority. The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 Act no. 90/2018 refers to an individual, legal entity, government authority or other party that decides alone or in collaboration with other purposes and methods of processing personal information ,. sbr. 7. tölul. Article 4 Regulation (EU) 2016/679. According to the Articles of Association of the Health Inspectorate of the South, it is a regional association of municipalities in the South in accordance with the provisions of the Local Government Act no. 138/2011. The South Iceland Health Committee is also in charge of the Health Inspectorate. As is the case here, the South Iceland Health Inspectorate is therefore responsible for the processing in question. 2. Legality of processing All processing of personal data must be covered by one of the authorization provisions of Article 9. Act no. 90/2018. It may be mentioned that personal information may be processed if it is necessary for the processing to be necessary to fulfill the legal obligation resting on the responsible party, (point 3)., The processing is necessary for work carried out in the public interest or in the exercise of public authority which the guarantor handles, (point 5), cf. also point e, para. Article 6 of Regulation (EU) 2016/679, or that the processing is necessary due to legitimate interests that the responsible party or a third party safeguards unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh (point 6) of the same article. In assessing the authorization for processing, the provisions of other applicable laws must also be taken into account, including the provisions under which the authority in question operates. In Article 44 Act no. 7/1998 on hygiene and pollution prevention states that no municipality shall be without health supervision. Heilbrigðiseftirlit Suðurlands carries out inspections in the complainant's district. In each region, a health committee shall be elected after each municipal election. According to the first paragraph. Article 49 the same law shall appoint a health committee in each area and a health representative to carry out supervision. Health representatives work on behalf of the health committee, cf. Article 49 Act no. 7/1998 on hygiene and pollution prevention. In Article 2 The same law states that the law covers all kinds of activities and projects in this country. According to Art. (originally Article 16) of Regulation no. 737/2003 on the treatment of waste, the occupiers of plots are obliged to keep them tidy and the role of the health committee is to supervise general cleaning and hygiene outdoors and to take care of the general cleaning of plots and lands for cleaning purposes. The committee is also authorized to order the cleaning of plots and land and if there is a special reason for the demolition of houses and fences in demolition. Finally, the committee may have numberless cars and car wrecks and similar items removed following a warning. In light of the above, it is the opinion of the Data Protection Authority that the registration and processing of personal information about the complainant by the Health Inspectorate of the South, which this complaint covers, could have relied on the authorization in point 3. Article 9 Act no. 90/2018. In addition to the authorization according to the above, the processing of personal information must satisfy all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. Among other things, it is stipulated that they are processed in a lawful, fair and transparent manner towards the data subject (point 1), that they shall be preserved in such a way that it is not possible to identify registered individuals for longer than necessary. for the purpose of processing (point 5), and that it shall be processed in such a way as to ensure the appropriate security of the personal data (point 6). It can be deduced from the facts of the case that the South Iceland Health Inspectorate notified the complainant's wife of the on-site inspection. The complainant was also given the opportunity to object in accordance with the administrative law to the planned actions of the health inspectorate. In the opinion of the Data Protection Authority, there is therefore no reason to believe that the above-mentioned basic requirements have been violated. In view of the above, the conclusion of the Data Protection Authority is that the processing of personal information about the complainant by the South Iceland Health Inspectorate was in accordance with Act no. 90/2018, on personal protection and processing of personal information. 3. Request for deletion of data The complainant has requested that the data in question be deleted. According to point b of point 2. Article 13 Act no. 90/2018, Coll. Article 18 of Regulation (EU) 2016/679, the responsible party must delete personal information when there is no longer a valid reason to store it. Reasonable reasons for the storage of information can e.g. based on instructions in law. According to Art. Act no. 77/2014, parties subject to delivery are obliged to submit their documents to the public archives, in accordance with the provisions of the Act. Then it says in Article 24. Act no. 77/2014 that parties subject to delivery are not permitted to disuse or discard any document in their archives, unless this is done on the basis of an approved national archivist, the rules of the National Archives of Iceland according to Art. or the second paragraph. Article 24 Act no. 77/2014, or on the basis of a special legal provision. The above is reiterated in Article 26. Information Act no. 140/2012, which states that the registration of cases, archives and other storage of data and information shall comply with the provisions of the Act on Public Archives. From the above provisions, it can be deduced that the legal obligation rests with the Health Inspectorate of the South, as a party subject to delivery, for the storage of the information. Furthermore, this information will not be disposed of except in accordance with an authorization in law or on the basis of a decision by the National Archives of Iceland. It is therefore up to the National Archives of Iceland, and not the Data Protection Authority, to decide whether the conditions for disposal of data exist according to Act no. 77/2014 From the following: The processing by the South Iceland Health Inspectorate of personal information about [A], due to the registration of information on movable property and the South Iceland health representative's taking it at his home, complied with Act no. 90/2018 and Regulation (EU) 2016/679. In Privacy, November 25, 2020
