Persónuvernd (Island) - 2020010726
From GDPRhub
| Persónuvernd - 2020010726 | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Persónuvernd (Island) |
| Jurisdiction: | Iceland |
| Relevant Law: | Act no 40 / 1991 Act no 77 / 2000 |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 12.09.2018 |
| Decided: | 05.04.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2020010726 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | The Icelandic Data Protection Authority (in IS) |
| Initial Contributor: | Isabella Baumgartner |
The Icelandic DPA decided that the processing of personal data by the city Kópavogur (controller) was admissible and in accordance with Act No 77 / 2000.
English Summary
Facts
In this case a data subject turned to the welfare department of the city Kópvagur (controller) for assistance with a housing problem.
The data subject later filed a complaint about the processing of personal data with the DPA. The complaint was accompanied by a copy of the communication log between the data subject and the processor. The data subject claimed that the processor shared personal information without authorisation and knowlegde of the data subject. The claim related to the fact that the department of Kópvagur has shared the information with the department in Reykjavik.
The controller, on the other hand, claimed to only have processed non-personally identifiable information. Additionally, the controller relied on the fact that there existed an authorisation for passing along the personal information.
Holding
The DPA held that the processing of personal information by the city Kópavogur (controller) was admissible. Therefore the DPA comes to the conclusion that the controller acted in accordance with Act No 77 / 2000.
The processing was necessary to fulfill a legal obligation according to Act 40 / 1991.
Also, the DPA held that it is permissible for local authorities to exchange information about clients. Therefore the controller did not have the obligation to inform the data subject about the processing.
The processing was fair and transparent and the personal information was obtained for a stated, clear and objective purpose.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Processing of personal information by the town of Kópavogur Case no. 2020010726 5.4.2023 When it comes to the processing of personal data, which is carried out by the government in connection with its statutory role, it has been considered that it can be permitted in particular on the basis that the processing is necessary to fulfill a legal obligation, due to work carried out in the public interest and exercise of public authority. In this case, the city of Kópavogur provided social services, including was intended to solve the housing problem. It was believed that the municipality of Kópavogur had quite a lot of scope to assess which services were necessary to carry out the tasks entrusted to the municipality by the law, as well as how the services would be implemented. It was therefore necessary for the town of Kópavogur to work with information about the complainant in order to remedy his housing problem in accordance with the municipality's statutory role. ---- Personal protection ruled in a case where a complaint was made about the processing of personal information by the welfare department of Kópavogur town. More specifically, the complaint related to the fact that the social worker of Kópavogsbær discussed the complainant's case with a person at Reykjavík City's welfare department without the complainant's knowledge and consent and without fulfilling his duty to educate. The complaint was also based on the fact that the complainant's messages addressed to the social worker were answered by the social worker's supervisor and those answers were not in accordance with the social worker's answers. The conclusion of the Personal Protection Authority was that the processing of the complainant's personal information by Kópavogur City was in accordance with the Act on Personal Protection and Handling of Personal Information. Ruling about a complaint about the processing of personal data by the municipality of Kópavogur in case no. 2020010726 (previously no. 2018091445): i Procedure 1. In general On 12 September 2018, Personal Protection received a complaint from [A], f.h. [B] (hereinafter the complainant), regarding the processing of personal information about him by the welfare department of Kópavogur town. Personal protection invited Kópavogsbær to comment on the complaint with a letter dated May 15, 2019. A reply was received by letter, dated 18 June s.á., By letter, dated On October 3rd, the Data Protection Authority requested further information from Kópavogsbær. The answer of Kópavogsbær was received with a letter dated 22. s.m. By letter, dated On April 14, 2020, the complainant was invited to comment on Kópavogsbær's responses. The answer was by email, dated 21 June s.á When resolving the case, all of the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. We apologize for the delays that have occurred in handling the case, i.a. due to a lot of work at Personal Protection. 2. Complainant's point of view On the part of the complainant, it is based on the fact that a social worker, who handled his case at Kópavogsbær, spoke to the head of the department of housing and aging affairs at Reykjavík City's welfare department without authorization and without the complainant's knowledge. It is also based on the fact that the social worker investigated the participation of Kópavogsbær in subsidizing the complainant for an emergency facility in Víðines that was run by Reykjavík City's welfare department, without the complainant's knowledge and consent, and without fulfilling the educational obligation. The complaint also relates to the fact that the head of the social worker at Kópavogsbær answered the complainant's messages to the social worker and that those answers are not in accordance with the social worker's answers about what information was communicated to the Reykjavík City Welfare Division. There is also a complaint that the complainant was answered by the legal department of the town of Kópavogur on behalf of the town's welfare department. The complainant relies on the fact that the mandates that the municipality of Kópavogur indicates that he signed for the application for financial assistance only concerned those specific applications and did not extend to anyone else. The complainant believes it is clear from the communication records from Kópavogsbær that information was obtained from someone other than himself, i.e. in a call with an employee of Reykjavík City's welfare department. The complaint was accompanied by a copy of the communication log between the complainant and the welfare department of Kópavogsbær between December 2017 and June 2018. It records the complainant's phone calls, meetings and e-mail communications with an employee of the welfare department of Kópavogsbær. The communication mainly concerned the complainant's housing problem and the resources available to remedy it. The communication also concerned the complainant's application for social housing and his position on the waiting list for that. 3. Kópavogur town's point of view Kópavogsbær's welfare department is based on the fact that the personal information that has been processed is non-personally identifiable information such as gender, age and marital status, as well as information that the complainant gives to the counselor himself and about his status and social history that is relevant to the resolution of cases. Information has not been obtained from others without the consent of the complainant. The purpose of the processing was to find ways to solve the complainant's housing problem and homelessness. On the part of Kópavogsbær, it is based on the fact that the authorizations for the aforementioned processing were, on the one hand, the consent of the data subject and also that the processing was necessary to fulfill a contract to which the complainant was a party or to take measures at his request before the contract was concluded. It is pointed out that the complainant signed a power of attorney to a consultant in 2016 related to financial assistance, where authorization was given to investigate his situation with several parties, i.e. on m. public bodies. The complainant also signed an application for financial assistance in 2017 and 2018, which authorized his advisers to examine his case in relation to the respective applications for financial assistance. It also states that the processing of personal information was in accordance with the provisions of the principles of the Personal Protection Act, as the processing was part of the municipality's statutory activities related to financial assistance according to Act no. 40/1991 and was in the hands of specially trained employees who are bound by a duty of confidentiality. Employees of the welfare department work according to the rules of the social service of Kópavogur town on the handling of personal information from 2004, which takes into account law no. 77/2000 on personal protection and processing of personal information. As if working according to the security policy from May 2006. Both the security policy and the rules for handling personal information take into account the principles mentioned in Article 8. Act no. 90/2018 on personal protection and processing of personal information. II. Conclusion 1. Legal separation The events of this case happened before the entry into force of the current law, no. 90/2018, on personal protection and processing of personal information, on 15 July 2018. The coverage and content of this ruling will therefore be based on the provisions of the previous law, no. 77/2000, but there are no material changes in law no. 90/2018 on the rules of the law that are tested here. 2. Legal basis and conclusion Scope of the previous personal protection law, no. 77/2000, cf. Paragraph 1 Article 3 of that law, covered any electronic processing of personal information, as well as manual processing of such information that was or was to become part of a record. Personal information was defined as any personally identifiable or personally identifiable information, i.e. information that could be directly or indirectly attributed to a specific person, dead or alive, cf. Article 2, number 1 of the Act, and processing was defined as any operation or series of operations where personal data was processed, whether the processing was manual or electronic, cf. Paragraph 2 of the same article. This case relates to the fact that the Kópavogur City Welfare Division has obtained and communicated information about the complainant to the Reykjavík City Welfare Division. The case also concerns the handling of information about the complainant within the administration of Kópavogur town. The only thing that can be determined from the facts and data of the case is that the information originated in some kind of file and that it was kept electronically. In the opinion of the Data Protection Authority, it is not possible to agree with Kópavogsbær that the case concerns the processing of non-personally identifiable information, as it seems clear that the municipality was able to link all the information discussed here with the complainant's personal identifier. Regarding this issue, the processing of personal data falls under the authority of the Personal Protection Agency. The city of Kópavogur is considered to be the party responsible for the aforementioned processing in the sense of section 4. Article 2 Act no. 77/2000 According to law no. 77/2000, all processing of personal information had to be based on one of the sources identified in Article 8. of the law. In the case of sensitive personal data, their processing also had to rely on one of the conditions set out in Article 9. of the law analyzed. It will not be seen that the personal information at issue in this case was considered sensitive personal information in the sense of the law, despite the fact that some of it, like information about homelessness, can be considered sensitive. On the part of Kópavogsbær, reference has been made to the fact that the processing of personal information discussed here was permitted based on the consent of the complainant, cf. Number 1. Paragraph 1 Article 8 Act no. 77/2000. Furthermore, the municipality has referred to the fact that the processing was permitted on the basis that it was necessary to fulfill a contract with the complainant or take measures at his request before a contract was reached, cf. Number 2. the same paragraphs. In the opinion of the Data Protection Authority, it is not possible to agree that the processing could be based on these provisions, taking into account that the processing concerned the statutory role of the municipality, as detailed below, and the complainant's consent could therefore not be considered to have been given voluntarily in the sense of number 7. Article 2 of the law. When it comes to the processing of personal information, which is carried out by the government in connection with its statutory role, it has been considered that it can be permitted mainly on the basis of item 3. Paragraph 1 Article 8 Act no. 77/2000 to the effect that processing is permitted if it is necessary to fulfill a legal obligation, item 5. Paragraph 1 of the same articles, due to work done in the public interest, or item 6. Paragraph 1 the same articles, in the exercise of public authority. When assessing the authority for the processing of personal information that is being discussed here by the municipality of Kópavog, provisions in other laws must therefore be taken into account. In Article 12 Act no. 40/1991 on social services of municipalities states, among other things, that a municipality must provide services and assistance to residents and also ensure that they can provide for themselves and their families. Assistance and services must equally serve to remedy the problem and prevent individuals and families from getting into the position of not being able to handle their own affairs. Article 16 also states of the act on social affairs committees, which are made up of representatives elected by the local government, cf. Paragraph 1 Article 5 of the law, shall offer social counseling, which includes, among other things, to provide support for social and personal problems. According to Article 17 of the same law, social counseling includes advice in the fields of finance, housing, parenting, divorce, etc. Says that it should always be used in a normal context with other assistance according to the law and in cooperation with other entities that offer such services. Furthermore, in Articles 45 and 46 the same law stipulates the obligation of municipalities to guarantee housing for its residents. More specifically, it says in Article 46. that the social affairs committees should see to it that families and individuals who are not able to do so themselves, get a solution in housing matters to solve an immediate problem while working on a permanent solution. Finally, it is assumed that local authorities are allowed to cooperate on projects according to the law, cf. Articles 4 and 7 of the law. Has Kópavogsbær thus by law no. 40/1991 has been assigned a role in connection with the provision of social services, which includes, among other things, solving the housing problem, and thus the public authority associated with it. From the aforementioned provisions of the law, the only conclusion is that the municipality of Kópavogur has quite a lot of scope to assess which services are necessary to carry out the tasks assigned to the municipality by the law, as well as how the services are implemented. In view of the above, Personal Protection Kópavogsbær believes it was necessary to work with information about the complainant in order to remedy his housing problem in accordance with the statutory role of the municipality. It must therefore be considered that Kópavogsbær has, on the basis of items 3 and 6. Paragraph 1 Article 8 Act no. 77/2000, all the processing of personal information about the complainant that is discussed here is permitted. In addition to authorization according to the above, the processing of personal information had to satisfy all the principles of paragraph 1. Article 7 applicable law no. 77/2000. Among other things, it was stipulated that personal data should be processed in a fair, objective and legitimate way and that all its treatment should be in accordance with the high-quality processing of personal data (subsection 1) and that it should be obtained for a stated, clear and objective purpose, and not further processed for other and incompatible purposes (item 2). The assumption that the processing is considered reasonable, in accordance with the requirement of item 1. Paragraph 1 Article 7 applicable law no. 77/2000, was that it was transparent towards the registered, but that included i.a. requirements for the registered person to be aware of the processing and to be educated about it, cf. i.a. Article 21 Act no. 77/2000. It also resulted, among other things, from the clause's requirement for high-quality processing methods that the responsible party had to consider the security of personal data when processing it, cf. further, Article 11 of the law. As has been mentioned before, the complaint that is being discussed here pertains, among other things, to the fact that the welfare department of Kópavogsbær exchanged the complainant's personal information with the welfare department of the city of Reykjavík without authorization and without the complainant's knowledge. From the case file, it can be concluded that the complainant was in regular contact with the welfare department of the city of Kópavogur in connection with the municipality's participation in subsidizing the complainant for emergency measures in Víðines, which was run by the welfare department of the city of Reykjavík. In the present case, Article 21 is tested in particular. Act no. 77/2000, which stipulated that when the controller obtains personal information about the registered person from someone other than himself, he must simultaneously inform the registered person about it and inform him of certain points, cf. enumeration in paragraph 3 of the provision. However, this was not required to be done if there was a legal authority to record or share the information, cf. Number 3. the same paragraphs. As above, the authorized law no. 40/1991 municipalities to cooperate on projects according to the law, cf. Articles 4 and 7 of them, but Personal Protection considers it a prerequisite for such cooperation that local authorities can exchange information about their clients. With reference to that, and taking into account what is stated above about processing authorization, it is the conclusion of the Data Protection Authority that Kópavogsbær did not have to educate the complainant specifically about the processing of his personal information that involved obtaining information about him from the City of Reykjavík where exemption clause 3. number Paragraph 4 Article 21 Act no. 70/2000 was applicable. Therefore, it will not be considered that the municipality of Kópavogur has violated its educational obligation during the processing. When evaluating transparency, it is also considered necessary to take into account the fact that the complainant has been in a lot of communication with Kópavogsbær in relation to his problem and has, among other things, instructed the municipality to gather information about him. Although the mandate, which was the basis of that information gathering, did not explicitly address the complainant's housing problem, it must be considered that the complainant must have been aware from the mandate that the municipality would have to work with his personal data in connection with the provision of social services, .including regarding the solution to the complainant's housing problem. In the complaint, comments are also made that the head of the complainant's social worker at Kópavogsbær answered the complainant's messages that he addressed to the social worker. In addition, there is a complaint that the complainant was answered by the legal department of the town of Kópavogur on behalf of the town's welfare department. Regarding the above, it is considered that the party responsible for the processing, i.e. The municipality of Kópavogur is responsible for the duties and tasks of managers and employees towards the registered. As is the case here, it is therefore not a matter of sharing personal information, but the processing consisted of access to personal information within the same responsible party, and therefore does not test the provisions of Act no. 77/2000 on the educational obligation for this processing. Furthermore, it cannot be determined from the documents of the case that through this arrangement unauthorized employees of Kópavogsbær gained access to personal information about the complainant that they did not need due to their work at the municipality. Accordingly, it will not be considered that the processing has in this respect gone against the provisions of Article 11. of the Information Security Act. In view of the above, it is the conclusion of the Data Protection Authority that the processing of personal information about the complainant by the City of Kópavogur was fair and transparent towards the complainant and that his personal information was obtained for a stated, clear and objective purpose, cf. 1. and 2. numbers. Paragraph 1 Article 7 Act no. 77/2000. Taking all the above into consideration, the conclusion of the Personal Protection Authority is that the processing of personal information about the complainant by the City of Kópavogur was in accordance with Act no. 77/2000. Ruling: The City of Kópavogur's processing of personal information about [B] was in accordance with Act no. 77/2000, on personal protection and processing of personal information. Privacy, April 5, 2023 Þórður Sveinsson Bjarni Freyr Rúnarsson
