Persónuvernd (Iceland) - 2022020332 and 2021112244

Persónuvernd - 2022020332 and 2021112244

Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 2(1) GDPR Article 4(1) Data Protection and the Processing of Personal Data
Type:	Complaint
Outcome:	Rejected
Started:	24.11.2021
Decided:	20.06.2022
Published:	07.10.2022
Fine:	n/a
Parties:	Íslandspóstur
National Case Number/Name:	2022020332 and 2021112244
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Icelandic
Original Source:	Persónuvernd (in IS)
Initial Contributor:	gauravpathak

The Icelandic DPA rejected complaints for lack of evidence which alleged that the Icelandic postal service unlawfully processed personal data by maintaining a special register for stamp collectors.

English Summary

Facts

On 24 November 2021 and 15 February 2022, a data subject complained to the Icelandic DPA regarding the processing of personal data by a controller, Íslandspóstur, i.e. the Icelandic postal authority. The data subject alleged that the controller maintained a special register of stamp collectors, including the data subject. The allegation was based on the claim that all postage to the data subject from abroad was subjected to customs check, regardless of whether it was general or traceable letters. In reply, the controller stated that it was not maintaining a special register. It also stated that, as per law, all shipments to Iceland are subject to customs duties and, as a customs broker, the postal authority is required to do customs processing. In addition, the controller added that with experience the employees of the postal authority gain knowledge about assessing high-value items.

Holding

The Icelandic DPA noted that Article 4(1) GDPR applies to "the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." It added that there was no evidence of a special register for stamp collectors and that, therefore, also no evidence existed for GDPR-infringing personal data processing. Thus, the DPA rejected the complaint. The DPA did not consider it necessary to use its additional powers to carry out any further investigations.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Processing of personal information by Íslandspósts ohf

Case no. 2022020332 and 2021112244

7.10.2022

Personal protection ruled in the cases of two unanimous complaints from parties about the processing of personal information about them by Íslandspósts ohf. when handling letters from abroad. More specifically, the complainant believed that Íslandspóstur maintained a special register of stamp collectors, including himself.

The conclusion of the Personal Protection Agency was that it was considered unproven that Íslandspóst's processing of the complainant's personal information violated the law.

Ruling

On June 20, 2022, Personal Protection issued the following ruling in cases no. 2022020332 and 2021112244:

i
Procedure
1.
Complaint and procedure

On November 24, 2021 and February 15, 2022, Personal Protection received complaints from [A] (hereinafter the complainant) about the processing of Íslandspósts ohf. on personal information about him, when handling correspondence from abroad. The complainant considered Íslandspóst ohf. maintain a separate register of stamp collectors including themselves.

Personal protection invited Íslandspósti ohf. to comment on the complaint by letter, dated May 10, 2022, and the company's answers were received by letter, dated May 31, 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

2.
Complainant's point of view

The complainant relies on the fact that Íslandspóst's Customs Agency maintains a special register of stamp collectors, including itself, for the purpose of taking all mail that the complainant and other Icelandic stamp collectors receive from abroad for customs processing. In the complainant's opinion, it cannot be considered normal that all mail he receives from abroad is taken for customs processing, regardless of whether it is traceable or general letters.

3.
Sjónarmið Íslandspósts ohf.

Íslandspóstur ohf. therefore refuses to maintain a separate register of Icelandic stamp collectors. In the aforementioned letter of Íslandspósts ohf. states that all product shipments to Iceland are subject to customs duties according to the customs law. Íslandspóstur ohf. it is therefore appropriate that over time the employees of Íslandspóst ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing. On behalf of Íslandspósts ohf. it is specifically stated that it follows from the provisions of the Customs Act and Íslandspóst's duties as a customs broker to be alert for all shipments arriving in the country, even if they are marked as gifts or sent as ordinary letters.

II.
Conclusion

Scope of law no. 90/2018, on personal protection and processing of personal data, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic.

The complainant believes that Íslandspóstur ohf. maintain a special register of stamp collectors, including himself, for the purpose of taking all correspondence received by the complainant from abroad for customs processing. Íslandspóstur ohf. therefore refuses to maintain a separate register of stamp collectors, but accepts that over time the employees of Íslandspósts ohf. built up knowledge, which enables them to assess shipments that have the characteristics of containing value and must, according to law, be subject to customs processing.

With reference to this, there is no evidence that personal data has been processed in violation of Act no. 90/2018, cf. regulation (EU) 2016/679. In addition, Personal Protection does not consider it necessary for the organization to use additional powers, which are given to it in Act no. 90/2018, in order to investigate it further.

Ruling:

It is unproven that the processing of personal information about the complainant took place at Íslandspósti ohf. which violated law no. 90/2018, on personal protection and processing of personal information.

Privacy, October 7, 2022

Helga Sigríður Þórhallsdóttir Edda Þuríður Hauksdóttir