View source for Persónuvernd (Iceland) - Case no. 2021061304

=== Holding ===
The DPA first asserted that the data subject would only have the right to access their own personal data. Consequently, they would only have the right to access the repair history of the car while it was in the possession of the data subject, but no right to receive any information about services done on the car while it was in the possession of previous owners.

Next, the DPA noted that that [[Article 15 GDPR|Article 15 GDPR]] stipulates that a data subject shall have the right to receive confirmation from a controller as to whether personal data concerning him or her is being processed and, if so, has the right to access personal data. Moreover, the controller must provide a copy of the personal data that is being processed. If the data subject submits a request electronically, the information must be provided in an electronic format that is generally used unless the data subject requests otherwise. Additionally, [[Article 12 GDPR]] demands that controllers shall facilitate data subjects to exercise their rights.

Regarding the first argument of the controller, the DPA explained that when an attorney is given the power to act on behalf of a principal, their actions are to be considered equivalent to those of the principal. Therefore, no further action would have been required from the data subject in this case. Moreover, if the controller would have deemed the powers of the attorney to be insufficient, it should have instructed the data subject on who to meet the formal requirements in order to submit an access request instead of refusing it. 

Concerning the second argument, the DPA reiterated that controllers are required to provide answers to access requests in a commonly used electronic format, unless requested otherwise. Therefore, only providing it in the form of paper is insufficient.

Considering the above, the DPA held that the controller acted in violation of the GDPR. It ordered the controller pursuant to its powers of [[Article 58 GDPR#2c|Article 58(2)(c) GDPR]] to comply with the access request.