Persónuvernd (Iceland) - no. 2020020909
|Persónuvernd (Iceland) - no. 2020020909|
|Relevant Law:||Article 5(1) GDPR|
Article 6(1)(f) GDPR
Article 58(2)(g) GDPR
Data Protection Act no. 90/2018
|National Case Number/Name:||no. 2020020909|
|European Case Law Identifier:||n/a|
|Original Source:||Icelandic DPA (in IS)|
|Initial Contributor:||Florence D'Ath|
The Icelandic DPA ruled that a credit scoring company had violated the GDPR by assigning a credit score to an individual on the basis of information that was more than 4 years old. The Icelandic DPA therefore ordered the controller to delete the personal data in question.
English Summary[edit | edit source]
Facts[edit | edit source]
Creditinfo is an Icelandic company assigning credit scores to individuals and companies, based on verifiable information entered by creditors or third-parties in Creditinfo's default register. According to the operating license granted to Creditinfo, Creditinfo is not allowed to assign credit scores on the basis of information which is older than 4 years old.
In this context, a data subject (the Complainant) was recognized in default of payment in a judgment of the Icelandic Supreme Court following legal proceedings opposing the Complainant to a creditor, Landsbankinn hf (hereafter, the Bank). The Bank however registered this information in Creditinfo's default register only two years after the judgment was rendered. Based on this entry, Creditinfo assigned a negative credit score to the Complainant.
In January 2020, the Complainant sent an email to Creditinfo to object to the processing of his personal data, arguing that the information on the basis of which his credit score had been calculated was more than 4 years old. In parallel, he also requested Creditinfo to erase his personal data. Creditinfo however rejected this request, arguing that the information in question was still valid and relevant, as it had been registered by the Bank less than 4 years ago.
On 5 February 2020, the Complainant decided to file a complaint with the Icelandic DPA.
The dispute brought to the attention of the Icelandic DPA therefore mainly concerned the date from which the four years period provided in the operating license of Creditinfo must be calculated. On the one hand, the Complainant was arguing that this date should be the date when he had been recognized in default of payment (i.e. the date of the judgment). On the other hand, Creditinfo was arguing that this date should be the date on which the Bank registered the information in its default register.
Holding[edit | edit source]
After reviewing the facts of the case and the operating licence of Creditinfo, the Icelandic DPA considered that the processing of the Complainant's personal data by Creditinfo was unlawful. In particular, the Icelandic DPA found that Creditinfo shoulf have used the date of the judgment rendered by the supreme court as the date from which the four-year deadline starts. The fact that the Bank was late in registering the claim in the default register of Creditinfo should not put the data subject at a disadvantage. Furthermore, the Icelandic DPA noted that Creditinfo had been informed by the Complainant about this discrepancy between, on the one side, the day of the judgment, and on the other side, the date of the registration by the Bank. The Icelandic DPA further stated that, in light of the principle of fairness,s lawfulness and transparency (Article 5(1) GDPR), Creditinfo should have responded to the Complainant's comments in this respect, and base the four-year period on the date of the judgment and not the date of registration of the claim by the Bank.
For these reasons, the Icelandic DPA concluded that Creditinfo did not comply with the GDPR, and thus ordered the latter to delete the data of the Complainant and send a confirmation of such a deletion at the latest by 22 October 2021.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.