Persónuvernd (Island) - 2021051199

Persónuvernd - 2021051199
[[File:\|center\|250px]]
Authority:	Persónuvernd (Island)
Jurisdiction:	Iceland
Relevant Law:	Article 14 GDPR Article 6(1)(e) GDPR Article 9(2) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2021051199
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Icelandic
Original Source:	Vinnsla persónuupplýsinga af hálfu Sýslumannsins á höfuðborgarsvæðinu og ríkislögreglustjóra (in IS)
Initial Contributor:	Sophia Hassel

The Icelandic DPA held that the sharing of a data subject’s entire case file in legal proceedings by both the Director of the National Police and Local Sheriff did not infringe the GDPR.

English Summary

Facts

The Local Sherriff asked the Director of National Police (LÖKE) for information about data subject with the Local Sheriff without delimiting the request and therefore received a case file in its entirety, for about 20 years back. This data was subsequently taken into account by a local magistrate for a visitation case which involved the data subject. In addition, the Local Sherriff shared the case file with the opposing litigious team. The data subject's lawyer filed a complaint with the Icelandic DPA, stating that the data subject was not told about the sort of data involved when signing their consent and that the Local Sheriff should have limited their request.

Holding

The data contained in the file was held to be sensitive health data under Article 9(2) GDPR as the case file contained information about incidents related to illness or accidents.

The sheriff was held to have not breached the GDPR. The processing of the case file was lawful under Article 6(1)(e) GDPR as it was necessary for the exercise of official authority. The director did not have to inform the data subject under Article 14(5)(c) GDPR because the law clearly prescribed the acquisition or dissemination of the information. Furthermore, the sheriff sent a copy of the police request for the case file to the data subject’s address. Under Icelandic administrative law and the Icelandic Children’s Act, the sheriff was permitted to send the case file to the opposing party.

The director was held to have not breached the GDPR. Under Icelandic national law he was permitted to share personal information that has been collected for law enforcement purposes. While the director should not make an assessment of which data would be necessary to hand over, it was noted that in this case the case file provided contained limited information. The director did not have to inform the data subject under the exemption carved out by the Icelandic GDPR (Article 19 of 90/2018) which states that Article 14 GDPR does not apply when an administrative authority communicates personal information to another administrative authority in the interests of a statutory role in the implementation of laws.

The magistrate did not have to revise the case as under Icelandic national law, nevertheless, the DPA reminded that the magistrate must observe all the rules of the administrative law such as the principle of proportionality.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Processing of personal information by the Metropolitan Sheriff and the National Police Commissioner

Case no. 2021051199

10.7.2023

The government may not work with information about the criminal conduct of individuals unless it is necessary in the interest of their statutory tasks. According to the Children's Act, all parties that the magistrate seeks to provide him with a copy of the documents that the magistrate deems necessary for the resolution of the case. In this case, the sheriff had deemed it necessary to obtain information from the complainant's case file at the police in connection with the investigation of a case concerning the visitation of a child, and the national police chief had handed over the complainant's case file in its entirety to the sheriff.

----

Personal data protection ruled in a case where a complaint was made about the processing of personal information in connection with the proceedings of the Sheriff in the capital area in the case of the complainant's access to the office. More specifically, a complaint was made about the office's processing of information about the complainant in the case file system of the National Police Commissioner (LÖKE) and the further processing of the information by the office, as well as the communication by the National Police Commissioner of the complainant's case file from LÖKE to the Sheriff in the capital area.

The conclusion of the Personal Protection Authority was that the processing of personal information by the Sheriff in the capital area was in accordance with the provisions of the Act on Personal Protection and Processing of Personal Information. The sharing of personal information by the National Police also complied with the provisions of the Act on Personal Protection and Processing of Personal Information.

Ruling

about a complaint about the processing of personal information by the Sheriff in the capital area and the National Police Commissioner in case no. 2021051199:

i
Procedure
1.
Outline of a case

On May 26, 2021, Personal Protection received a complaint from [B] attorney f.h. [A] (hereinafter the complainant) regarding the processing of personal information in connection with the proceedings of the Sheriff in the capital area in the complainant's visitation case at the office. The complaint concerns, on the one hand, the office's processing of obtaining information about the complainant from the case file system of the National Police Commissioner (hereafter LÖKE) and the further processing of that information by the office, and on the other hand, the communication by the National Police Commissioner of the complainant's case file from LÖKE to the Sheriff in the capital area.

Personal protection invited the Sheriff of the capital region and the National Police Commissioner to comment on the complaint by letter, dated 23 March 2022, and the responses of the National Police Commissioner were received on 29 April s.á. and the commissioner's answers on 19 May s.á. The complainant was then given the opportunity to express comments on the responses of the commissioner and the national police chief by letter, dated 3 June 2022, and they were received by email on 23 July 2022. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

The processing of the case has been delayed due to the heavy workload at Personal Protection.

2.
Complainant's point of view

With regard to the processing of personal information by the Sheriff in the capital area, the complaint relates to the fact that the complainant was made to sign consent for information to be obtained from the police case file. However, he was not informed about the type of data involved or what rules applied to their handling. There is also a complaint that the Sheriff requested information about the complainant from LÖKE from the National Police Commissioner without defining the request and therefore received all information from the complainant's case file in its entirety, or about 30 years back. It is pointed out that in the case file there are numerous examples of cases that did not concern the visitation issue in any way. Then it covers all cases, regardless of whether it is a case that has been prosecuted, canceled or an incident reported by the complainant himself. The complainant is based on the fact that it will not be seen how an incident that happened in his life up to 17 years before the birth of his child can have significance in his case regarding contact with the child at the magistrate's office. The complainant also refers to the fact that the sheriff's office handed over the complainant's case file from LÖKE to the other party's lawyers, or the other party himself. The parties to a case in visitation cases will thus receive detailed information about all cases where the ex-spouse has come to the attention of the police decades back. There is a risk that the litigants will misuse the information obtained during the magistrate's proceedings, i.a. in visitation or custody matters.

With regard to the part of the complaint that concerns the transmission of the complainant's case file to the Sheriff in the capital region, the complaint is that the case file was handed over in its entirety, without comments by the National Police Commissioner, without an assessment of what was considered the necessary data.

3.
The Sheriff's perspective on the capital area

On the part of the Sheriff in the capital area, it is based on the fact that the office has requested data from the National Police Commissioner on the basis of paragraph 1. Article 72 Children's Act no. 76/2003. The provision states that the parties to a case must obtain the data that the magistrate deems necessary for the resolution of the case and that the magistrate can obtain data on his own initiative if necessary, cf. Article 10 administrative law no. 37/1993. It is pointed out that the magistrate has a strong investigative duty and he assesses on his own initiative what data and information he deems necessary to obtain when processing a case. In the provision, there is no limitation on what kind of data the commissioner is authorized to collect on its basis. Reference is also made to the fact that the provisions of Article 72 the Children's Act has been amended by Act no. 61/2012 and in the comments with the provision in the bill says that it is decided that the commissioner has the right to access all the data about the parties and their children that he considers necessary for the resolution of the case with regard to the interests of the child. Furthermore, it is based on the fact that the magistrate must make decisions based on what is in the child's best interests and that it is in the child's best interests that the magistrate can investigate the case as well as possible before making a decision in the child's case. Then it depends on the nature of the entries from the case file how far back in time they will be considered to be relevant. In the case of the complainant, it was clear that there was a need for a detailed investigation by the magistrate before a decision would be made, i.a. due to information that had emerged at earlier stages of the case.

Regarding the delivery of case documents, it is pointed out that both parents of a child are parties to a case before the magistrate and according to Article 75 children's law and 15.-19. art. administrative law right to get access to the records of the case, with narrow exceptions. Otherwise, the party to the case cannot use their right to object and inform about the case from their side. In the commissioner's reply, it is stated that no request was received from the mother for the delivery of these documents and therefore they were not delivered to her.

4.
The Inspector General's point of view

It is based on the fact that the Commissioner of National Police's communication of the complainant's case file to the commissioner was based on Article 72. Children's Act no. 76/2003. According to paragraph 3 of the provision, everyone whom the magistrate asks to provide him with a copy of the documents he deems necessary for the resolution of the case, free of charge. In the comments with the provision in the bill, it is emphasized that this is a copy of data that is already available, but the provision does not include the obligation of others to assess cases separately or prepare new data. With reference to those comments, the Commissioner of National Police points out that it is difficult to see how it is compatible with the provision that the Commissioner of National Police evaluates what data is necessary for the commissioner. Since the Commissioner of National Police does not have case documents or reasons for the case, and there are no grounds for the cases being processed by the Commissioner, the office is in no position to assess whether certain cases or a certain type of case should be removed from the case file overview. The same applies to the office's criteria for assessing how far back the information should go. In general, the magistrate requests an overview of all cases of an individual due to a case being processed by the office in order to be able to assess whether further data is deemed necessary and, if so, to request it separately. The Director of National Police has therefore made it a basis not to delete information that could possibly be relevant for the handling of a case by the magistrate. In the response letter of the Commissioner of the National Police, it is pointed out that the procedure used today is generally such that the Commissioner limits his request to a certain period of time and the Commissioner of the National Police fully depends on the Commissioner's judgment in that regard, as long as it is only the Commissioner who is in a position to assess what information is necessary for him.

II.
Assumptions and conclusion
1.
Legal environment

This case concerns the collection, processing and sharing of personal information about the complainant. It concerns the processing of personal data that falls under the authority of the Personal Protection Agency. The sheriff in the capital region is considered to be the party responsible for the processing that involved obtaining information about the complainant from the National Police Commissioner and their further processing when processing a case at the office. The Commissioner of the National Police is considered to be the party responsible for the processing that involved communicating personal information about the complainant to the Sheriff in the capital area at the latter's request, cf. law no. 90/2018, on personal protection and processing of personal data, and Regulation (EU) 2016/679.

All processing of personal information must be covered by one of the authorized provisions of Article 9. Act no. 90/2018, cf. Article 6 of regulation (EU) 2016/679. One can mention that personal data can be processed if the processing is based on the data subject's consent, cf. Number 1. of the law and point a of the regulatory provision. Governments, however, cannot generally base their authorization for the processing of personal data on consent when they act within their powers, as there is then an imbalance of power between the controller and the data subject, and therefore cannot guarantee that consent is given voluntarily.

It will therefore not be considered that the consent that was signed by the complainant to the commissioner for information gathering was proper consent within the meaning of the Personal Protection Act, which fulfills the requirements set out in the law, and therefore it cannot be accepted that it was possible to support the processing in question personal information at that source. However, personal data may be processed if it is necessary to fulfill a legal obligation on the responsible party, cf. Number 3. of the legal provision and point c of the 1st paragraph of the regulatory clause, or if it is necessary due to work carried out in the public interest or in the exercise of official authority exercised by the responsible party, cf. Number 5. of the legal provision and section e of the regulatory provision.

In addition, the processing of sensitive personal data must be compatible with one of the additional conditions of paragraph 1. Article 11 of the law, cf. Paragraph 2 Article 9 of the regulation. According to point b of 3. no. Article 3 of the law is considered health information, i.e. personal information concerning a person's physical or mental health is sensitive, but a complaint will determine that the complainant's case file contains information about incidents related to illness or accidents. As is the case here, item 6 comes into consideration in particular. Paragraph 1 Article 11, to the effect that the processing of sensitive personal information is permitted if it is necessary to establish, establish or defend legal claims, cf. point f, paragraph 2 Article 9 of the regulation.

In paragraph 1 Article 12 Act no. 90/2018 stipulates that the government may not work with information about the criminal conduct of individuals unless it is necessary for the benefit of their statutory tasks. Then in the 2nd paragraph provided that the information according to paragraph 1. may not be communicated unless one of the four conditions specified in the provision is met. More specifically, the information may not be shared unless the registered person has given their unequivocal consent to the sharing, cf. Number 1. Paragraph 2 Article 12, the sharing is necessary in the interests of the legitimate interests of the public or private sector which clearly outweigh the interests of the secrecy of the information, including the interests of the data subject, cf. Subsection 2, the communication is necessary for the benefit of the statutory tasks of the relevant government authority or in order to be able to make an administrative decision, cf. Section 3, or the sharing is necessary for legitimate interests that clearly outweigh the fundamental rights and freedoms of the data subject, cf. Number 4.

In addition to authorization according to the above, the processing of personal data must be compatible with all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Article 5 of regulation (EU) 2016/679. The principles stipulate, among other things, that personal data must be processed in a lawful, fair and transparent manner towards the data subject, cf. Number 1. of the legal provision and point a of the regulatory provision, and that they must be sufficient, appropriate and not beyond what is necessary based on the purpose of the processing, cf. Number 3. of the legal provision and point c of the regulatory provision.

When evaluating authorization for processing, provisions in other laws that are applicable in each case must also be taken into account. In paragraph 1 Article 72 Children's Act, no. 76/2003, states that the parties to a case must obtain the documents that the magistrate deems necessary to resolve the case and that the magistrate can obtain documents on his own initiative if necessary, cf. Article 10 administrative law no. 37/1993. The provisions of Article 72 was changed by law no. 61/2012 and in the comments to the provision in the bill that became the law, it is stated that the commissioner has the right to access all the data about the parties and their children that he considers necessary for the resolution of the case with regard to the interests of the child . It is considered necessary to guarantee the commissioner access to more data than was provided for in the applicable law. Then it says in the 3rd paragraph of the provision that all persons to whom the magistrate consults must be provided free of charge with a copy of the documents he deems necessary for the resolution of the case. In the comments in the bill that became the law, it is emphasized that this is a copy of data that is already available, but the provision does not include the obligation of others to assess cases separately or prepare new data.

2.
Lawfulness of processing
2.1 Processing of personal information by the Sheriff in the capital area

According to the Children's Act no. 76/2003, cf. above, it is clear that the commissioner has a strong investigative duty when it comes to processing cases at the office, but the processing in question here concerns the interests of a child. It is also clear that personal data may be processed if it is necessary for the exercise of official authority exercised by the controller, cf. Number 5. Article 9 Act no. 90/2018 and point e of paragraph 1 Article 6 of regulation (EU) 2016/679. The authorities are also permitted to work with information about criminal conduct if it is necessary for the benefit of their statutory tasks, cf. Number 3. Paragraph 2 Article 12 Act no. 90/2018.

The obligation to provide information, transparency and the data subject's right to information is discussed in Article 17. Act no. 90/2018. According to number 2 of the provision, the registered person has the right to information about processing, whether personal information is obtained from him or not, according to instructions 13.-15. art. of regulation (EU) 2016/679. When personal information is obtained from someone other than the registered person himself, he must generally be provided with education in accordance with Article 14. of the regulation. However, this educational obligation does not apply if the law clearly prescribes the acquisition or dissemination of the information, cf. c.-item 5. paragraph Article 14 of the regulation. Of the general transparency requirement, item 1. Paragraph 1 Article 8 Act no. 90/2018, cf. also point a of paragraph 1 Article 5 Regulation (EU) 2016/679, however, may result in the need to provide information about processing in the cases covered by Articles 13 and 14. of the regulation is omitted. As stated in section 60 of the preamble of the regulation, the principle in question includes a requirement that the data subject be notified that a processing operation is in progress and what its purpose is. It is also referred to that the responsible party should provide the data subject with additional information necessary to ensure fairness and transparency in the processing of personal data, taking into account the specific circumstances and context of their processing. Although the complainant's consent was not required for the processing of personal information by the sheriff's office, cf. previous discussion, in the opinion of the Data Protection Authority, it must be considered that the complainant was informed about the planned acquisition of data and its processing so that it was compatible with the requirement of fairness and transparency, item 1. Article 8 Act no. 90/2018, cf. Article 14 of regulation (EU) 2016/679.

From the available data in the case, it must be determined that in a form signed by the complainant at the magistrate's office and entitled "Consent for the collection of information", it must be stated that information will be collected from certain parties for the purpose of processing a review regarding visitation matters, i.a. information from the National Police Commissioner from the police case file. As mentioned earlier, in the opinion of the Personal Protection Authority, this is not a case of actual consent for the processing of information, but rather it will be considered that this is actually a case of educating the complainant about the planned collection of information. Despite the fact that the title of the form is contradictory, all that can be seen is that it states what data will be collected about the complainant and for what purpose. Personal protection directs the recommendation to the sheriff's office to review the name of the form in light of the above.

The principle of proportionality, item 3, then comes into consideration. Paragraph 1 Article 8 Act no. 90/2018. The complaint is that an overview of the complainant's case file was obtained in its entirety without the request being further defined, such as by type of case or time period. It is clear that Article 72 Children's Act no. 76/2003 contains a broad authority for the commissioner to call for documents if he deems it necessary to resolve a case. Nevertheless, when resolving a case, the magistrate must observe all the rules of the administrative law, i.e. on m. proportionate. According to the authorized authority of the commissioner according to Article 72. Children's Act and case files otherwise, it is the opinion of the Personal Protection Authority that, as is the case here, there is no reason to revise the assessment of the Metropolitan District Magistrate that it was necessary to request an overview of all cases where the complainant was registered in LÖKE.

In light of the above, the Personal Protection Authority considers that the processing of personal information about the complainant by the Sheriff in Reykjavík, which is the subject of this complaint, has been based on authorization according to section 5. Article 9 and paragraph 1 Article 12 Act no. 90/2018. Then it will not be seen that the basic requirements of paragraph 1 have been violated. Article 8 of the same law, nor other provisions of the law, and the processing is therefore considered to have been in accordance with them.

2.2 Processing of personal information by the National Police Commissioner

In the case that is being resolved here, it is known that the Director of National Police handed over to the Sheriff in the capital area a copy of an overview of all cases in which the complainant was registered in LÖKE. The overview shows the case number, a brief description of what the offense or incident was about, the relationship between the parties to the case, the status of the case in the LÖKE, the status of the case in the prosecution's case file if it went to prosecution, the date of the case, the date of the alleged offense or incident, the venue and which office the case is in was last treated.

According to paragraphs 1 and 3 Article 72 Children's Act, no. 76/2006, the Commissioner of National Police must provide the magistrate with a copy of the documents that the magistrate deems necessary for the resolution of the case. It is clear that the provision contains a broad authority for the commissioner to demand information and documents. With reference to the fact that it was a specific case that was being processed by the Sheriff in the capital area, there was a legal obligation on the Director of National Police to hand over documents to the office in accordance with the relevant request. The assessment of which data would be necessary to hand over rested with the commissioner, but in the opinion of the Data Protection Authority, that duty will not be placed on the National Police Commissioner, as the National Police Commissioner does not have the grounds to carry out such an assessment. It is also to be considered that only an overview of the complainant's social security number from the case file was provided, which contained limited information, but the magistrate must specifically request specific entries if he deems it necessary for the processing of the case.

As stated in section II.2. the duty of education, transparency and the right of the registered person to information are discussed in Article 17. Act no. 90/2018. According to number 2 of the provision, the registered person has the right to information about processing, whether personal information is obtained from him or not, according to instructions 13.-15. art. of regulation (EU) 2016/679. When personal information is obtained from someone other than the registered person, he must generally be given education in accordance with Article 14. of the regulation. Thus, the responsible party, which intends to process personal data for a purpose other than that which was behind its collection, must provide the data subject with information about the new purpose, among other things, before the processing begins, cf. Paragraph 4 Article 14 of the regulation. In Article 19 Act no. 90/2018, however, states the exception that the disclosure obligation according to Article 4. Article 14 of the regulation does not apply when a public authority communicates personal information to another public authority in the interest of a statutory role in the implementation of laws and the information is shared only to the extent necessary to fulfill the legal obligation of the public authority.

In view of the above, it is the conclusion of Personal Protection that the delivery by the Commissioner of the National Police of an overview of all cases where the complainant was registered in LÖKE to the Sheriff in the capital area was in accordance with Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679.

Ruling:

The Sheriff's processing of personal information about [A] in the capital area was in accordance with the provisions of Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679, on processing authorization, transparency and proportionality in the processing of personal data.

The National Police Commissioner's sharing of personal information about [A] was in accordance with the provisions of Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679, on processing authorization, transparency and proportionality in the processing of personal data.

Privacy, 10 July 2023

Helga Sigríður Þórhallsdóttir Edda Þuríður Hauksdóttir