Guide to Iceland’s Act on the Protection of Privacy

In this guide:

1. Key facets of Iceland’s Privacy Act
2. Establish business compliance
3. How Privacy Bee assists

Key facets of Iceland’s Act on the Protection of Privacy

The Act on the Protection of Privacy (Persónuverndarlög, commonly known as the “Privacy Act”) aims to protect individuals’ right to privacy while ensuring that personal data is processed in accordance with the fundamental rights and freedoms enumerated throughout Iceland’s legislation. This Privacy Act brings Icelandic law in line with the EU’s General Data Protection Regulation (GDPR), because Iceland is not an EU member state but is a part of the European Economic Area (EEA) and sought to regulate more seamless data transfers within the region.

Created as a response to the growing concerns about the collection, processing, and storage of personal data in an increasingly digital world, the Privacy Act was a milestone in Iceland’s legal landscape, reflecting the country’s commitment to protecting the privacy of its residents and visitors. This legislative development was influenced by global discussions on data protection and privacy rights, particularly in the context of emerging technologies and the internet.

The legal copy within the Privacy Act defines personal data broadly, encompassing any information that relates to an identified or identifiable individual. This includes but is not limited to names, addresses, identification numbers, and even IP addresses. The expansive definition is in line with the Act’s intention to cover a wide range of data types to ensure comprehensive protection.

To deliver on this intention, the Privacy Act includes the following core principles of data processing:

• Lawfulness, Fairness, and Transparency: Data processing must be lawful, fair, and transparent. This principle requires that individuals are informed about the processing of their data, and processing activities must have a legal basis, such as consent or compliance with a legal obligation.
• Purpose Limitation: Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. This principle ensures that data is not used for purposes beyond what was initially communicated to the data subject.
• Data Minimization: Data controllers should only collect and process the data necessary for the intended purposes. Unnecessary or excessive data collection is discouraged to minimize the risk of unauthorized access or misuse.
• Accuracy: Personal data must be accurate, and reasonable steps should be taken to ensure that inaccurate data is rectified or erased promptly. This principle emphasizes the importance of maintaining the integrity of a person’s data.
• Storage Limitation: Data should be kept in a form that permits identification of individuals for no longer than is necessary for the purposes for which it is processed. This principle aims to prevent the indefinite retention of personal data.
• Integrity and Confidentiality: Data controllers and processors are required to implement appropriate technical and organizational measures to ensure the security of personal data. This includes protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.

While defining what businesses can and can’t do in regards to data collection and processing, Iceland’s Privacy Act grants individuals the power to assert greater control over their own personal data. These rights are the critical piece of the regulation allowing consumers to compel organizations to comply with their requests.

The specific enumerated rights granted to individuals are as follows:

• Right to Information: Individuals have the right to know whether their data is being processed, for what purpose, and by whom. This transparency enables individuals to make informed decisions about their data.
• Right of Access: Data subjects have the right to obtain confirmation about whether their personal data is being processed and, if so, access to that data. This allows individuals to verify the accuracy and lawfulness of the processing.
• Right to Rectification: If personal data is inaccurate or incomplete, individuals have the right to request its rectification. Data controllers must respond to such requests promptly.
• Right to Erasure (Right to be Forgotten): Individuals have the right to request the deletion of their personal data under specific circumstances, such as when the data is no longer necessary for the purposes for which it was collected or if consent is withdrawn.
• Right to Restriction of Processing: Data subjects can request the restriction of processing in certain situations, such as when they contest the accuracy of the data or when processing is unlawful, but the individual opposes erasure.
• Right to Data Portability: This right enables individuals to receive their personal data in a structured, commonly used, and machine-readable format, allowing them to transmit the data to another data controller.
• Right to Object: Data subjects have the right to object to the processing of their personal data, including processing for direct marketing purposes. The data controller must cease processing unless they can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject.
• Right to Avoid Automated Decision-Making (Including Profiling): The Act addresses situations where decisions are made solely based on automated processing, including profiling. In such cases, individuals have the right not to be subject to decisions that significantly affect them without human intervention.

Iceland’s Privacy Act empowers individuals by providing them with rights and protections concerning their personal data. It seeks to ensure that individuals are informed, in control, and have avenues for redress in the event of privacy violations, contributing to a more privacy-conscious and rights-oriented digital environment. For businesses looking to ensure compliance with the Privacy Act, there are numerous obligations created that must be considered.

Source: Government of Iceland website

Establish business compliance

Businesses operating in Iceland or marketing to Iceland consumers must adhere to the comprehensive set of obligations outlined in the Privacy Act to ensure the lawful, fair, and secure processing of personal data. Compliance with these obligations not only safeguards individuals’ privacy rights but also helps businesses build trust and maintain ethical data practices in the digital age.

Organizations not only need to consider the principles above, but also consider the lawful bases for data processing. These bases include:

1. Consent: Processing may be based on the data subject’s consent, which should be freely given, specific, informed, and unambiguous. Consent must be easy to withdraw at any time.
2. Legal Obligation: Processing may be necessary for compliance with a legal obligation to which the data controller is subject. If the processing is necessary for the performance of a contract with the data subject or for taking pre-contractual steps at the data subject’s request, it is considered lawful.
3. Vital Interests: Processing may be necessary to protect the vital interests of the data subject or another natural person.
4. Legitimate Interests: The legitimate interests pursued by the data controller or a third party may serve as a lawful basis for processing, provided that they do not override the interests or fundamental rights and freedoms of the data subject.

Data transfers outside of the EEA are restricted by Icelandic law to ensure adequate safeguards are in place. Transfers to countries without an adequacy decision must rely on appropriate safeguards, such as standard contractual clauses or binding corporate rules. It’s also worth noting the organizations of a certain size are required to appoint a Data Protection Officer (DPO) to ensure compliance with the Privacy Act. The DPO acts as a point of contact for data subjects and the Icelandic Data Protection Authority (DPA) and monitors the organization’s compliance with data protection laws.

The Data Protection Authority (DPA) is responsible for enforcing the Privacy Act. The DPA has the authority to investigate complaints, perform audits, and issue fines for non-compliance. Fines can be substantial, underscoring the importance of adhering to the principles and requirements outlined in the Act.

Here are some key pieces of advice for businesses to achieve and maintain compliance:

• Understand the Applicability of the Act: Begin by thoroughly understanding the scope and applicability of the Privacy Act. Determine whether your business processes personal data and, if so, identify the lawful basis for such processing. This foundational understanding is essential for establishing a compliance framework.
• Conduct a Data Inventory and Assessment: Conduct a comprehensive inventory of the personal data your business processes. Perform a data protection impact assessment (DPIA) to identify and mitigate potential risks to individuals’ rights and freedoms. This will help in implementing appropriate safeguards.
• Implement Privacy by Design and Default: Integrate privacy considerations into your business processes from the outset. Ensure that data protection measures are part of the design and default settings of your systems and services. This proactive approach aligns with the Privacy by Design principle.
• Establish Data Protection Policies and Procedures: Develop and implement clear data protection policies and procedures that align with the principles of the Privacy Act. These documents should cover data processing activities, data security measures, data retention policies, and procedures for handling data subject rights requests.
• Train Employees on Data Protection: Provide comprehensive training to employees who handle personal data. Ensure that they understand the principles of data protection, their roles in compliance, and the procedures for responding to data subject requests or potential breaches.
• Establish Data Security Measures: Implement robust security measures to protect personal data from unauthorized access, disclosure, alteration, or destruction. This includes encryption, access controls, regular security assessments, and monitoring of data processing activities.
• Monitor and Audit Compliance: Regularly monitor and audit your data processing activities to ensure ongoing compliance with the Privacy Act. This proactive approach helps identify and address potential issues before they escalate.
• Respond Promptly to Data Subject Requests: Establish processes to respond promptly to data subject requests, including requests for access, rectification, erasure, or data portability. Clearly communicate the procedures for exercising these rights to data subjects.
• Implement a Data Breach Response Plan: Develop and implement a response plan to address potential security incidents swiftly and effectively. This plan should include procedures for notifying the Icelandic Data Protection Authority (DPA) and affected individuals, when necessary.
• Review and Update Privacy Policies: Regularly review and update your privacy policies to ensure they accurately reflect your data processing practices and comply with any changes in the Privacy Act or relevant regulations.
• Stay Informed About Regulatory Changes: Keep abreast of changes to data protection laws and regulations. The privacy landscape is dynamic, and staying informed about legal developments ensures that your business remains compliant with the latest requirements.
• Document Compliance Efforts: Maintain thorough documentation of your compliance efforts, including policies, procedures, risk assessments, and employee training records. This documentation serves as evidence of your commitment to data protection compliance.
• Seek Legal Advice: If in doubt about specific legal requirements or interpretations, seek legal advice from professionals with expertise in data protection laws. Legal guidance can provide clarity and help ensure accurate compliance.

Iceland’s Privacy Act serves as a robust framework for safeguarding individuals’ privacy rights in an era of rapid technological advancement. Its principles and provisions reflect a commitment to transparency, fairness, and accountability in the processing of personal data. Individuals, businesses, and organizations operating in Iceland must familiarize themselves with the law’s requirements to ensure the ethical handling of personal information. As technology continues to evolve, the Privacy Act is likely to adapt to new challenges, reinforcing Iceland’s dedication to protecting the fundamental right to privacy.

How Privacy Bee assists

The safeguarding of personal data and transparent disclosures of data utilization are essential for businesses involved in online service provision in Germany today. Globally, new regulations are emerging constantly to necessitate more rigorous opt-in and opt-out protocols while affording consumers greater authority to scrutinize, modify and delete their data.

Despite the proliferation of these regulations, the primary responsibility still rests on individuals to supervise, evaluate, and request the deletion of their personal data dispersed across the internet. Managing this task across an entire operation is particularly challenging, often requiring professional assistance as it is a herculean effort for a single person or a small team. However, identifying and eliminating this data is crucial in deterring cyber threats, reducing a company’s attack surface, and mitigating the risk of a data breach.

Enter Privacy Bee as the optimal solution complementing existing cybersecurity best practices by streamlining the laborious process of monitoring and eradicating employee personal data for the entire business.

Privacy Bee not only diminishes the spread of your organization’s personal data across the expansive digital landscape but also extends its protective shield to vendors. This helps ensure that third-party partners do not become weak links in your security defenses. Even if you are already conducting risk assessments and vendor surveys, it’s essential to acknowledge that vendors are most vulnerable to breaches due to inadequate data privacy management.

In the billion-dollar surveillance industry, Data Brokers and People Search Sites play pivotal roles, profiting by trading your organization’s information with obscure entities. The consequences of private data exposure on the internet are extensive and pose significant threats when accessed by malicious hackers. Especially for highly-visible executives, the risks of doxxing and social engineering attacks is simply too high.

A single data breach can result in productivity loss, expensive remediation efforts, and recurring breach incidents. The aftermath not only affects your bottom line but also erodes brand value and customer trust over time. Privacy Bee proactively combats threats beyond your organization’s perimeters by pinpointing and swiftly purging every corner of the internet where your data resides. The service includes dark web monitoring and provides timely data breach notifications if another company falls victim, potentially exposing your information.

In our unwavering commitment, we firmly believe that privacy is an inherent human right transcending political discussions. Privacy Bee diligently monitors user data for security vulnerabilities while holding the companies misusing and abusing your data accountable. We compel Data Brokers, People Search Sites, and over 150,000 additional websites to erase stored data and opt you and your employees of further data collection.

Privacy Bee protection covers a wide range of potential threats, including:

• Data breaches
• Social engineering attacks
• Doxxing
• Identity theft
• Spam emails
• Telemarketing calls
• Cyberstalking
• Swatting
• Blackmail

Our service is a powerful tool for business leaders who want to protect their employees’ and customers’ data. In today’s world, where privacy is more important than ever, Privacy Bee is your trusted partner in the fight to preserve personal and organizational integrity.