Default register and data protection
General
A default register is a register containing information about individuals’ default, for example if they have not been making their payments.
Creditinfo is the only financial information agency that has been granted permission from the Data Protection Authority to work with personal financial information.
Creditinfo's permit that came into force on 1 December 2024 (in Icelandic).
The principle
In principle, a financial information office may only put on the default register information that is considered reliable and of decisive importance in assessing the financial position and creditworthiness of a natural or legal person.
Information not to be recorded
Never record sensitive personal information, such as health or information about criminal conduct.
If there is reasonable doubt about the legality of a claim, the financial information office may not register or share information about it with its subscribers.
No information shall be recorded or disseminated on a claim if the debtor has demonstrated objection to it against the creditor, except if the debtor's objection is clearly unfounded.
Information from a default register may not be shared if a claim is no longer in default, for example if it has been paid or has been delivered by other means.
No information on how often an individual has been looked up in the records of the Financial Information Office may be shared.
Rights of the data subject
Individuals and legal entities have a variety of rights under the data protection legislation, both when it is intended to register information in a default register and also while it is kept in such a register.
It is important that individuals and legal entities receive education about their rights from the Financial Information Office, which is a prerequisite for the ability to use the rights.
Before registration
The Financial Information Office shall, among other things, provide individuals and legal entities with information about the proposed registration in the default register, and alert the person concerned of their intentions.
This includes sending a formal notice setting a time limit for the payment of the debt or agreement on payment or the right to object to registration and when such objections are taken into account by the financial information office so that registration in the default register does not result in the objections.
After registration
Individuals and legal entities have the right to receive information, including who works with the information, where it has been obtained, why and how it is handled.
Individuals and legal entities have the right to request that their information be deleted from the default register, subject to certain conditions.
When a claim is no longer in default
When it is clear that a claim is no longer in default, information about it is not allowed to be shared.
When information that has been placed on a default register is no longer reliable or no longer of decisive importance for the assessment of the financial situation or creditworthiness of the person concerned, it shall be removed from the register.
About the processing
Information on natural or legal persons may only be registered in the default register when clear rules are complied with. Generally, information may only be registered if the debtor has failed to pay, for example loans or bills, and after a warning has been given.
The processing of information in the default register is governed by rules that both Creditinfo Lánstraust hf. and subscribers to the company's systems must follow. Subscribers to Creditinfo Lánstraust hf.'s systems are, for example, credit institutions and collectors.
When to record information
Before registration, the debtor must be notified and given the opportunity to respond or pay the debt. If the debtor does not respond to the notification, he/she will be placed on the default register.
Who can record information
To be able to request a claim against an individual to be registered in a default register, a company must first have made a written subscription agreement with the Financial Information Office, i.e. be a subscriber to its systems.
Who can view information
Companies must have the authority to look up or monitor individuals on default notices, for example in connection with loan transactions or collections.
They must also keep a record of the reasons for each review. The monitoring of the identification number must end as soon as it is no longer authorised.
