Object to the use of your personal data

Right of Objection

The right to object gives you the right to prevent the use or processing of your personal data for certain purposes.

Proccessing time

The organisation must respond as soon as possible and not later than 1 month after the request.

In certain circumstances, the deadline may be extended by 2 months. In this case, you must be informed:

• within 1 month of your request

• on why there is a delay

• the right to lodge a complaint with the Data Protection Authority

Right to object to the use of personal data

You can object to the processing of your personal data under certain circumstances.

Marketing

You can always object to the use of your personal data in direct marketing. This applies whether the marketing is based on legitimate interests, consent or other grounds. When you object, the company must immediately stop all processing related to the marketing.

Legitimate interests

If your personal data is processed on the basis of a company's or an organisation's "legitimate interests", you can object to this processing. However, the company may continue the processing if it can demonstrate a legitimate reason for the processing that outweighs your rights and freedoms.

Public projects

If the processing is done for the purpose of public projects or for the purpose of public authority, you can object to the processing.

Ban registration and ban labelling

Individuals may not be contacted for marketing purposes who are:

• in the National Registry's banned list

• banned in the já.is and 1819.is phone directory

It is also prohibited to call, text and email marketing if there is no business relationship between the parties.

Individuals are always entitled to protest even if there is a business relationship.

Exception

The Data Protection Authority has considered that no obligation can be imposed on the sender of a marketing material to compare it with a banned list when:

• the marketing material is directed to an employee of an enterprise, and the sender only has the name of the employee concerned.

Corporate and institutional responsibilities

The controller is the person who processes the information.

• The responsible person must check whether the person concerned has, by notification to the National Registry or by banned phone book, objected to the use of his name when marketing.

• The accountable manager may provide the registrations of members, students, employees or customers for use in direct marketing if he has given individuals the possibility to object to his name being included in the register. However, the disclosure of data must not be contrary to the articles of association or the rules of procedure that apply to the accountable manager.

Monitoring

• The Icelandic Data Protection Authority and the National Registry monitor that marketing entities respect the prohibition marking in the National Registry.

• The Icelandic Telecommunications Authority monitors that entities respect the prohibition marking (x-marking) in the telephone directory.