The Icelandic Medicines Agency is committed to data protection.

Controller

The Icelandic Medicines Agency is responsible for the collection and registration of personal data and for the processing of such data in the Agency’s activities. The Icelandic Medicines Agency needs to process certain personal data in order to fulfil its role and obligations under the legislation governing the Agency’s activities.

What personal data does the Icelandic Medicines Agency process?

The Icelandic Medicines Agency collects personal data on the basis of different statutory provisions. Personal data is received from individuals, healthcare professionals, supervised entities, companies, employees, job applicants and other public institutions. The Icelandic Medicines Agency emphasises that the collection of personal data should not go beyond what is necessary at any given time in order to perform the role assigned to the Agency by law.

Processing and security of data at the Icelandic Medicines Agency

A fundamental principle in the activities of the Icelandic Medicines Agency is not to retain personal data for longer than necessary in order to perform the Agency’s statutory role, unless there is an obligation under law or contract to retain the data for a longer period. The Icelandic Medicines Agency is an entity obliged to deliver records under Act No. 77/2014 on Public Archives and is therefore not permitted to delete documents that fall within the scope of that Act.

The Icelandic Medicines Agency has authorisation from the National Archives of Iceland for the electronic transfer of data from the Agency’s case management system, from 1 January 2022. The applicable rules provide that data shall be transferred electronically to the National Archives of Iceland every five years. Although the Icelandic Medicines Agency has transferred data to the National Archives of Iceland, the Agency retains full responsibility for the data until 30 years have passed from the date on which the data was created. Personal data processed by the Agency and falling within the scope of Act No. 77/2014 is therefore entirely under the control of the Icelandic Medicines Agency for 30 years.

Other information is retained by the Agency for either two years or seven years, in accordance with the Accounting Act.

Employees’ access to data depends on their field of work. Personal data is only accessible to staff of the Icelandic Medicines Agency when it is necessary for the handling of individual tasks.

Information is not disclosed to third parties unless there is a legal obligation to do so or disclosure is required by court order. Special rules apply to information concerning companies’ financial and commercial interests and companies’ scientific and technical information.

Contractors and service providers sign confidentiality declarations and only have access to data in the Agency’s systems to the extent necessary for the repair and maintenance of systems.

Confidentiality and duty of confidentiality of staff of the Icelandic Medicines Agency

Staff of the Icelandic Medicines Agency are informed of laws and rules on data protection and the security of personal data and of how laws and rules on data protection are to be followed.

All employees are bound by a duty of confidentiality under Act No. 70/1996 on the Rights and Obligations of Government Employees, and this duty continues after employment ends. When signing an employment contract, all employees sign a declaration in which the duty of confidentiality is reiterated. Contractors and service providers of the Icelandic Medicines Agency also sign confidentiality declarations. Staff of the Icelandic Medicines Agency must observe the utmost impartiality in their work at the Agency and may not undertake secondary employment that could in any way jeopardise their confidentiality in relation to their work, in accordance with the Icelandic Medicines Agency’s staff policy.

To ensure that staff of the Icelandic Medicines Agency demonstrate proper conduct in their work, both within and outside the Agency, the Icelandic Medicines Agency has adopted a Code of Conduct in accordance with the Agency’s values, which are Quality, Trust and Service.

Electronic monitoring

Monitoring is carried out for security and property protection purposes, and surveillance cameras have been installed in stairwells by the Agency’s entrances on the second and third floors of the building. In such monitoring, care is taken to respect the right to privacy of those subject to monitoring and to avoid any unnecessary intrusion into their privacy. Further information on electronic monitoring can be found here.

Publication of photographs on the Icelandic Medicines Agency’s website and social media

At all open events held by the Icelandic Medicines Agency, attendees are informed if recording is taking place and that video footage and photographs taken during the event may be published on the Agency’s website and/or social media. Requests from individuals who do not wish to appear in video recordings and/or photographs are respected.

Before photographs of staff are published on the website, social media or in published material on behalf of the Icelandic Medicines Agency, the oral consent of the person concerned is obtained. The same applies if the person appears in the background. Requests from individuals who do not wish to appear in visual material from the Agency are respected.

If an image has been published on the Agency’s social media or website without the consent of any person appearing in the image, whether in the foreground or background, and the person concerned wishes to have the image removed, that person may send a request to the Icelandic Medicines Agency at samskipti@lyfjastofnun.is.

Who has access to information held by the Icelandic Medicines Agency?

All individuals have the right to certain information concerning themselves that is registered with the Icelandic Medicines Agency.

How do I access information about myself?

Data protection legislation gives you the right to confirmation of whether the Icelandic Medicines Agency processes personal data about you and, if so, the right to access that personal data. Requests are received electronically through My Pages. It is possible to log in to the Icelandic Medicines Agency’s My Pages using Íslykill or electronic ID.

It is also possible to access one’s own personal data by completing the form: Request for access to personal data, and submitting it at the reception of the Icelandic Medicines Agency. An identity document issued by a public authority must be presented when the request is submitted. Processing of the request will not begin until identity documentation has been presented. Requests for access are not accepted by post, email or telephone. These measures are necessary because it must be ensured that personal data is only disclosed to the person to whom it relates. The Agency endeavours to provide the data within 30 days of receiving the request.

If an individual considers the information to be inaccurate or incorrect, they may request that the Agency correct it or delete it, provided that the Agency is not legally required to retain it. An individual also has the right to request information on the purposes for which the data is used, whether the data is disclosed to third parties and, if so, to whom, the origin of the data and how long the Agency intends to retain it.

In certain cases, an individual may also have the right to object to the processing of personal data and request that its processing be restricted.

Personal data breach at the Icelandic Medicines Agency

If a personal data breach occurs in relation to the processing of personal data, the Icelandic Medicines Agency shall notify the Icelandic Data Protection Authority without undue delay and, where possible, no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals. If the personal data breach is likely to result in a high risk to individuals, the Icelandic Medicines Agency shall notify the person concerned of the breach without undue delay. A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration or disclosure of personal data, or unauthorised access to such data.

Data Protection Officer of the Icelandic Medicines Agency

The Data Protection Officer of the Icelandic Medicines Agency monitors compliance with the provisions of laws and rules on data protection and the processing of personal data. The Data Protection Officer receives enquiries from individuals whose data is being processed by the Agency and provides individuals with advice on data protection. The Data Protection Officer provides staff training on data protection rules, advises staff on data protection matters when questions arise, carries out audits and resolves disputes in the field of data protection.

The Data Protection Officer of the Icelandic Medicines Agency is the contact point for the Icelandic Data Protection Authority. Enquiries should be sent to personuvernd@lyfjastofnun.is.

Supervisory authority

The Icelandic Data Protection Authority monitors the implementation of data protection legislation, regulations and special provisions in laws concerning the processing of personal data. If a dispute arises concerning the processing of personal data, a complaint may be submitted to the Icelandic Data Protection Authority by sending an email to postur@personuvernd.is. Information on the Icelandic Data Protection Authority can be found on the Authority’s website.

Cookies

The Icelandic Medicines Agency’s terms on the use of cookies

The Icelandic Medicines Agency operates the domain serlyfjaskra.is and uses cookies there. Cookies store information about the visit but do not contain personally identifiable information such as an IP address, name, email address, telephone number or national ID number. Searches in the Register of Medicinal Products are not traced to individuals.

The Icelandic Medicines Agency’s use of cookies and web analytics

The Icelandic Medicines Agency’s web analytics on the use of the Register of Medicinal Products are based on the service provided by Plausible, which does not use cookies and does not record any personally identifiable information.

On the websites of Ísland.is, including the institutional website of the Icelandic Medicines Agency, use is also measured using Plausible.

First-party and third-party cookies

First-party cookies come from the same domain as the website the user is visiting, while third-party cookies are cookies that come from domains other than the website the user is visiting. The Icelandic Medicines Agency uses various social media platforms to communicate information to users, such as Facebook, Instagram and YouTube, and users are encouraged to familiarise themselves with their terms.

Please note, however, that individuals are responsible for personal data, for example information they choose to share through the Icelandic Medicines Agency’s Facebook page and other open social media platforms.

Users can configure their browsers so that they are notified of cookies, for example so that they reject third-party cookies or reject cookies entirely. Instructions on cookie settings.

Mailing list

By subscribing to the Icelandic Medicines Agency’s mailing list, you give the Icelandic Medicines Agency your consent for the Agency to send you press releases by email to the email address provided.

The mailing list is hosted by Mailchimp. See Mailchimp’s Privacy Policy. Mailchimp has gone through a specific process and has been registered on the Privacy Shield list of the US Department of Commerce. Further information on Privacy Shield can be found on the website of the Icelandic Data Protection Authority.

The mailing list is used solely for the purpose of communicating news from the Icelandic Medicines Agency to those who have subscribed to the mailing list. Neither the mailing list itself nor the information entered by users on the mailing list will be disclosed to others. Those who subscribe to the mailing list may change their settings and/or unsubscribe from the mailing list at any time. Options for both are provided at the bottom of all emails. Data is stored in accordance with data protection legislation.