Data Protection Commissioner's Office

Helga Þórisdóttir, Data Protection Commissioner

There was a lot to do at the Data Protection Agency in 2024, as in previous years. The Agency’s attention is on the processing of personal data in Iceland, but at the same time international cooperation is of great importance, as the legislation is the same here as in Europe, and therefore it is important to monitor the implementation of cases in the countries around us.

Insurance companies consider data protection and Creditinfo operation licence

From the handling of larger cases, it is enjoyable to point out that the largest Icelandic insurance companies, which make automated decisions on applications and requests for offers of life and health insurance, mostly meet the requirements that the data protection legislation makes in this regard. Insurance companies handle a large amount of personal information and therefore it is important that they are aware of the rules that apply here. A new authorization was issued for Creditinfo Lánstraust hf., while the Ministry of Justice pointed out that the legal environment for financial information offices in Iceland may need to be given greater attention.

Children's privacy - online gaming

The protection of children's privacy has, in recent years, gained great importance in the Agency's work, as information about children enjoy special protection. With thisin mind, the Data Protection Authority published guidelines on the protection of children's privacy when playing games online, which were prepared in cooperation with other Nordic data protection authorities. Companies have been conducting highly sensitive reviews of children's behaviour in such games. Such information can be used for a variety of purposes and even sold to unrelated parties.

Court cases – Seesaw and Íslensk erfðagreining (e. deCODE GENETICS)

During the year, the Data Protection Authority’s decision on the processing of personal data in the Seesaw Student System operated by the City of Reykjavík was partially upheld by the Supreme Court. The municipality's various violations against the data protection legislation were confirmed, but comments were also made about the Data Protection Authority's proceedings in the case, which led to the court finding that there was not sufficient reason to impose a fine on the City of Reykjavík. Then, a judicial panel in Landsréttur, Appeal Court, ruled in favour of the Data Protection Authority against Íslensk erfðagreining (e. deCODE GENETICS) regarding a scientific study that the company performed during the Covid epidemic. The company has appealed that decision to the Supreme Court. The Data Protection Authority welcomes more judgments from the country's courts, which give precedents regarding the interpretation and application of the data protection legislation.

Artificial intelligence can be beneficial, but it needs to be carefully monitored

2024 marked a turning point in the development of digital technology and the application of artificial intelligence. Never before have technological advances had such a profound impact on people’s daily lives, work practices and services, practically all over the world. The European Data Protection Board has issued an opinion on certain issues related to the use of personal data in the interests of artificial intelligence and further guidance is expected from the Board in the coming months. Artificial intelligence can be beneficial, but it needs to be handled with care. It has never been more important to ensure that technological development do not infringe on the rights of individuals. We at the Data Protection Authority are standing guard, but society as a whole needs to make sure that the introduction of artificial intelligence in all activities in the country is well thought out.