The Data Protection Authority has ruled in a case where it was complained about the processing of personal data by Arion bank hf. Specifically, it was maintained that the bank had registered a complainant on the bank’s target group list without his consent, the bank had prevented the legal expiry of information on the financial affairs of the complainant by conducting regular credit ratings and other forms of financial analysis without authorization, and financial information on credit cards, self-debt guarantees and mortgage agreements had been kept for longer than necessary.

The Data Protection Authority concluded that the bank’s processing of the complainant’s personal data for market purposes was authorised in relation to the bank’s legitimate interests until the complainant objected to the processing, at which point the complainant was removed from the bank’s target group lists. The Data Protection Authority concluded that the bank’s processing of the complainant’s personal data on other financial matters had been in accordance with the provisions of the Act on Data Protection and the Processing of Personal Data.

The Data Protection Authority's ruling of 14 February 2025 (in Icelandic).