In the case, the complainant had requested a meeting with the Prime Minister. In his request to the Prime Minister's Office, the complainant stated that the matter concerned the then Minister of Education and Children's Affairs and that it would be fine for the relevant minister to also attend the meeting if the Prime Minister so requested. From the available evidence, there was no other conclusion than that the Prime Minister's Office had shared the complainant's personal information with the Minister of Education and Children's Affairs for the purpose of preparing a response to the complainant's request for a meeting and assessing the correct course of the case.

The Data Protection Authority concluded that the Prime Minister's Office's sharing of information about the complainant with the Minister of Education and Children's Affairs had been necessary in the exercise of official authority exercised by the Prime Minister's Office. The processing of the personal information was therefore permitted on the basis of point 5 of Article 9 of Act No. 90/2018, cf. point e of the first paragraph of Article 6 in Regulation (EU) 2016/679, but in the opinion of the Data Protection Authority, the authorities must be granted a certain margin of discretion to assess what processing is necessary to carry out their statutory tasks. The Data Protection Authority also concluded that the Prime Minister's Office's sharing of the complainant's personal data had been in accordance with the principles of points 1 and 3 of Article 8, paragraph 1 of the Act, cf. points a and c of Article 5, paragraph 1 of the Regulation.

The ruling (in Icelandic)