Data Protection Authority
Processing of personal data by Keldan ehf.
17th October 2025
The board of the Data Protection Authority has ruled in a case where a complaint was made about Keldan ehf.'s registration in a database of individuals at risk due to political connections.
According to the complaint, Keldan ehf. had collected personal information about the complainant's child and registered it on a so-called PEP list, but the registration was based on the complainant's position as a deputy ambassador.
The Icelandic Data Protection Authority concluded that the processing was permitted by Keldan ehf. on the basis of point 6 of Article 9 of Act No. 90/2018 and point f of Article 6(1) of Regulation (EU) 2016/679. The Icelandic Data Protection Authority also concluded that the processing had been in accordance with the principles of points 1 and 3 of Article 8(1) of the Act and points a and c of Article 5(1) of the Regulation.