Digital Iceland Data Protection Policy

This privacy policy aims to provide a comprehensive overview of the processing of personal data that takes place on Ísland.is and the Ísland.is the Ísland.is app, and it includes information on ensuring it complies with laws and regulations.

Thus, the policy covers all processing of personal data on the website Ísland.is and the Ísland.is app and everyone who visits the website or uses the Ísland.is app. To complement this policy, reference is made to the privacy policy of the Government of Iceland, which is available in Icelandic on the Government website.

Personal data, as defined in this policy, is any information about an identified or identifiable individual, i.e. information that can be directly or indirectly attributed to a specific individual.

Data that is non-personally identifiable is not considered personal data.

Services on Ísland.is are twofold.

Ísland.is contains various general information about public services. No personal information is collected or otherwise processed when using Ísland.is

On My pages Ísland.is and in Ísland.is app, you can access more specific information and services from the public sector.

Public information: is retrieved and displayed to the user in a designated area on Ísland.is.

Below is an overview of what information is retrieved and displayed:

• Basic information from Registers Iceland about an identified user, such as name, social security number, legal address, place of birth, citizenship, gender, relationship, marital status and registration in a religious organisation.

• Information about other parties who have the same family number as the identified user, such as name, social security number, legal address, gender, relationship and marital status.

• Information from the real estate register about real estate, land and plots of land that the user is the registered owner of.

• Information about the academic record from the upper secondary schools that register in Inna, such as courses, school attendance and grades.

• Information about the user's status with the treasury and institutions, such as payments made, payment slips, payment receipts and a summary of outstanding invoices.

• Information about the user's driving license from the Dis­trict Com­mis­sioners.

Social security number and authentication: Used to identify a user on My pages Ísland.is Also used in the Ísland.is app for authentication with electronic ID, but offers the use of a PIN number and facial recognition/fingerprint scanning on the phone after the user has authenticated with electronic ID.

Contact information: When a user identifies themselves on My pages Ísland.is for the first time, the user is requested to register general contact information. This is information such as email address, phone number and language preference. The user can update this information themselves on the website. A record of the user's action history is stored if contact information is changed.

Electronic documents: Under My pages Ísland.is and in the Ísland.is app there is also a Digital mailbox that contains electronic documents that public institutions and municipalities use to communicate information or send to individuals and companies. The Digital mailbox is the main channel of communication between the public sector and citizens in the future. In electronic documents, for example, you can access information about payment slips and receipts, property valuation notifications and assessment results.

Application process: In certain cases, it is possible to apply directly for specific services or exercise special rights through Ísland.is. Applications and accompanying documents are accessible on the website and the status of applications is visible in the Ísland.is app.

Digital driver's license: Information about a user's driving privileges is retrieved from the driver's license register and published on My pages Ísland.is and in the Ísland.is app.

In cases where a user of Ísland.is is transferred to the website of an appropriate institution when he wants to obtain specific information or apply for a service; it is the appropriate institution that informs about the processing of personal data.

When handling personal information, Digital Iceland ensures that it only processes information necessary and appropriate for the purpose pursued at any given time.

Digital Iceland processes personal information about users to provide the right service and ensure its quality, which the public sector is obliged to do by law, whether such service involves disseminating information to individuals and/or companies or granting them certain rights.

Digital Iceland also processes personal information to send users information about the services they apply for via SMS or email.

Promoting digital services is one of the government's priorities, and work is underway to ensure that digital communication becomes the primary means of communication between the public and the public sector. Part of this promotion is creating a platform My Pages Ísland.is, which compiles and publishes public information about users in one place. Such information provision simplifies the overview for users and enables them to take appropriate measures or change such registration if necessary.

Promotion and marketing: Digital Iceland uses non-personally identifiable information for marketing purposes to promote its own products and services in accordance with applicable law and on the basis of legitimate interests, unless a user has specifically objected to such processing.

The public sector's dissemination of information through Ísland.is based, in other words, on points 3 and 5 of Article 9 of Act No. 90/2018 on the Protection of Personal Data and the Processing of Personal Data, which states that the processing of personal data is permitted if it is necessary to comply with a legal obligation to which the data subject is subject. The same applies when users submit an application for a service or exercise their rights through the website.

Personal information on Ísland.is and in the Ísland.is app comes either from individuals or from the relevant office, institution or municipality. Individuals register some information themselves, such as email address, phone number and account number under My settings on My pages Ísland.is. Further discussion of the origin of information that the public sector communicates through Ísland.is can be found in the privacy policy of the relevant office, institution or municipality.

1.1 My data

Under "My data" on My pages Ísland.is and in the Ísland.is app, essential information from the Registers Iceland about an identified user is displayed, such as name, social security number, legal address, place of birth, citizenship, gender, relationship, marital status and registration in a religious organisation. Also, information about other parties with the same family number as the identified user is displayed there, such as their name, social security number, legal address, gender, relationship and marital status.

1.2. Applications

Under "Applications", the permits and applications that an identified user has applied for on Ísland.is, both as an individual and on behalf of others, will be published. This information comes from the Digital Iceland Application System, which allows users to apply for various services electronically and monitor the application process.

1.3. Electronic Documents

Under "Electronic documents", all documents that an identified user has with all public institutions in the country and municipalities are displayed. In electronic documents, information can be accessed about, for example, payment slips and receipts, notifications of property valuations and assessment results. 

1.4. Settings

Under "Settings," there is information about an identified user's access, such as email address, phone number, and language preference. The user enters this information himself and can change it at any time.

1.5. Finance

Under "Finance", there is information about the user's status with the treasury and institutions, such as payments made, payment slips, payment receipts and a summary of outstanding invoices. This information is obtained from all public institutions in the country.

1.6.  Education

Under "Education", you can find information from schools about the academic career of a known user from the upper secondary schools that register in Inna, such as academic career, school attendance and grades.

1.7. Real estate

Under "Real Estate" you can find information from the real estate register owned and operated by the Registers Iceland. Information such as real estate, land and plots of land that an identified user is the registered owner of.

Personal information related to Ísland.is is only accessible to employees of Digital Iceland and, where applicable, contractors who provide Digital Iceland with specific limited services. It may also be accessible to employees of the office, institution or municipality from which it originates. In some cases, it may be legally required to provide information to others, such as regulatory authorities or courts.

When applying for services or rights on Ísland.is, the institution and its employees providing the service have access to the information sent concerning the requested service or rights.

Public bodies that share information on Ísland.is have an obligation to preserve information according to the Public Archives No. 77/2014 Act. They are generally not permitted to delete the data. Other information related to the website use is only stored for as long as necessary, but this varies depending on the nature of the information and the circumstances.

A digital driver's license is an innovation useful to any person who has earned the right to drive and owns a smartphone. The digital license verifies that the person in question has a valid driver's license and includes all the same information that is presented on the physical driver's license.

Digital driver's licenses are equivalent to traditional driver's licenses but are only valid in Iceland.
A digital driver's license confirms that the person has a valid driving license and contains the same information as a traditional driver's license.

Verification of digital driver's licenses

The Ísland.is app contains software that can be used to scan digital driver's licenses to confirm the accuracy of the information on the license. The software is part of the digital driver's license technology solution and is issued on the basis of an agreement and cooperation between the National Police Commissioner and Digital Iceland and is subject to the Ísland.is privacy policy.

Scanning a digital driver's license involves looking up whether the license holder has a valid driving license, the name and ID number of the license holder in the National Police Commissioner's driver's license database to confirm the accuracy of the above information. No personal information is stored on the phones used for scanning, nor is it further processed or distributed in any way.

Consent for scanning

By presenting a digital driver's license, the license holder consents to the validity of the license being verified using a software scanner that retrieves information from the National Police Commissioner's driver's license database.

Police and third-party verification of individuals' driving licenses is carried out on the basis of Regulation 830/2011 on driving licenses.

Digital driving licenses are issued by the National Commissioner of the Icelandic Police through Ísland.is based on Regulation No. 830/2011 on driving licenses.

Ísland.is uses a web analytics program from Plausible to analyze the use of the website. Its purpose is to obtain statistical information to refine and develop the website and the published information. This information gives insight, for example, how many users open specific subpages on the website, for how long they are viewed, what content users search for in the search engine on the site, from which websites users enter the site and what type of browser they use to view it. No personally identifiable information is collected for this purpose.

Strong emphasis is placed on the security of personal information related to Ísland.is and the Ísland.is app. All parties who work with such personal information are bound by confidentiality and non-disclosure agreements. For this reason, great emphasis is placed on ensuring that their security is guaranteed at all stages of processing, both through organisational and technical measures. The website is encrypted with HTTPS (hypertext transfer protocol secure) to promote adequate security of the information that passes through the website.

There are various rules in place regarding data security on Ísland.is, e.g. access restrictions, information system security, and an active Information security policy of Digital Iceland. Furthermore, Digital Iceland requires its operating and hosting partners to be certified according to the ISO/IEC 27001 standard. That deals with information security management systems and is intended to promote stability in the operation of information systems and information security. In the event of a security breach, all such matters will be handled in accordance with the law on privacy and the processing of personal data.  

Each time a new product or core service is released by Digital Iceland, an independent party is hired as an associated certification to review that product with regard to information security.

Act No. 90/2018 on the Protection of Personal Data and the Processing of Personal Data provides for various rights for individuals.

Access to your personal information: You are required to confirm whether and what personal information is being processed about you. Access to the information must then be provided upon request. In addition, certain minimum information must be provided about the processing of personal information, which can be found both in this policy and in the policies of the relevant public bodies at any given time.

Portability of personal data: The right to have your personal data ported only applies when the processing is based on consent or in the performance of a contract. In a few cases, this applies to the processing of personal data on Ísland.is.

Correction or deletion of personal data: You can always request that incorrect or inaccurate personal data be corrected. The right to deletion, however, does not apply to the processing of personal data by governments, as they are obliged under the Public Archives Act to preserve all information they receive.

Restriction or objection to the processing of personal data: In certain cases, it is possible to request that the processing of personal data be restricted. It may also be possible to object to the processing, but in this case, legitimate reasons for the processing must be demonstrated.

In general, requests from individuals wishing to exercise their rights should be made directly to the controller of the information, which is generally the public entity from which the information originates, such as an office, institution or municipality. Likewise, it is always possible to direct messages to Digital Iceland, which will either process them, forward them or guide individuals on where to turn. You can contact Digital Iceland.

Special emphasis is placed on ensuring that the rights of individuals are properly safeguarded when processing personal information on Ísland.is. If a dispute arises regarding it, the registered individual can always contact the Icelandic Data Protection Authority by sending an email to postur@personuvernd.is

Digital Iceland, which is responsible for the operation and development of Ísland.is, is under the Ministry of Finance and Economic Affairs. Its Data Protection Officer is the Data Protection Officer of the Government, who can be contacted by phone at 545-8800 or by email at personuverndarfulltrui@stjornarradid.is. Information about data protection officers of other public bodies that use Ísland.is in their communications with the public is available on their websites.