Delete Personal Data

The right to be forgotten

You have the right to demand that your personal data be deleted from websites, databases or other systems, when certain conditions are met. This is called the right to be forgotten.

Processing time

The organisation must respond as soon as possible and not later than 1 month after the request.

In certain circumstances, the deadline may be extended by 2 months. In this case, you must be informed:

within 1 month of your request
on why there is a delay
the right to lodge a complaint with the Data Protection Authority

Conditions

You may request the deletion of personal data when:

personal data are no longer necessary for the purpose for which they were collected or processed
you withdraw your consent and there is no other legitimate basis for the processing of the information
you object to the processing and there is no legitimate reason for the continued processing
the processing of personal data is illegal, for example if it was collected without consent
personal data must be deleted to fulfil legal obligations
information relating to a child under the age of 16 at the time of collection

Right is not applicable

The right to privacy does not generally apply to the processing of personal data by the government, as they are legally bound to keep documents and other information received.

Organisations may refuse to delete information when processing is necessary to:

to exercise freedom of expression and freedom of information
fulfill a legal obligation to carry out a task carried out in the public interest
ensure public health or public interest
public interest in the field of public health.
for the archiving of documents of general interest, scientific research, historical research and statistical processing
to set up, maintain or defend legal claims

Your information erased from online search engines

It is important to assess in each case whether there are conditions for the removal of search results on the Internet and the same views apply as for the right to delete personal data and it is necessary to assess whether it is legitimate for the information to be accessible by looking up a person’s name on a search engine.

Then it is also necessary to weigh:

the interests of an individual's privacy and the protection of personal data about him.
public interest in making information available in this way.

Assessment considerations

the sensitive nature of the personal data in question.
whether the person concerned is a public figure or plays a role in a public arena, so as to affect the privacy protection of the person concerned.
whether the person in question is a child.
the accuracy and reliability of the information.
what the public interest is in the availability of information.
the proportionality or excessiveness of the information in relation to the original purpose of the processing.
the extent to which this access to information has a negative impact on the person's privacy.
how long it has been since the initial processing took place.
where the information originated, i.e. from the individual concerned himself or another, and whether it was intended to be made public.
whether the information was initially made public as part of a news report or other media.
whether the person who originally published the information had a legal obligation to make it available.

According to the search results are deleted if they concern personal data such as:

Personal identification numbers or other such personal identifiers.
Numbers of bank accounts.
Credit card number.
Photos of the signatures.
Nektars or sexually explicit images that have been posted on the Internet without the person's consent.
Individuals' medical records or other data on their health, which are confidential.

Google search results

Google removes search results that contain personal information, such as:

social security numbers or other similar personal identifiers
bank account numbers
credit card numbers
images of signatures
nude or sexually explicit images posted online without the person's consent
medical records or other confidential health information

Personal information that Google does not delete

Some personal information Google generally does not delete, such as:

birthdays
addresses
phone numbers

Google's assessment considerations

When assessing requests to remove search results, Google considers whether:

the specific personal information could increase the risk of identity theft, fraud, or other harm
certain identification numbers are issued by the government
the information is public or confidential
they can generally be used to transfer funds
they can generally be used to obtain further information about a specific individual, which could lead to identity theft or financial harm
the person can be identified in a nude or sexually explicit image

The general rule, according to Google's terms of service, is that search results will not be removed if they concern personal information that is publicly available on government websites.

Contact the search engine and request that the search result be erased.
1. If you wish to have certain search results erased by Google, you can request this by sending it to Google.
Similar resources may be available on websites of other web search engines, but if this is not the case, a message can be sent to the relevant web search engine and requested that certain search results be erased, with appropriate justification.
If a web search engine does not respond to a request for the search result to be erased, a complaint can be sent to the Data Protection Authority if:
the web search engine is Google – Data Protection has already ruled that Google is established in Iceland,
the web search engine is operated by a person established in Iceland or,
the web search engine is operated by a person who does not have a registered office in Iceland but the website's activities are related to (i) offering products or services to individuals within the EEA area, regardless of whether it is for payment or not, or (ii) monitoring the behaviour of individuals within the EEA area, and the Data Protection Authority then resolves the dispute between the parties.

If you can bring your dispute to the Data Protection Authority under the above conditions, you can also bring it directly to the courts.

Decisions by the Data Protection Authority can also be challenged by the courts.

Service provider

Data Protection Authority

Related material

Data protection laws and your rights

Access to your personal data