IcelandAct No. 90/2018, Data Subject Rights in Iceland
Log nr. 90/2018, art. 2, incorporating Regulation (EU) 2016/679, Arts. 12-21; arts. 17 to 19
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd (the Icelandic Data Protection Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The linked page summarizes a ruling on the right to erasure under Article 20 and does not address access, portability or objection.
- As of
- Guidance link
- https://personuvernd.is/urlausnir/birting-leitarnidurstadna-i-leitarvel-google-2
- Guidance body
- Persónuvernd (the Icelandic Data Protection Authority)
- Open questions
- Which interests count as 'brýnir hagsmunir einstaklinga tengdir upplýsingunum, þar á meðal hins skráða sjálfs' (overriding interests of individuals connected to the information, including the data subject), so that the access and information rights in Articles 13 to 15 of the Regulation 'gilda ekki' (do not apply) under Article 17 of Act No. 90/2018?
What it makes you log
Logging duty
Articles 17 to 21 of the Act and Articles 12 to 21 of the Regulation give the data subject rights of information, access, rectification, erasure, restriction, portability and objection, and Article 17 lets a law restrict the access rights on listed grounds. They put response and notice duties on the controller but none that requires it to keep, show or produce a record of handling a request. The consent-proof duty (Article 10) and the register (Article 26) are not cited by this row. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Act No. 90/2018 carries the General Data Protection Regulation (GDPR) data subject rights, access, rectification, erasure, restriction, portability, and objection, into Icelandic law. Rights are exercisable against the controller, with Personuvernd as the escalation path for a complaint.
Article 17(3) of the Act disapplies the rights to information and access, Article 13(1) to (3), Article 14(1) to (4) and Article 15 of the Regulation, where overriding interests of individuals connected to the information, including the data subject, weigh more heavily.
Article 17(4) lets a law restrict the Article 13 to 15 rights where the restriction respects the essence of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard one of eight listed aims, among them national security, defence, public security and the prevention or prosecution of offences.
Article 17(5) allows the paragraph 4 restrictions to be applied to personal data in working papers used by the controller to prepare decisions and not shared with others, so far as necessary to secure the preparation of proceedings. Article 17(6) allows information in cases before public authorities to be withheld from the Article 15(1) right of access to the same extent as the exceptions to the right to information under the Information Act and the Administrative Procedure Act.
Article 18(2) disapplies Articles 15, 16, 18 and 21 of the Regulation where personal data is processed solely for scientific or historical research or for statistical purposes, so far as the rights can be considered to make the purpose impossible or seriously impair it.
Article 18(3) disapplies Articles 15, 16, 18, 19, 20 and 21 on the same terms where the data is processed solely for archiving in the public interest, and the data subject keeps the right to lodge a statement to be kept with the records about them.
Article 19 disapplies the duty to inform under Article 13(3) and Article 14(4) when a public authority passes personal data to another public authority for a statutory task, where the data passed is limited to what is necessary to perform the authority's legal duty. No Icelandic-specific timeline departure from GDPR's one-month response window was found.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .