The Data Protection Authority answers questions of the French DPA

On 29 April 2008, the Icelandic Data Protection Authority received an e-mail in which it is asked to answer the following questions from the French DPA (CNIL):

The answers to both questions are positive.

P.S. The following cases can be mentioned as examples of how the Supreme Court of Iceland has handled cases regarding privacy and data protection.

1. On 27 November 2003, The Supreme Court of Iceland delivered a judgement on a case concerning the Icelandic Health Sector Database, which the company deCode/Íslensk erfðagreining was planning to build. According to law, health data from clinical records on all Icelanders were supposed be put into this database without consent, but people had the right to abstain. A woman wanted information on her late father not to be put into the database. She was denied of this since the act on the database only granted this right to the data subject itself.

However, the Supreme Court came to the conclusion that her claim should be accepted because health information on her father could be relevant in assessing her own health. Also, in the light of the constitution of Iceland, which grants everyone the right to privacy, the Supreme Court considered the act on the database to be too vague in terms of data security. This applied, e.g., to encryption of data, which was supposed to make it unidentifiable. Likewise, this applied to security when matching the data in the Health Sector Database with data in a genealogical database and a genetic database.

2. On 1 June 2006, the Supreme Court delivered a judgement in a case regarding the publication of e-mails in a newspaper, i.e. whether the publication of the e-mails constituted a violation of provisions in the Icelandic Penal Code protecting privacy and whether or not an injunction against further publication of the material in the e-mails – and of the newspaper having hold of them – was lawful. The e-mails were about charges that were to be brought against prominent business men in Iceland for suspected illegal behaviour. The newspaper considered the individuals sending the e-mails between them to have started this case and that the e-mails were a proof of that.

One of the individuals asked for the aforementioned injunction and filed a case against the newspaper since she considered it to have violated her privacy rights and, thereby, the aforementioned provisions in the Penal Code. The Supreme Court did not agree with that taking into account, amongst other things, that the allegations against the business men had given rise to much public debate. Therefore, the Supreme Court argued, the e-mails were of concern for the public. In the light of this, the Court put an end to the injunction and aquitted the newspaper of having been in breach of the Penal Code.

3. On 4. October 2007, the Supreme Court of Iceland delivered a judgement in a case regarding a front page newspaper story stating that an editor of another newspaper and a certain woman had had a secret, sexual relationship. Both of those people were amongst those individuals mentioned in the aforementioned judgement from 1 June 2006 who had been sending e-mails between them later to be published without their consent in a newspaper.

The woman in question filed a case against the two editors of the newspaper publishing the story since she regarded her privacy rights to have been violated and, thereby, a provision in the Icelandic Penal Code protecting privacy. The editors were of the view that the story on the sexual relationship was true and was also connected to the charges against the prominent businessmen mentioned in the judgement from 1 June 2006. The Supreme Court, however, considered the story to have no relevance in relation to these charges or public debate in general. Therefore, the Supreme Court came to the conclusion that the two editors of the newspaper publishing the story had violated the relevant provision in the Penal Code.

4. On 6 December 2007, the Supreme Court of Iceland delivered a judgement regarding the DPA’s decision of 27 February 2006. An individual had complained to the DPA after a doctor had accessed his health record for conducting an evaluation of his health for an insurance company. The DPA came to the conclusion that the individual in question had not consented to this access and that it was, therefore, illegal. The doctor, then, filed the case that gave rise to the Supreme Court’s judgement. The defendants were the DPA and the individual in question.

The District Court of Reykjavik agreed with the DPA in a judgement given on 21 December 2006. However, the Supreme Court nullified the DPA’s decision. In that regard, the court pointed out that the individual in question had given his advocate written permission to access his health records. The advocate had given a copy of the permission to the doctor. On the ground of that, the court considered the doctor to have been in good faith when he accessed the individual’s health record. This means, in other words, that the court was of the view that the doctor had reason to believe that the individual had consented to this access even though there was no written permission in that regard from this individual to the doctor himself.