The Icelandic data protection authority ('Persónuvernd') issued, on 11 May 2022, its decision to refuse an application by Amgen AB, an international pharmaceutical company to target social media users who have looked up pages related to migraines or liked migraine-related pages in connection with its study on a supplement for migraine medicine. In particular, the Persónuvernd outlined that it received a request by the Science Ethics Committee to provide its opinion on the processing of personal data for the benefit of such research in the run-up to the Committee's decision to grant a licence to AMGEN in accordance with Article 13 of Act no. 44/2014 on Act on Scientific Research in the Field of Health.

Furthermore, the Persónuvernd outlined that the transmission of an advertisement about the study in question to those who may have migraines in the light of online behaviour involves the processing of sensitive personal information and therefore requires authorisation to ensure it lawful and fair processing in accordance with Article 11 of the Act and Article 9 of the GDPR. Therefore, the Persónuvernd considers it a precondition for users to consent to the processing of information through behavioural analysis of on online behaviour in the interest of the investigation. However, the Persónuvernd noted the Irish data protection authority's investigation on Meta Platforms Inc. (formerly known as Facebook Inc.) in determining that there are no grounds for permitting processing of personal information of targeted users through behavioural analysis by Amgen.

You can read the decision, only available in Icelandic, here.