The Icelandic data protection authority ('Persónuvernd') published, on 31 March 2022, its decision in Case No. 2020072023, as issued on 15 March 2022, in which it found the processing of personal data of a spouse to fall outside of the scope of Articles 4(1) and 39(1) of the Act 90/2018 on Privacy and Processing of Personal Data ('the Act'), following a complaint regarding the alleged processing of the ex-spouse's personal data.

Background to the case

In particular, the Persónuvernd noted that it had initiated an investigation following a complaint regarding the alleged collection, by their former spouse, of information regarding their CV from their email account, which was subsequently passed onto their lawyer and submitted to court.

Findings of the Persónuvernd

In light of the above, the Persónuvernd considered whether the complainant's former wife logged into the complainant's email account without their knowledge or consent, and whether their lawyer was authorised to submit the complainant's CV to court. More specifically, the Persónuvernd found that the complaint regarding the receipt of the CV by the court fell outside the scope of Article 4(1) of the Act, since the court was authorised to direct the relevant parties to obtain any information necessary to clarify the circumstances of the case.

Regarding the alleged unlawful access to the complainant's email account, the Persónuvernd considered it unnecessary, owing to disputes surrounding the facts of the case, to exercise its powers under Article 39(1) of the Act.

Outcomes

Consequently, the Persónuvernd found that the processing of the complainant's CV fell outside the scope of Articles 4(1) and 39(1) of the Act. Therefore, the Persónuvernd closed its investigation.

You can read the decision, only available in Icelandic, here.