Iceland: Persónuvernd issues opinion on requirement to transmit patient information
The Icelandic data protection authority ('Persónuvernd') announced, on 19 May 2020, that it had issued, on 18 May 2020, an opinion ('the Opinion') on the requirement of the Directorate of Health that self-employed medical practitioners transmit information about their patients for their registration. In particular, the Opinion highlights that the law requires that personal information must be included in health records and that such inclusion constitutes processing of personal data. In addition, the Opinion notes that, in accordance with the principle of medical confidentiality, the use of anonymised information which does not identify an individual should be considered. Moreover, the Opinion states that, in the aforementioned case, any restrictions under Article 23 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') on the rights of data subjects to object to the processing do not apply, and that the right to object to the processing under Article 21 of the GDPR should be respected.