Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Iceland: Persónuvernd orders Íslensk erfðagreiningar to ensure DPO duties do not lead to conflicts of interest

The Icelandic data protection authority ('Persónuvernd') published, on 4 August 2022, its decision in Case No. 2020061979, as issued on 29 June 2022, in which it found Íslensk erfðagreiningar ehf, a genetic research company, in violation of Article 38(6) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and Article 35(3) of the Act 90/2018 on Privacy and Processing of Personal Data ('the Act'), following an ex officio assessment.

Background to the decision

In particular, the Persónuvernd reported that it had decided to carry out an assessment of the position of Íslensk erfðagreiningar's data protection officer ('DPO') and to investigate whether the requirements under the Act and the GDPR were complied with. Subsequently, the Persónuvernd noted that it had requested Íslensk erfðagreiningar to provide relevant information that demonstrated compliance with the above.

Findings of the Persónuvernd

Further to the above and based on the elements acquired, the Persónuvernd found that Íslensk erfðagreiningar's DPO had been correctly involved in issues related to the protection of personal data and that Íslensk erfðagreiningar had provided the same with adequate resources. However, the Persónuvernd determined that Íslensk erfðagreiningar had not ensured that the tasks and duties of the DPO did not lead to conflicts of interest, thus resulting in a violation of Article 38(6) of the GDPR and Article 35(3) of the Act.


In conclusion, the Persónuvernd ordered Íslensk erfðagreiningar to ensure that the DPO does not carry out other tasks and duties that may lead to conflicts of interest. Lastly, the Persónuvernd noted that Íslensk erfðagreiningar's delay in responding to its requests for information was reprehensible, neverthless the Persónuvernd took the view that the case in question should not lead to criminal proceedings, as Íslensk erfðagreiningar's responses and the requested data were eventually received.

You can read the decision, only available in Icelandic, here.