Iceland: Persónuvernd orders Íslensk erfðagreiningar to ensure DPO duties do not lead to conflicts of interest
The Icelandic data protection authority ('Persónuvernd') published, on 4 August 2022, its decision in Case No. 2020061979, as issued on 29 June 2022, in which it found Íslensk erfðagreiningar ehf, a genetic research company, in violation of Article 38(6) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and Article 35(3) of the Act 90/2018 on Privacy and Processing of Personal Data ('the Act'), following an ex officio assessment.
Background to the decision
In particular, the Persónuvernd reported that it had decided to carry out an assessment of the position of Íslensk erfðagreiningar's data protection officer ('DPO') and to investigate whether the requirements under the Act and the GDPR were complied with. Subsequently, the Persónuvernd noted that it had requested Íslensk erfðagreiningar to provide relevant information that demonstrated compliance with the above.
Findings of the Persónuvernd
Further to the above and based on the elements acquired, the Persónuvernd found that Íslensk erfðagreiningar's DPO had been correctly involved in issues related to the protection of personal data and that Íslensk erfðagreiningar had provided the same with adequate resources. However, the Persónuvernd determined that Íslensk erfðagreiningar had not ensured that the tasks and duties of the DPO did not lead to conflicts of interest, thus resulting in a violation of Article 38(6) of the GDPR and Article 35(3) of the Act.
In conclusion, the Persónuvernd ordered Íslensk erfðagreiningar to ensure that the DPO does not carry out other tasks and duties that may lead to conflicts of interest. Lastly, the Persónuvernd noted that Íslensk erfðagreiningar's delay in responding to its requests for information was reprehensible, neverthless the Persónuvernd took the view that the case in question should not lead to criminal proceedings, as Íslensk erfðagreiningar's responses and the requested data were eventually received.
You can read the decision, only available in Icelandic, here.