Data Protection Laws and Freedom of Expression: Iceland 
Constitutional/Primary Law Background - see also ECHR
Article 73 of the contemporary Icelandic Constitution (1944 as revised 2013) protects freedom of opinion and belief and freedom of expression, with limitations equivalent to Article 10(2) of the ECHR. Censorship and similar limitations are prohibited, but it is specially provided that expression of thoughts is subject to liability in court. Article 71 ensures non-interference with privacy, home and family life but subject to statutory limitations “urgently” necessary to protect the rights of others. It is specifically provided that examination of documents and communications and comparable interferences with privacy require a judicial decision or a statutory provision.
The first relevant protection of expression, inviolability of dwelling and protection of letters and papers (with searches subject to a judicial order except in exceptional circumstances) can be traced to the 1849 Danish Constitution (see Denmark Report). Similar Icelandic-specific provisions here were included in the Constitutional Law for the Special Affairs of Iceland 1874 (arts 54 and 49) and also the 1944 Constitution (art 66 and 72) adopted when Iceland become an independent republic. The current provisions here were adopted in 1995.
First-Generation Statutory Law
Iceland adopted the Act No. 63/1981 on Systematic Recording of Personal Data on 25 May 1981. In 1989, this was replace with the Act Concerning the Registration and Handling of Personal Data. Special Expression Derogation Iceland did not provide for a special expression derogation in its first generation Data Protection Act (1981). It did, however, exclude biographical writing from the law’s scope of application (art. 2). Broad Expression Derogation Personal Exemption Knowledge Facilitation Framework |
Parliamentary Debates
Where were no discussions on special or broad expression or personal exemptions.
In the parliamentary debate leading up to the adoption of the 1981 Data Protection Act, Haraldur Olafsson MP did, however, express concern about the impact of data protection regime on the processing of data for research and scientific purposes. He noted that while scientific research should not be curtailed by the data protection regime, it was also important to prevent the misuse of data.[1]
In the parliamentary debates preceding the adoption of the 1989 Data Protection Act, special or broad expression, a personal exemption or Knowledge Facilitation Frameworks were not discussed. However, special rules for professionally conducted market and opinion poles were introduced. Jón Kristiánson, a member of the General Committee reviewing the proposed Act, thereby noted that most exemptions in this regard were granted for scientific research with strong public interests.[2]
Second-Generation Statutory Law
Iceland adopted its second-generation Data Protection Act on 10 May 2000. It was subsequently amended multiple times. Special Expression Derogation Broad Expression Derogation Personal Exemption Knowledge Facilitation Framework |
Parliamentary Debates
The 2000 Data Protection Act implementing the Directive was passed shortly after the passing of a law giving permission for a centralized healthcare database for research purposes. Parliament therefore debated whether the new Data Protection Act would affect the centralized database. MP Tomas Ingi Olrich emphasized the importance of distinguishing between the processing of data for research purposes and for treatment purposes. The processing of data for research purposes would require compliance with data protection provisions, including the consent of the data subject. MP Ogmundur Jonasson disagreed with this assessment, noting the central database was created for the patients themselves, while databases created for research purposes would have to comply with the Helsinki Declaration on informed consent. A further point of contention concerned the use of the centralized database for research purposes by private for profit actors, including pharmaceutical companies.[3]
Although the initially proposed special expression derogation provision’s structure was changed, no parliamentary debates were recorded thereon. On the household or personal no debates took place either.[4]
Third-Generation Statutory Law
Iceland adopted third-generation data protection law through Act No. 90/2018 on Data Protection and the Processing of Personal Data on 27 June 2018. As necessary for a non-EU EEA State, this Act both transposed (see Act 90/2018, art. 2) and implemented the GDPR. Special Expression Derogation While these exemptions also apply to artistic and literary forms of expression, Iceland has failed to extend their scope to the protection of ‘academic expression’ (art. 6). Broad Expression Derogation Personal Exemption – see GDPR, art. 2(2)(c) Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards) |
Parliamentary Debates
No relevant debates were found on the special or broad expression or knowledge facilitation framework. Social media platforms were mentioned in connection with their collection of data even where a person does not have a profile rather than in connection with the freedom of expression.[5]