skip to content
 

Data Protection Laws and Freedom of Expression: Iceland File:Flag of Iceland.svg

 

 

I. First-Generation Statutory Law

Iceland adopted the Act No. 63/1981 on Systematic Recording of Personal Data on 25 May 1981. In 1989, this was replace with the Act Concerning the Registration and Handling of Personal Data.

Special Expression Derogation

Iceland did not provide for a special expression derogation in its first generation Data Protection Act (1981). It did, however, exclude biographical writing from the law’s scope of application (art. 2).

Broad Expression Derogation
No specific provision.

Personal Exemption
No specific provision.

Knowledge Facilitation Framework
While the initial Data Protection Act (1981) did not provide for derogations in favour of knowledge facilitation, the 1989 Act Concerning the Registration and Handling of Personal Data contained a Knowledge Facilitation Framework, exempting registers or registrations established solely for the purpose of statistical extracts from the retroactive transparency rule (art. 11). Art. 2 of the 1981 and 1989 Act, moreover, excluded genealogical research from their scope of application.

Parliamentary Debates
Where were no discussions on special or broad expression or personal exemptions.

In the parliamentary debate leading up to the adoption of the 1981 Data Protection Act, Haraldur Olafsson MP did, however, express concern about the impact of data protection regime on the processing of data for research and scientific purposes. He noted that while scientific research should not be curtailed by the data protection regime, it was also important to prevent the misuse of data.[1]

In the parliamentary debates preceding the adoption of the 1989 Data Protection Act, special or broad expression, a personal exemption or Knowledge Facilitation Frameworks were not discussed. However, special rules for professionally conducted market and opinion poles were introduced. Jón Kristiánson, a member of the General Committee reviewing the proposed Act, thereby noted that most exemptions in this regard were granted for scientific research with strong public interests.[2]

 

II.  Second-Generation Statutory Law

Iceland adopted its second-generation Data Protection Act on 10 May 2000. It was subsequently amended multiple times.

Special Expression Derogation
The Icelandic Data Protection Act completely and unconditionally exempted media from all the substantive data protection provisions with the exception of some of the data protection principles (art. 5). Iceland namely provided for a full exemption from principles pursuant to which personal data must be (ii) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes, (iii) adequate, relevant and not excessive, and (v) kept in a form that permits identification of data subjects for no longer than is necessary. The principles pursuant to which personal data must be (i) processed fairly and lawfully and (iv) accurate and, where necessary, kept up to date were stated to generally apply. However, ‘to the extent necessary to reconcile the right to privacy on the one hand and freedom of expression on the other derogations can be made from provisions in the Act in the interest of journalism, art or literature’, establishing a strict public interest balancing test (art. 5).

Broad Expression Derogation
The special expression derogation thereby went beyond all the defined (journalistic, artistic and literary) special purposes (art. 5).  

Personal Exemption
celand excluded the processing by an individual of data that only relates to him- or herself or is ‘purely intended for personal use’ (art. 3).

Knowledge Facilitation Framework
The Icelandic Data Protection Act provided that ‘further processing of data for historical, statistical or scientific purposes shall not be considered incompatible provided that proper safeguards are adhered to’ (art. 7(2)). No exemption for knowledge facilitation purposes was provided from proactive direct and indirect transparency rules. A qualified exemption was set out from the retrospective transparency rule. Art. 19(1) accordingly provided that the right of access would not apply to data which ‘are used solely for statistical processing or scientific research, provided that their processing cannot have direct influence on his interests’. A broad exemption was also provided from the sensitive data rules, where ‘the processing is necessary for the purpose of statistical or scientific research, provided that the privacy of individuals is protected by means of specific and adequate safeguards’ (art. 9(9)). As regards the consent requirement, rules were to be established by the DPA on how individuals may be selected, approached and informed of the scientific research before being asked for their consent. No exemptions were granted from the legitimating ground, registration and data export conditions.

Parliamentary Debates

The 2000 Data Protection Act implementing the Directive was passed shortly after the passing of a law giving permission for a centralized healthcare database for research purposes. Parliament therefore debated whether the new Data Protection Act would affect the centralized database. MP Tomas Ingi Olrich emphasized the importance of distinguishing between the processing of data for research purposes and for treatment purposes. The processing of data for research purposes would require compliance with data protection provisions, including the consent of the data subject. MP Ogmundur Jonasson disagreed with this assessment, noting the central database was created for the patients themselves, while databases created for research purposes would have to comply with the Helsinki Declaration on informed consent. A further point of contention concerned the use of the centralized database for research purposes by private for profit actors, including pharmaceutical companies.[3]

Although the initially proposed special expression derogation provision’s structure was changed, no parliamentary debates were recorded thereon. On the household or personal no debates took place either.[4]

 

III.  Third-Generation Statutory Law

Iceland adopted third-generation data protection law through Act No. 90/2018 on Data Protection and the Processing of Personal Data on 27 June 2018.  As necessary for a non-EU EEA State, this Act both transposed (see Act 90/2018, art. 2) and implemented the GDPR.

Special Expression Derogation
Closely following its second generation Data Protection Law, Iceland provides a very wide-ranging unconditional media exemption. With regard to the data quality principles, exemption from the first and fourth data protection principles (the processing of personal data must be (i) fair, lawful and transparent and (iv) accurate and, where necessary, kept up to date) are subject to this being only ‘to the extent necessary’ to reconcile the right of ‘private life’ and freedom of expression, setting out an objective and strict public interest test.

While these exemptions also apply to artistic and literary forms of expression, Iceland has failed to extend their scope to the protection of ‘academic expression’ (art. 6).

Broad Expression Derogation
While article 6 addresses the ‘relation to the freedom of expression’, its provisions are limited to journalistic, artistic or literary forms of expression.

Personal Exemption – see GDPR, art. 2(2)(c)

Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Article 11(1) of the new Act carries forward a modified version of the sensitive data derogation for statistical purposes and scientific research purposes provided that the right to data protection is ensured with specific measures where appropriate (based on the provisions in the data protection act) and is carried out on a basis of law which provides for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.  With minor modifications, Article 12 extends legal bases to process sensitive data also to criminal offense data.  Article 34 establishes that the Act on Scientific Research in the Health Sector governs approvals of scientific research in this area.  Art. 18 excludes Arts. 15, 16, 18 and 21 GDPR from applying to the processing of data for statistical, historical and scientific research purposes ‘to the extent that these rights make it impossible or hinder it significantly achieving the desired goals’. These Articles and also Article 19 are excluded from application for public interest archiving to the extent that these rights make it impossible or hinder it significantly achieving the desired goals but with the proviso that the data subject has the right to provide a statement to kept with any documentation containing their personal data.

Parliamentary Debates
No relevant debates were found on the special or broad expression or knowledge facilitation framework. Social media platforms were mentioned in connection with their collection of data even where a person does not have a profile rather than in connection with the freedom of expression.[5]

 


[1] 103rd Parliamentary Proceedings (1981) A-692/693 B-4148.
[2] 112th Parliamentary Proceedings (1989) A-181 B-2135; see art. 24.
[3] Iceland, 125th Parliamentary Proceedings (2000)
[4] Ibid.
[5] Iceland, ‘Persónuvernd og vinnsla persónuupplýsinga, frh. 1. Umræðu’ (29 May 2018) https://www.alt-hingi.is/altext/148/05/l29182838.sgml (last accessed 21 September 2020).