eCommerce 2020 ApS – €51,000 Fine (Iceland, 2023)

A company offering so-called "small loans" - eCommerce 2020 ApS (eCommerce) – sent information about non-payments of loans for registration at a credit scoring company - Creditinfo Lánstrausti hf. The Icelandic DPA issued a decision (case no. 2020061901 – see summary on [https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Island)_-_2020061901 GDPRHub]) against Creditinfo Lánstrausti hf. after the consumers' association of Iceland filed a complaint against it. Following the investigation in that case, it was revealed that the loan terms of eCommerce did not include any provision stating that non-payment (for 40 days) leads to registration of non-payment at Creditinfo Lánstrausti hf. However, in this case eCommerce 2020 disputed the fact that such provision was missing and argued that regardless of the wording in the company's loan terms at any given time, borrowers were always informed of the consequences of non-payments on their loans. Furthermore, eCommerce claimed that there was always some kind of provision in the company's loan terms stating that if a loan defaulted, the company has the right to entrust a third party to collect the loan. It was also revealed that information on non-payments were registered on behalf of eCommerce 2020 ApS despite the fact that the amount of the payment default was below the minimum amount that could be registered according to the terms of the business license of Creditinfo Lánstrausti hf. In light of the above, the Icelandic DPA considered that there may be grounds for imposing an administrative fine on eCommerce 2020 ApS, and initiated an investigation. Firstly, the Icelandic DPA concluded that eCommerce is responsible as the controller for the processing of the personal data in question when eCommerce sends the information on non-payments to Creditinfo Lánstrausti hf. for registration. Moreover, the DPA stated that eCommerce is liable for ensuring that the conditions of the loan terms are met for the registration of non-payments. Secondly, the DPA considered the lawfulness of the processing of perosnal data in question. The fact that eCommerce sent the information on non-payments of loans for registration despite the fact that the necessary term relating thereto was missing in the loan terms was noted by the DPA. Additionally, the DPA took into account that eCommerce sent information on non-payments for registration even when the amounts were below the minimum amount that could be registered according to the business license of Creditinfo Lánstrausti hf. Following the above considerations, it was found by the DPA that eCommerce violated Article 6(1)(f) GDPR when it sent the information on non-payments for registration on the basis of legitimate interests. The legitimate interests of eCommerce did not outweigh the interests or fundamental rights and freedoms of the data subjects. Furthermore, the DPA found that with regard to its processing of personal data in question eCommerce breached the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR as well as the accountability principle pursuant to Article 5(2) GDPR. Consequently, eCommerce was issued with a fine of ISK 7,500,000 (approx. € 51,000) due to the registration of unpaid claims due to the so-called small loans at Creditinfo Lánstrausti hf. without the registration conditions being met.