- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 2020010613 – Complaint Upheld (Iceland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Iceland's DPA upheld a complaint about Creditinfo's use of personal data for credit ratings. They confirmed that Creditinfo can use this data for up to four years. This decision reassures users about how long their credit information can be stored.
What happened
The DPA ruled that Creditinfo could process personal data related to credit defaults for four years.
Who was affected
Individuals whose credit ratings are affected by defaults registered with Creditinfo.
What the authority found
The DPA found that Creditinfo's processing of personal data complied with Icelandic data protection laws.
Why this matters
This case clarifies the rules around credit data usage, helping businesses understand their responsibilities in handling personal information.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On April 9 2019, the Icelandic DPA received a complaint from a Complainant regarding the processing of their personal information in connection with credit rating by Creditinfo Lánstrausti hf. (hereinafter, 'Creditinfo'). The registration of a complainant's defaults affects their credit rating for up to four years from registration. The Icelandic DPA had to decide whether Creditinfo could use information about the complainant's defaults within the four-year period. The Icelandic DPA decided that the processing of the Complainant's personal data by Creditinfo Lánstraust hf. in connection with the preparation of their credit report, was in compliance with Act no. 90/2018 on Data Protection and the Processing of Personal Data. The DPA pointed out that it had previously taken a position on the issue in question with a ruling, cf. January 26, 2017, in case no. 2016/950; on December 6, 2016, in case no. 2016/580; on September 28, 2017, in case no. 2016/1138; and on May 31, 2018, in case no. 2017/537. In all of the foregoing rulings, the DPA considered that Creditinfo could use information on the entry of the company's defaults list for four years from the registration of such information.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010613 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010613 - Iceland (2020). Retrieved from cookiefines.eu
Last updated: