DPA case 2020010616 – Dismissed (Iceland, 2020)

A company obtained medical information about the complainant from a health centre, and used it to prepare a report which was then submitted to the Icelandic Insurance Appellate Committee, who were dealing with a compensation claim involving the complainant. Was the company's acquisition and use of the complainant's personal data compliant with the processing principles under Article 5 GDPR? Did an exception to the prohibition of processing of health data under Article 9(2) GDPR apply? The Icelandic DPA held that the processing was compliant with Article 5, noting in particular that the amount of data processed was "not in excess of what was necessary". The Icelandic DPA also held that the company could process the data lawfully because an Article 9(2) exception applied, namely Article 9(2)(f), where processing is necessary for the exercise or defence of a legal claim. However, they rejected the company's contention that the exception of explicit consent (Article 9(2)(a)) could be relied on in this case, because of the "clear difference in situation" between the controller (company) and processor (complainant). In particular, the DPA considered that consent here could not be granted voluntarily, because the compensation settlement was conditional on the complainant granting the company access to their health data.