DPA case 2020010677 – Complaint Upheld (Iceland, 2020)

The Association of Icelandic Municipalities published the opinion of the Parliamentary Ombudsman on its website. However, the opinion contained the name and personal information of the complainant, and was online for several weeks, and was only taken down when the complainant contacted an employee of the Association. The Association responded that the information was published online unintentionally, and that they had not reported the breach to the Icelandic DPA because they did not believe the publication of the opinion would lead to a risk to the complainant's rights and freedoms. Did the Association have a responsibility to report the breach to the DPA? Was there a lawful basis for the processing (i.e. the publication of the opinion) under Article 6(1)GDPR? The DPA considered that either Article 6(1)(c) - the processing is necessary for complying with a legal obligation - or Article 6(1)(e) - the processing is necessary for the performance of a task carried out in the public interest - could apply to this case. However, it ultimately concluded that neither could apply, because the processing was the result of a mistake. Furthermore, the DPA concluded that the processing was also unlawful because it failed to meet the requirements of Article 5(1)(e) - data subjects shall not be identifiable for longer than is necessary - and Article 5(1)(f) - data shall processed so as to ensure appropriate security for it. It stated that it was not going to answer the question of whether or not the Association had a responsibility to report the breach, despite both parties to the complaint agreeing that a breach had taken place.