DPA case nr. 2020010678 – Dismissed (Iceland, 2020)

The complainant filed a complaint with the Persónuvernd because their personal data was processed by a credit agency for the purpose of making a report on the complainant's creditworthiness. The complainant argued that because Creditinfo's rating was based on, among other things, information that was up to four years old, including information on the complainant's temporary financial difficulties, the processing involved in the making of the rating did not comply with data protection rules. Creditinfo disputed this argument. Was the processing by Creditinfo a violation of the GDPR? The Persónuvernd held that the processing was lawful for several reasons. Regarding the GDPR, it held that Article 6(1)(f) applied as a lawful basis for the processing, on the basis that Creditinfo had a legitimate interest in processing the information for the preparation of a report on the complainant's credit rating. It also held that the Article 5(1) principles of transparency, purpose limitation and data minimisation were not violated in this case. The Persónuvernd also cited several of its earlier decisions where it also decided that Creditinfo was allowed to use information on the entry in the company's default register when preparing reports on the complainants' credit ratings, for four years from the registration of such information.