DPA case 2020010610 – Complaint Upheld (Iceland, 2020)

A data subject complained to the Persónuvernd that his personal data was published by another individual on the latter's Facebook page. The complainant also attached a screenshot with the complaint to the DPA, and the individual who had posted the information did not respond to the DPA's invitations to submit explanations regarding the complaint. More specifically, the data published on the Facebook page included the complainant's address, which the complainant had previously removed from a telephone directory for security purposes. Furthermore, the defendant's Facebook page was open and accessible to all those who are registered on social media. If a URL that directly refers to the post in question and the documents that accompany it were used, they were also accessible to those who are not registered. Was the publishing of the information regarding the claimant lawful based on Article 9 of Act no. 90/2018 (the national implementation of Article 6 GDPR)? The Persónuvernd held that the publishing of the complainant's information constituted an unlawful processing of personal data in breach of Article 6(1)(f) GDPR. In its reasoning, the DPA first examined whether the publishing of the complainant's address constituted processing of personal data. Despite the DPA not having explicitly mentioned Recital 18 GPDR, it did state that the processing did not only cover personal information intended for personal use. A main reason for the household exemption not applying was that the Facebook page was not closed, but open to be accessible to anyone who had the URL of the post in question. The DPA then examined the defendant's potential exercise of his freedom of expression based on Article 10 ECHR and its relation to Article 8 ECHR. The Persónuvernd first noted that expressing one's views and beliefs, as well as value judgements based on facts, do not constitute personal data and the DPA would not be competent to assess whether an individual has violated the Icelandic C