DPA case 2020051637 – Dismissed (Iceland, 2021)

The DPA received a complaint over the request of Sjúkratryggingar Íslands for a copy of the complainant's airline tickets for her application for reimbursement of foreign medical expenses. The complainant stated that Sjúkratryggingar's claim does not comply with the law. Sjúkratryggingar stated that the institution's authorization to process personal information in connection with the registered person's case is based on point 3. Paragraph 1 Article 9 Act no. 90/2018, where the processing is necessary to fulfill the legal obligation that rests on the institution according to Art. a laga nr. 112/2008 on health insurance and Regulation no. 484/2016 on health services applied for within the member state of the EEA Agreement but which can be provided in Iceland and on the role of a national contact person for cross-border health services. The DPA considered the acquisition of airline tickets for the purpose of demonstrating the length of the applicant's stay in a foreign country can be considered necessary in connection with the statutory implementation of Sjúkratryggingar's projects. The DPA concluded that Sjúkratryggingar's collection of personal information about the complainant, which consisted of obtaining a copy of her flight tickets, can be based on the authorization in point 5. Article 9 Act no. 90/2018 and Article 6 of the GDPR.