DPA case 2020010708 – Dismissed (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Iceland's data protection authority dismissed a complaint against Creditinfo about using old debt information in credit reports. This matters because it shows that companies can use certain data for credit assessments as long as they follow the rules.
What happened
A complaint was filed against Creditinfo for using settled debt information in credit reports.
Who was affected
An individual whose credit rating was affected by the use of old debt information.
What the authority found
The authority ruled that Creditinfo was allowed to use the old debt information as it was within the legal timeframe for reporting.
Why this matters
This case clarifies that companies can use historical data for credit assessments, but they must ensure compliance with data protection rules. Businesses should be aware of how long they can retain and use personal data.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 18 December 2019, the DPA received a complaint from regarding the processing of personal information about a data subject by a credit rating company Creditinfo, in connection with the preparation of reports on his credit rating. According to the complainant, for the purposes of the credit rating, Creditinfo stored and used information about his previous defaults with a bank, despite the fact that they have been settled for a long time. The complainant had requested a correction of the assessment, as he found information on his previous defaults unreliable and misleading. He demanded to stop the processing in the Creditinfo default register and requested information on the method used to calculate his credit rating. According to Creditinfo, its current operating license states that information on individual debts should be deleted if it is known that they have been returned. Information from the register shall be deleted when it is four years old. The company may store information for additional three years and may use the information to comply with requests from registered individuals. The previous registrations that had affected the complainant's credit rating at the time the complaint was filed were dated 27 June 2017 and 14 June 2018 and were therefore less than four years old. Creditinfo's credit rating assesses the probability of default and registration in the default register over the next twelve months. Statistical predictions for future events must be based on historical information, such as returns and payment history. The DPA had several times before that Creditinfo was permitted to use information on previous entries in the default register when preparing credit ratings for individuals. Creditinfo was not obliged by law to consider the income and assets of individuals when preparing reports on the creditworthiness of individuals. Regarding the complainant's demands to stop the processing of information about him by Creditinfo, the DPA had previ
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020010708 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020010708 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: