- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case Case no. 2021010248 – Dismissed (Iceland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic website that holds genealogical data rejected a request to delete personal information from a user and her child. The data controller argued that the information was important for historical research. This case highlights the balance between personal privacy and public interest.
What happened
A request to delete personal data from a genealogical database was denied.
Who was affected
A user and her minor child whose data was included in the genealogical database.
What the authority found
The Icelandic Data Protection Authority upheld the decision to deny the deletion request, citing the importance of the data for public interest research.
Why this matters
This ruling underscores the tension between individual privacy rights and the value of data for historical and scientific purposes. It serves as a reminder for organizations to carefully consider the implications of data retention.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller maintained the website "Íslendingabók". The website was a database containing genealogical information about the inhabitants of Iceland, dating back more than 1,200 years. A data subject sent a request for deletion of her and her minor child's personal data to the controller. The controller rejected the request, prompting the data subject to complain to the Icelandic DPA. The data subject asked the DPA to decide that the controller was not allowed to register, save, process, publish, and share personal information about her and her child in any possible way. The data subject argued that she did not give her consent for personal information about her and her minor child to be recorded and published in the Íslendingabók. In addition,she was not informed about that in advance. The controller, on the other hand, responded that since the database concerned genealogical research, which is a type of scientific and historical research, its data processing could be conducted under the legal basis of Article 6(1)(e) GDPR. The controller also argued that it had a legitimate interest in processing the personal data which overrode the interests of the data subjects to have their data deleted. The controller pointed out that they promote genealogical research in Iceland by running the database: "Genealogical research, which has been carried out in Iceland for centuries, is very popular with the public and is one of the main pillars of the nation's cultural heritage. In addition, genealogical research is one basis and prerequisite for extensive research in the field of human genetics in this country." In its rejection of the data subject's erasure request, the controller relied on Article 17(3)(d) GDPR. The provision allows controllers to reject erasure requests if the personal data concerned is processed for archiving purposes in the public interest, scientific, historical research or statistical purposes The Icelandic DPA rejected the complaint. The DPA held
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Case no. 2021010248 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Case no. 2021010248 - Iceland (2022). Retrieved from cookiefines.eu
Last updated: