DPA case Case no. 2021101924 – Complaint Upheld (Iceland, 2022)

Signet, the controller, is a web portal which allows its users to digitally sign and verify documents. At the time of the processing of the data subject's personal data, which is the complainant in this case, the controller used, among other things, the sharing of its users' email addresses and social security number to verify that the service connects parties securely and to ensure that documents are transferred between the correct recipients. Every user of the service gained access to this personal data. Crucially, the social security number is not stored on Signet but on the national register of Iceland. Signet, however, is an access provider to the national register. The concrete mechanisms of how the security was achieved through public access to the email addresses and social security numbers was not explained in detail, neither in the case nor on the service's website. The concerned data subject had used Signet to sign a document. For that purpose, the data subject had shared her social security number and email address with the controller. The controller published the personal data and made it available to all Signet users. Subsequently, the data subject sent a complaint to the Icelandic DPA about the processing of her data, argued that the controller had processed her personal data without a legal basis. Moreover, the data subject maintained that the processing was unlawful, unfair, not appropriate and far beyond what is necessary (see the GDPR principles in Articles 5(1)(a) and (5)(1)(b) GDPR). Additionally, the controller had not complied with its information duties pursuant to Article 13 and 14 GDPR. No information about the processing of personal data appear in the terms of use and the privacy policy was not referred to when the data subject logged into the system. The controller responded that they had processed the personal data based on the data subject's consent. When first accessing the service, the data subject had agreed to the terms of use.