DPA case 2021101915 – Dismissed (Iceland, 2023)

After suffering mental abuse and threats, person A (controller) recorded telephone calls from her ex-partner (and father of her child) B and forwarded the evidence to the police, lawyers and the public prosecutor. B, the data subject, stated that these recordings were made without his knowledge and consent. He therefore lodged a complaint with the Icelandic DPA. The DPA distinguished between two operations: the recording of phone conversations and their transmission to the police. For the recording of the phone calls, the DPA explained that the processing of data by an individual that only concerns his or her private interests or those of his or her family is not subject to the GDPR. However, the transfer of the recordings to the police was subject to the GDPR as they were outside the private sphere. The DPA considered that it was necessary to transfer the recordings to the police for A's safety. A therefore demonstrated a legitimate interest in the processing in accordance with Article 6 GDPR which superseded B's interest in protecting his privacy. The DPA also found that the principle of minimisation of Article 5(1)(c) GDPR was respected. As regards the right to information under Article 13 GDPR, the DPA balanced B's interest in receiving this information against the controller's (A) urgent interest in informing the police. It concluded that Controller A was not obliged to provide the information under Article 13. In conclusion, no violation was found and the complaint was therefore rejected.