- Enforcing jurisdiction
- Iceland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case Mál nr. 2021091751 – Dismissed (Iceland, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Icelandic man complained that the police kept his personal data after an investigation against him was dropped. This case is significant because it highlights the importance of timely data deletion by authorities.
What happened
The police retained personal data of a man even after his investigation was closed.
Who was affected
An individual whose personal data was kept by the police after the investigation against him ended.
What the authority found
The Icelandic DPA found that the police had already deleted most of the man's data but acknowledged that the response time could have been better.
Why this matters
This case emphasizes the responsibility of law enforcement to delete unnecessary personal data promptly. It serves as a reminder for all organizations to handle data deletion requests efficiently.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
During the police investigation against the data subject, data was copied from electronic devices in his possession, i.e. of phone and computer. After the investigation against the data subject was stopped, he sent a request to the police, and requested that the personal information stored about him be deleted and a list of those who had access to it be sent to him. The police responded that they would do so, but according to the data subject, he did not receive an answer. The data subject complained to the DPA that the Icelandic police had kept his personal information even after an investigation against him was cancelled. Moreover, in his opinion, his requests for the deletion of the information were not answered within a reasonable time. The DPA invited the police to respond to the complaint. The police replied that the data subject's personal data had already been deleted with the exception of 80 recordings that were found on his phone and had been specially marked as evidence. It is also said that the data subject was informed of the above by letter. In light of the fact that the police had already agreed to the data subject's request for the deletion of the information by letter, the data subject was asked by the DPA whether there was still a dispute. The data subject replied that his complaint was based on the fact that he had to request that personal information about him, which had been irrelevant to the investigation, be deleted instead of it being deleted at the initiative of the police department. In addition, the police should have taken less time to reply to him. The police then submitted further evidence, arguing that the data subject had requested the deletion of the information by e-mail dated 28 July 2021, and that it had been dealt with and the data subject informed by the 16 September 2021. The reason for the delay was that during the investigation of the criminal case, it was not known whether all electronic data had weight. Moreover, the summer
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Mál nr. 2021091751 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Mál nr. 2021091751 - Iceland (2023). Retrieved from cookiefines.eu
Last updated: