DPA case 2021091877 – Complaint Upheld (Iceland, 2023)

A Facebook user, the controller, published photos and police reports that were part of an investigation file of a criminal case, including sensitive data about a data subject, in a Facebook post on his profile in which he gave his opinion on the case. The data subject, who was a victim or a witness in the criminal case, filed a complaint with the Icelandic DPA. In his submissions, the controller stated that he did not process personal data of the data subject because he merely expressed his opinion on the case. This conduct is covered by the fundamental freedom of expression. First of all, the Icelandic DPA made a preliminary remark. On the one hand, it considered that it generally has no competence to decide on cases relating to freedom of expression, hence it could not take a stance on the text of the post itself, as it constitutes the controller's expression of his opinion. According to the DPA, it is up to courts to assess the scope of such freedom and balance it against the right to data protection under the Icelandic constitution and [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 10 ECHR]. On the other hand, however, the DPA considered itself competent to decide on the processing of personal data by the controller. After stating that the GDPR applied, since the post was accessible to all Facebook users, and did not constitute processing for private purposes, the DPA considered that the user was also a controller under Article 4(7) GDPR. The DPA clarified that the police files were meant to be kept secret and it could not ascertain how the controller got hold of the documents as he was unrelated to the criminal case. The DPA went on to assess the legality of processing under Article 6(1)(f) GDPR and carried out a balancing exercise between the interests at stake. The DPA considered that, since the controller was neither a party to the criminal investigation, nor should he have accessed the police files, it could not be held that his i