DPA case 2021061342 – Dismissed (Iceland, 2024)

A policeman was assigned to supervise a public CCTV. He recorded footage from that CCTV and shared it with his colleagues. The footage showed a data subject. The data subject lodged a complaint with the Islandic DPA (Persónuvernd) against the Police (the controller). According to the data subject, unauthorised persons had access to their personal data, in particular data subject’s location and travel habits. Allegedly, the footage was also shown to the data subject's colleagues. Also the data subject claimed the policeman recorded the footage using his phone. The Inspector General of Police explained that the data subject was suspected of not abiding the law. Because of that, it was necessary to inform policemen about the data subject’s movement in a specific area. Also, it was denied that the sharing of data subject’s data with their colleagues took place. The policeman disclosed the data only orally. The DPA dismissed the case. Firstly, the DPA underlined that processing activities performed by the police or other law enforcement authorities were in principle covered by [https://www.althingi.is/lagas/nuna/2019075.html the Law on processing of personal information for law enforcement purposes] (lög nr. 75/2019 um vinnslu persónuupplýsinga ílöggæslutilgangi). Secondly, the DPA found there was no proof the alleged violations occurred. There was no basis to claim that the processing fell within the scope of the law on processing of personal information for law enforcement purposes, since the alleged disclosure was done orally. Moreover, the disclosure of personal data orally was also not covered by [https://www.althingi.is/lagas/nuna/2018090.html the Law on protection of personal information (Lög nr 90/2018 um persónuvernd og vinnslu persónuupplýsinga).]