Creditinfo Lánstraust – Dismissed (Iceland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic data protection authority dismissed a complaint against a credit report agency for using a person's past payment history. The agency was found to have a legitimate reason to process this data. This decision shows that credit agencies can use historical payment data if they have a valid interest.
What happened
The Icelandic DPA dismissed a complaint about a credit agency using past payment history in credit ratings.
Who was affected
A person who had previously paid off debts and objected to the use of their payment history in credit assessments.
What the authority found
The DPA found that the credit agency was allowed to use the payment history data based on legitimate interests that outweighed the individual's privacy rights.
Why this matters
This case clarifies that credit agencies can process payment history data if they have a legitimate interest, as long as it aligns with consumer protection laws. It highlights the balance between business needs and individual privacy rights.
The Icelandic credit report agency "Lánstraust" is the data controller. The complainant had debts in the past which he paid. Therefore, he argues that the data controller is not authorized to use his payment history information when making a credit rating. Whether the data controller was lawfully processing payment history data of the complainant. The DPA held that the data controller was authorized to process the payment history data on the basis of legitimate interests which outweigh the fundamental rights and freedoms of the data subject. The court emphasized that the issue in question is subject of the implementation of the Data Protection Act and of resolved case. Further, applicable Icelandic law requires that a consumer's creditworthiness be assessed prior to the granting of a consumer loan and state, inter alia, that information from the financial information databases may be used for this purpose. According to the applicable law, the processing of personal data relating to four years from the date of its registration is permitted.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Creditinfo Lánstraust in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Creditinfo Lánstraust - Iceland (2020). Retrieved from cookiefines.eu
Last updated: