Creditinfo Lánstraust – Dismissed (Iceland, 2020)

The Icelandic credit report agency "Lánstraust" is the data controller. The complainant had debts in the past which he paid. Therefore, he argues that the data controller is not authorized to use his payment history information when making a credit rating. Whether the data controller was lawfully processing payment history data of the complainant. The DPA held that the data controller was authorized to process the payment history data on the basis of legitimate interests which outweigh the fundamental rights and freedoms of the data subject. The court emphasized that the issue in question is subject of the implementation of the Data Protection Act and of resolved case. Further, applicable Icelandic law requires that a consumer's creditworthiness be assessed prior to the granting of a consumer loan and state, inter alia, that information from the financial information databases may be used for this purpose. According to the applicable law, the processing of personal data relating to four years from the date of its registration is permitted.