Creditinfo (IS) – Dismissed (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Iceland's data protection authority dismissed a complaint against Creditinfo for allegedly publishing credit information without proper notice. The authority found that Creditinfo had followed the rules by sending a notification letter, which was not returned. This case highlights the importance of keeping accurate contact details to ensure proper communication.
What happened
Creditinfo was accused of publishing credit data without notifying the individual, but evidence showed a notification letter was sent.
Who was affected
The affected person was an individual whose credit information was published by Creditinfo.
What the authority found
The authority concluded that Creditinfo had complied with its obligations by sending a notification letter, which was not returned.
Why this matters
This decision underscores the importance for companies to maintain accurate address records to ensure notifications reach individuals. It also shows that authorities may dismiss complaints if companies can prove they followed notification procedures.
GDPR Articles Cited
National Law Articles
Entities Involved
In Iceland, the processing of personal data relating to the creditworthiness of individuals is regulated, among others, by Article 2 of Regulation no. 246/2001 as well as Article 15 of the Icelandic Data Protection Act no. 90/2018. In particular, companies willing to publish information relating to the creditworthiness of individuals must first obtain an operating license from the Icelandic DPA, which sets out specific terms for the processing of personal data for the purpose of credit scoring. Such a license was delivered by the Icelandic DPA to the company Creditinfo on 29 December 2017. According to the terms of this operating license, Creditinfo had to, prior to the publication of any financial data relating to individuals, inform them by sending an information notice by letter. The operating license does not require such letters to be registered letters. The information notice is supposed to give to data subjects the opportunity to present objections (for example, if the data are inaccurate or incomplete, or if a settlement had been reached). On 28 December 2020, the Icelandic DPA received a complaint from a data subject (hereinafter the Complainant) regarding the publication of information about him in the default register of Creditinfo. The Complainant claimed that he hadn't received any information prior to the publication of these data, and that, in spite of his erasure request, Creditinfo had refused to delete the concerned data. Creditinfo, for its part, was arguing that a letter dated March 16, 2020, had been sent to the complainant, and provided evidence thereof to the Icelandic DPA. Credit info further specified than in case the individual does no longer live at the indicated address, the letter is normally returned, and the address is corrected by taking into account the data of the National Registry. In that case, however, Creditinfo informed the Icelandic DPA that the letter had not been returned. After analysing the facts of the case, the Ice
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Creditinfo (IS) in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Creditinfo (IS) - Iceland (2021). Retrieved from cookiefines.eu
Last updated: