Creditinfo (IS) – Dismissed (Iceland, 2021)

In Iceland, the processing of personal data relating to the creditworthiness of individuals is regulated, among others, by Article 2 of Regulation no. 246/2001 as well as Article 15 of the Icelandic Data Protection Act no. 90/2018. In particular, companies willing to publish information relating to the creditworthiness of individuals must first obtain an operating license from the Icelandic DPA, which sets out specific terms for the processing of personal data for the purpose of credit scoring. Such a license was delivered by the Icelandic DPA to the company Creditinfo on 29 December 2017. According to the terms of this operating license, Creditinfo had to, prior to the publication of any financial data relating to individuals, inform them by sending an information notice by letter. The operating license does not require such letters to be registered letters. The information notice is supposed to give to data subjects the opportunity to present objections (for example, if the data are inaccurate or incomplete, or if a settlement had been reached). On 28 December 2020, the Icelandic DPA received a complaint from a data subject (hereinafter the Complainant) regarding the publication of information about him in the default register of Creditinfo. The Complainant claimed that he hadn't received any information prior to the publication of these data, and that, in spite of his erasure request, Creditinfo had refused to delete the concerned data. Creditinfo, for its part, was arguing that a letter dated March 16, 2020, had been sent to the complainant, and provided evidence thereof to the Icelandic DPA. Credit info further specified than in case the individual does no longer live at the indicated address, the letter is normally returned, and the address is corrected by taking into account the data of the National Registry. In that case, however, Creditinfo informed the Icelandic DPA that the letter had not been returned. After analysing the facts of the case, the Ice