Landspítali – The National University Hospital of Iceland – Violation Found (Iceland, 2021)

Since 2015, the Icelandic health authorities had appointed Landspítali Hospital (the Hospital) to conduct border and domestic screening to monitor the spread of infectious diseases. It was agreed that the Hospital was allowed to subcontract services in order to carry out this screening. In June 2020, the Hospital sought the services of a company named Icelandic Genealogy (IG) to conduct COVID-19 screening tests. A Data Protection Impact Assessment (DPIA) was carried out by the Icelandic Medical Director of Health (the Director) in consultation with the Icelandic DPA. The DPA observed that there was no indication that this processing would violate the GDPR. As a result, the Hospital outsourced part of the testing and screening activities to IG. However, in August 2020, the Hospital publicly announced that they would temporarily relocate part of their own staff to IG’s facilities to use some of their equipment and software (Virlab) in order to increase their screening capacity. Following this announcement, the Icelandic DPA asked the Hospital for specific information regarding security measures related to the processing of personal data, and whether a new DPIA had been carried out by the Hospital before relocating part of their staff to IG’s facilities. The Hospital disregarded this request, and related part of its staff to IG’s facilities, as planned. The DPA reiterated their request in September 2020. The Hospital then responded to the DPA, apologising for the delay, and explaining that they had began using IG’s facilities expeditiously in order to respond to the increased demand in sampling due to the pandemic. The Hospital also stated that they had not conducted a new DPIA because they considered that the previous DPIA applied to the processing that would now temporarily take place at IG’s facilities. However, prior to the transfer of some staff members to IG’s facilities, IG only had access to sample numbers sent by the Hospital. Once part of the Hospital's staff started working in IG’s facilities and using their equipment, the IG’s Virlab system registered the names of individuals who had tested positive in border screening, as well as identification codes from samples taken at health centres which could be traced back to the individuals concerned. IG’s staff did not have access to this personal data as registered in the Virlab system, except for three employees involved in its design, programming and making necessary updates. In November 2020, the DPA began an investigation, auditing the Hospital and IG in order to determine whether the new processing operations conducted by the Hospital's staff at IG’s facilities was compliant with the GDPR. The Icelandic DPA found that the Director and the Hospital failed to comply with Article 35(1) GDPR by not conducting a new DPIA. The DPA held in particular that a new DPIA should have been carried out due to fact that the Hospital would now be processing personal data using IG’s facilities and Virlab system, which gave some IG employees access to that additional data. It explained that the initial DPIA could not be applied to these new circumstances. Previously, IG’s staff only had access to sample numbers which did not include personal data or data that could be traced back to an individual, so the circumstances were not comparable. The DPA also held that, despite the absence of a new DPIA, there had been no violation of Article 24(1) and (2) GDPR (responsibility of the controller), Article 25 GDPR (privacy by design and by default) or of Article 32 GDPR (obligation to implement appropriate technical and organisational measures to ensure the security of the processing). The DPA found indeed that the processing of the personal data at IG's facilities did not lead to a security breach, taking into account the fact that only 3 IG staff members had access to the personal data stored in Virlab, and that this access was necessary for the programming and maintenance of the software. However, the DPA did reprimand the Hospital for not complying with answering their questions related to the security of personal data prior to the transfer of their staff to IG’s facilities. The DPA reminded the Hospital that the GDPR must be complied with even in the context of the COVID-19 pandemic, as already stressed by the European Data Protection Board in its “Statement on the processing of personal data in the context of the COVID-19 outbreak” issued on March 19, 2020. The Icelandic DPA however stated that it was aware of the pressure that the Icelandic health authorities have been under since the outbreak of the pandemic and, in view of these special circumstances, it would not take further action in this case.