Landsbankinn hf. – Dismissed (Iceland, 2022)

On 27 April 2021, Landsbankinn hf., a bank and the alleged controller, received an access request from the complainant, the data subject, regarding personal data which the bank may have. More specifically, the data subject requested access to the email communication of the bank's employees that had him as a subject. The communication took place through office email addresses but did not concern the bank's operations. The bank provided the data subject with a copy of all the personal information processed in the bank's activities. However, it rejected the request to the extent that it concerned the e-mail communication of its employees, stating that another controller is concerned, namely, a workers' union. The data subject is a former member of the union and, in the bank's opinion, the data subject's request for access to the emails of employees of the bank, related to their confidential duties for the union, is not made in good faith. The bank speculated that the complainant is trying to access personal information from the activities of a third party through the bank. The data subject responded that the bank's arguments for refusing his access request do not stand up to scrutiny. The data request is directed to the bank because it is known that the bank's email address was used for the processing and distribution of information about the data subject and, therefore, the request is rightly directed to it. In the opinion of the data subject, it is unreasonable that he was advised to contact an unrelated non-governmental organization in order to gain access to data stored in a mailbox operated by the bank. The Icelandic DPA held that the bank was not the controller for the purposes of the email communication requested by the data subject. According to Article 4(7) GDPR, "controller" refers to an individual, legal entity, government or other entity that alone or in cooperation with others determines the purposes and methods of processing personal data. In the dat