Landsbankinn hf. – Dismissed (Iceland, 2022)

On 27 April 2021, Landsbankinn hf., a bank and the alleged controller, received an access request from the complainant, the data subject, regarding personal data which the bank may have. More specifically, the data subject requested access to the email communication of the bank's employees that had him as a subject. The communication took place through office email addresses but did not concern the bank's operations. The bank provided the data subject with a copy of all the personal information processed in the bank's activities. However, it rejected the request to the extent that it concerned the e-mail communication of its employees, stating that another controller is concerned, namely, a workers' union. The data subject is a former member of the union and, in the bank's opinion, the data subject's request for access to the emails of employees of the bank, related to their confidential duties for the union, is not made in good faith. The bank speculated that the complainant is trying to access personal information from the activities of a third party through the bank. The data subject responded that the bank's arguments for refusing his access request do not stand up to scrutiny. The data request is directed to the bank because it is known that the bank's email address was used for the processing and distribution of information about the data subject and, therefore, the request is rightly directed to it. In the opinion of the data subject, it is unreasonable that he was advised to contact an unrelated non-governmental organization in order to gain access to data stored in a mailbox operated by the bank. The Icelandic DPA held that the bank was not the controller for the purposes of the email communication requested by the data subject. According to Article 4(7) GDPR, "controller" refers to an individual, legal entity, government or other entity that alone or in cooperation with others determines the purposes and methods of processing personal data. In the data subject's right of access request to the bank, two of its employees are listed, who are also board members of a workers' union. The data subject requested a copy of their e-mail communications with third parties concerning the him. It is clear from the documents of the case that the aforementioned e-mail communications which discussed the data subject concerned the work of the persons in question for the union. The DPA held that similar considerations apply to the e-mail communications in question as apply to the handling of employees' private e-mails that are not related to the employer's activities. Taking into account Article 9 of the Icelandic regulations no. 837/2006 on electronic monitoring and handling of personal information generated during electronic monitoring, employers are prohibited to view employees' personal e-mail unless it is absolutely necessary, such as due to a computer virus or a similar technical incident. Accordingly, the e-mail communication in question is irrelevant to the bank, as they do not concern its operations. The bank cannot assess the data subject's right to access about this data since that assessment falls under the union as the controller of the data.