Complainant – Dismissed (Iceland, 2022)

The dispute concerns an issue where the research company Gallup (the controller) looks up data subjects' phone numbers on the online database www.ja.is and stores these in their internal database, to be able to call the data subjects and invite them to participate in surveys. A data subject lodged a complaint against this processing of their personal data, arguing that they never agreed to the processing, nor did the controller inform them about the processing and purposes for the processing. The controller claimed that the processing of personal data in question was necessary because of their legitimate interests in ensuring sufficient research quality and participation rate, including allowing for all adult citizens to have an equal opportunity to respond to national registry surveys. Even without a database, the controller would have to research and call participants. Further, the controller stored personal data in a do-not-call list to avoid contacting data subjects again who had previously objected to this. The controller concluded that the disadvantages for the processing activities were minimal for the data subjects. The Icelandic DPA rejected the complaint. The DPA noted that pursuant to Article 6 GDPR, personal data may be processed if it is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data are outweighed. Based on this provision, the DPA agreed with the controller that if they had to look up the phone numbers of every single person in the national register sample for every survey, it would entail a lot of time-consuming work and could have a negative effect on the quality of research. In addition, Gallup uses the phone number database to keep track of those individuals who have declared to the company's staff that they no longer wish to be invited to participate in the company's research. The DPA therefore he