Creditinfo Lánstrausts – Dismissed (Iceland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Icelandic Data Protection Authority dismissed a complaint against Creditinfo Lánstrausts. The complaint involved the use of credit reports and personal data sharing without proper notification. The authority found that Creditinfo's actions were in line with GDPR rules.
What happened
Creditinfo Lánstrausts was accused of improperly sharing credit reports and personal data without notifying individuals.
Who was affected
Individuals whose credit information was processed and shared by Creditinfo Lánstrausts.
What the authority found
The Icelandic DPA found that Creditinfo Lánstrausts processed personal data in compliance with GDPR articles 5 and 6.
Why this matters
This decision highlights the importance of ensuring credit assessments comply with GDPR, but also shows that not all complaints lead to penalties if the company follows the rules. Businesses should ensure transparency and proper notification in data processing.
GDPR Articles Cited
Entities Involved
Following, complaints about the processing of personal data by Creditinfo Lánstrausts to issue reports on creditworthiness, for Netgíró ehf to use these reports, as well as the dissemination of personal data by the IL fund in the Creditinfo debt ranking system. The Icelandic DPA found that a credit assessment took place in accordance with articles 5 and 6 GDPR. In December 2020, the DPA received a complaint by the complainant that their authorisation had been invoked by Netgíró ehf. (the controller) due to credit rating information given by Creditinfo Lánstrausts without prior to informing the claimant i.e. data subject of data transmission. The data subject argued that to gain access to Creditinfo's information about themself, they had to agree to the company's use of certain additional information from its debt position system when calculating their credit rating. Additionally, Creditinfo allegedly used incorrect information from the debt position system in the calculation, as the IL fund communicated information to the system about the complainant's debt to the fund even though they had already paid the debt in question. Netgíró ehf. have been prohibited from using information about Creditinfo's credit rating, which has been incorrectly calculated, and that the company is obliged to notify the borrower (this case the complainant) in advance when it intends to cancel the borrower's authorization due to changes in Creditinfo's credit rating. The defendants in this case argued that the data subject had in fact been notified and reminded that they can withdraw their consent at any point and that Creditinfo was considered a processor in the debt position system. The DPA held that the processing of financial data is considered personal data and falls under the authority of the DPA. The DPA is responsible for monitoring the implementation of Act No. 90/2018, on Data Protection and the Processing of Personal Data, Regulation (EU) 2016/679 (General Data Protection Re
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Creditinfo Lánstrausts in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Creditinfo Lánstrausts - Iceland (2022). Retrieved from cookiefines.eu
Last updated: