Creditinfo Lánstrausti hf. – €257,427 Fine (Iceland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Creditinfo Lánstrausti hf. was fined for improperly registering loan defaults based on information from eCommerce 2020 ApS. They registered defaults even when the conditions for doing so were not met, violating data protection rules. This case serves as a reminder for credit scoring companies to adhere strictly to legal requirements.
What happened
Creditinfo Lánstrausti hf. registered loan defaults despite not meeting the necessary conditions outlined in their business license.
Who was affected
Individuals and businesses whose loan defaults were improperly registered by Creditinfo Lánstrausti hf.
What the authority found
The Icelandic DPA found that Creditinfo Lánstrausti hf. failed to comply with the legal conditions for registering non-payments.
Why this matters
This ruling highlights the need for credit scoring companies to follow strict guidelines when processing personal data. Companies should ensure they comply with all legal requirements to avoid penalties.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A credit scoring company - Creditinfo Lánstrausti hf. (the controller) - processes information on financial matters and the creditworthiness of individuals and businesses. A company offering so-called "small loans" - eCommerce 2020 ApS - provided information to the controller on non-payments of small loans which the controller then registered. The controller conducts its business on the basis of an business license. According to the license terms there are conditions that must be met when information about defaults should registered by the controller: inter alia, the registration must be prominent and clear and the payment default must have lasted for at least 40 days. Further, that information about non-payment is registered only when the amount reaches a certain minimum amount. The Consumers' Association of Iceland filed a complaint with the Icelandic DPA against the controller about the controller’s processing of personal data in connection with the registration of non-payment of the small loans. The association claimed in its complaint that the controller registered registered non-payments for such loans despite the fact that the interest and costs of the loans had violated consumer credit legislation. The controller operating in this way was argued to go against the principle of lawfulness pursuant to Article 5(1)(a) GDPR. The controller claimed to have a legitimate interest to the said processing of personal data pursuant to Article 6(1)(f) GDPR which the controller's balancing of interests assessment supported. In its investigation, the DPA considered that the relevant terms of the controller’s operating license must be considered in this case. According to the license terms, the original documents connected to the loan must always be examined and a position taken as to whether the conditions for registration are met in individual cases. The DPA viewed that the controller has a special obligation to check whether the requirements for registering non-pa
Related Enforcement Actions (0)
No other enforcement actions found for Creditinfo Lánstrausti hf. in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Creditinfo Lánstrausti hf. - Iceland (2023). Retrieved from cookiefines.eu
Last updated: