Creditinfo Lánstrausti hf. – €257,427 Fine (Iceland, 2023)

A credit scoring company - Creditinfo Lánstrausti hf. (the controller) - processes information on financial matters and the creditworthiness of individuals and businesses. A company offering so-called "small loans" - eCommerce 2020 ApS - provided information to the controller on non-payments of small loans which the controller then registered. The controller conducts its business on the basis of an business license. According to the license terms there are conditions that must be met when information about defaults should registered by the controller: inter alia, the registration must be prominent and clear and the payment default must have lasted for at least 40 days. Further, that information about non-payment is registered only when the amount reaches a certain minimum amount. The Consumers' Association of Iceland filed a complaint with the Icelandic DPA against the controller about the controller’s processing of personal data in connection with the registration of non-payment of the small loans. The association claimed in its complaint that the controller registered registered non-payments for such loans despite the fact that the interest and costs of the loans had violated consumer credit legislation. The controller operating in this way was argued to go against the principle of lawfulness pursuant to Article 5(1)(a) GDPR. The controller claimed to have a legitimate interest to the said processing of personal data pursuant to Article 6(1)(f) GDPR which the controller's balancing of interests assessment supported. In its investigation, the DPA considered that the relevant terms of the controller’s operating license must be considered in this case. According to the license terms, the original documents connected to the loan must always be examined and a position taken as to whether the conditions for registration are met in individual cases. The DPA viewed that the controller has a special obligation to check whether the requirements for registering non-payments on the basis of information received by eCommerce 2020 ApS have been met. Furthermore, the DPA considered that, in light of the accountability principle enshrined in Article 5(2) GDPR, the fact whether the controller examined the original terms of loans connected with its registration of non-payment to be relevant. Moreover, it was revealed during the course of the investigation that the controller had registered, on the basis of information received by eCommerce 2020 ApS, non-payments of 577 individuals which were below the required minimum amount according to the business license. Due to the investigation, that information was later deregistered for this reason. The DPA also examined the terms of the loans granted by eCommerce 2020 ApS, and found out that the terms did not include any provision stating that non-payment (for 40 days) leads to registration of non-payment at the controller’s company. Eventually, the DPA found that the said processing of personal data by the controller breached the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR. Additionally, it held that the controller breached the accountability principle pursuant to Article 5(2) GDPR and did not comply with Article 6(1)(f) GDPR as the controller could not rely on legitimate interests for its processing operations. An administrative fine of 37,856,900 ISK (approx. €257,660) was imposed on the controller.