Notice from the City of Hafnarfjörður

Notice from the City of Hafnarfjörður regarding the decision of the Data Protection Authority in case 2015/241 (the transfer of personal data from Vodafone to the City of Hafnarfjörður and its processing)

The conclusion of the Data Protection Authority was that the City of Hafnarfjörður had a legitimate interest in requesting information from Vodafone at the time in question for the investigation of an alleged security breach at the City Hall of Hafnarfjörður, and that their processing had been in accordance with the Personal Data Act no. 77/2000. The City of Hafnarfjörður considers it important that the Data Protection Authority has confirmed that it was permissible to obtain information that could concern security matters at the Town Hall. On the other hand, the Data Protection Authority considered that it was not sufficient, due to the so-called duty to inform, to provide information solely about the investigation at a meeting of the town council. The individuals who appeared on the Vodafone list should have been specifically informed, but the City of Hafnarfjörður had, however, deleted it after it became clear that the information requested was not on the list.  It should be noted that the complaints of two of the three complainants were dismissed by the Data Protection Authority as the matter did not concern them, whereas the third individual was wrongly included on the list in question for specific reasons.  In accordance with the guidance of the Data Protection Authority, the City of Hafnarfjörður will take steps to inform the individuals concerned about the processing carried out by the city.

 The decision of the Data Protection Authority can be found on the authority's website at the following address. 
http://www.personuvernd.is/efst-a-baugi/urskurdir-og-alit/2015/nr/2042