The Data Protection Authority

Information in english

General Introduction

General Introduction concerning Act no. 77/2000 on The Protection of Privacy as regards the Processing of Personal Data as well as on the functions of the Data Protection Authority.


The Personal Data Act and other relevant acts and rules:

Act no. 77/2000 on The Protection of Privacy as regards the Processing of Personal Data; as amended

Act on Biobanks no. 110/2000

Act on the Schengen Information System in Iceland, no. 16/2000.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (EUR-Lex)

Rules no. 837/2006 on Electronic Surveillance.

Rules no. 698/2004 on The Obligation to Notify and Processing which requires a Permit.

Rules no. 299/2001 on security of personal data

Regulation no. 322/2001 on Management of Personal Information by the Police

Act on the Rights of Patients no. 74/1997

Translations are un-official and non-verified, unless otherwise stated.

General overview on the conduct of audits

Monitoring data controllers and ensuring that they take appropriate security measures, in accordance with law, is an important part of the DPA´s work on law-enforcement. Further information on the subject can be found here.

The audits are conducted within the framework of rules no. 299/2001, on security of personal data, which incorporate, in a very simplified form, the methodology of the International Standard ISO/IEC 17799 "Information Tecnhology - Code of Practice for information security management".


Miscellaneous; answers to inquiries, opinions, rulings e.tc.:

The Data Protection Authority has given the following answers to a questionnaire from the International Bioethics Committtee (UNESCO), concerning the Revised Outline of the International Declaration on Human Genetic Data.

The Data Protection Authority´s reply of May 14, to a JSB-Europol questionnaire "Data Protection and the Police".

Excerpt from the JSA-Schengen quide for exercising the right of access (Iceland).

For further information regarding the Schengen Information System, see the JSA website

Information Brochure on the Schengen Information System. (pdf)


The Data Protection Authority's answers to a questionnaire on the processing of medical data by pharmaceutical companies, mainly concerning conditions under which clinical trials, safety surveys and post-market studies are allowed.

Answers about the right to privacy and judgements given by the Supreme Court on that matter.

Information / Documents concerning the Icelandic Health Sector Database:

An excerpt from a judgement by the Supreme Court of Iceland, of November 27, 2003, concerning The Health Sector Database (HSD)

Act on a Health Sector Database no. 139/1998

Governmental Regulation on the Health Sector Database

General security terms set by the Icelandic Data Protection Commission

Methodology

Security Target