Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to

The Data Protection Authority has ruled in a case where a complaint was filed regarding, on the one hand, the transmission by the Agricultural Association of Iceland of the complainant's personal data from the WorldFeng database to Horseday ehf., and on the other hand, the company's subsequent processing of the same data in the Horseday app.WorldFeng is, on the one hand, the studbook for the Icelandic horse and, on the other hand, the official herdbook for horses in Iceland. Generally, the processing of personal data in WorldFeng is very limited, which, in the complainant's case, was limited to information about her ownership of horses. Horseday is an app for horse enthusiasts, a kind of daily journal for the horse regarding its care and training. The app uses basic information about Icelandic horses from WorldFeng.The Personal Data Protection Authority concluded that the transmission of the complainant's personal data from the Agricultural Association of Iceland to Horseday ehf. was in compliance with the personal data protection legislation, regarding processing authorizations and principles, to the extent that the agency deemed it necessary to investigate the matter of complaint.

The disclosure was considered necessary for the exercise of official authority and in the public interest.Furthermore, the Data Protection Authority concluded that Horseday ehf. had legitimate interests in processing the personal data in its mobile app, and the company's interests were considered to outweigh the interests or fundamental rights and freedoms of the complainant that require the protection of personal data. However, the Data Protection Authority found that Horseday Ltd.'s processing did not comply with the fairness principle of data protection law, which stipulates that personal data must be processed in a lawful, fair, and transparent manner toward the data subject. In the opinion of the Data Protection Authority, the information provided to the data subjects about the processing of their personal data in the app, which had been retrieved from WorldFeng, was insufficient. The privacy policy information provided by Horseday ehf. only pertained to the company's processing of the app's users' personal data.

Horseday ehf. was instructed to bring its processing into compliance with the aforementioned principle of data protection law.Decision on the complaint regarding the transmission of personal data by the Agricultural Association of Iceland to Horseday ehf. and the subsequent processing of that data by the latter, in case no. 2025010154 (formerly 2024020368):Procedural Matters1. On February 21, 2024, the Personal Data Authority received a complaint from [A] (hereinafter the complainant) regarding the transfer of her personal data from the WorldFeng database, which is operated by the Farmers' Association of Iceland (hereinafter FA or the association), to the Horseday app (hereinafter Horseday or the app), which is owned by Horseday ehf. (hereinafter HD or the company), and the company's subsequent processing of them.2. The Data Protection Authority invited BÍ and HD to comment on the complaint in letters dated January 8, 2025.

BI's responses were received in a letter dated February 12 of that year, along with supporting documents, and HD's responses were received in a letter dated March 10 of that year, along with supporting documents. The complainant was given the opportunity to submit comments on the responses from BÍ and HD by letter dated the 17th of the month, and these were received by email on the 30th of the month. BÍ and HD were invited to comment on the complainant's comments by letters dated April 8 of that year, and responses from HD were received by letter dated April 29, and from BÍ by letter dated May 6 of that year. The complainant was given the opportunity to submit comments on the responses from BÍ and HD by letter dated 13th of the same month, and they were received with letters dated the 25th of the same month. With a letter dated September 30, 2025, the Data Protection Authority requested further clarification from BÍ, and the organization's responses were received with a letter dated October 14 of that year.3.

In resolving the matter, all of the above-mentioned evidence has been taken into account, although not all of it is specifically detailed in the following ruling. Dispute.4. The dispute concerns BÍ's authority to transfer the complainant's personal data from the WorldFeng database to the Horseday app, which is owned by HD. There is also a dispute regarding HD's authority to process the personal data in the company's aforementioned app. Facts of the Case and Submitted Documents 5. The WorldFengur database is, on the one hand, the studbook of origin for the Icelandic horse, operated by the Icelandic Horse Breeding Association (BÍ) pursuant to Regulation No. 442/2011 on the Origin and Breeding of the Icelandic Horse, which was enacted under the authority of the Livestock Act No. 70/1998. However, it is the official herd book for horses in this country according to Regulation No. 916/2012 on the marking of livestock, which was enacted, among other things, with authority from the Livestock Act No. 38/2013 and the Animal Welfare Act No. 55/2013.

Generally, this involves a very limited processing of personal data in the WorldFeng database, which is primarily limited to information about the ownership of horses by an identifiable individual, with a reference to their name as well as the horse's identification number, etc.e. birth number, which can be traced to the registered owner.6. Horseday is an app for horse enthusiasts designed as a kind of journal for the horse regarding its care and training. Horseday uses basic information about Icelandic horses from WorldFeng. Additionally, users can enter information into the app themselves.7. The Agricultural Advisory Center (hereinafter RML) is wholly owned by the Icelandic Equestrian Federation (BÍ) and is the service provider, under a contract with BÍ, for the operation of WorldFeng. RML granted HD permission to publish data from WorldFeng in the Horseday app with connections to the database via an application programming interface (API).

Following the complainant's comments about the transfer of her data from WorldFeng to Horseday, RML created a filter for the aforementioned connections, which allows owners of horses registered in WorldFeng to block the transfer of information about their horses from WorldFeng.8. Attached to HD's letter of response of March 10, 2025, was, among other things, a copy of the association's privacy policy, retrieved from the association's website on that date. Parties' Views. Complainant's Main Views 9. The complainant believes that BÍ's dissemination of her personal information from WorldFeng, which she was required by law to register in the database, was not in accordance with, among other things, Act No. 90/2018 on the Protection of Personal Data and Processing of Personal Data. The disclosure was also in violation of the legal disclaimer and the WorldFeng terms of use, as a user's consent is required to transfer information from the database, unless it is done to provide a product or service that a customer has requested.10.

The complainant argues that BÍ was obligated to inform the registered users that their information from WorldFeng would be forwarded to Horseday. The complainant states that she did not become aware of the transfer and the possibility of her personal data being collected by Horseday until two years after the transfers began. Regarding BÍ's reference to its privacy policy, the complainant argues that Horseday is not a party included in the list of third parties to whom the organization reserves the right to disclose the personal data of WorldFeng users.11. Regarding HD's processing of the complainant's personal data, the complainant objects to the company's claim that it can base the processing on legitimate interests. The interests the company has cited are not compatible with publishing information about individuals and their horse ownership without their knowledge and consent. Furthermore, HD's reference to the legitimate interests of horse owners and trainers in being able to access information about horse ownership in Horseday is not valid, as these individuals can already look up the information in WorldFeng.

HD's processing is contrary to the general principles of data protection law. The processing can be considered neither fair nor transparent, as the complainant did not consent to it and it was carried out without her knowledge. HD cannot guarantee the accuracy of the information, as updates to information in WorldFeng are based on the initiative of the horse owner, e.g., regarding a change in a horse's ownership. Main arguments of BÍ12. BÍ's responses state that the WorldFeng database contains public data and its service provider is RML. The purpose of WorldFeng is to ensure the continued purebred status of the Icelandic horse and to support international cooperation in its breeding, see Article 1 of Regulation No. 442/2011. According to item 4 of the second paragraph of Article 5 of the regulation, a certificate of individual marking is a prerequisite for registering a horse in the database, and information about owners is part of the registration of such markings, see Article 5. art. of Regulation No. 200/1998 on livestock brands, brand registers, and restrictions on the co-branding of livestock.13.

BÍ points out that RML, by contract dated July 9, 2021, granted HD a license to publish data from WorldFeng in Horseday. It was considered important to support the innovation embodied in the app, on the condition that only those who already had access to WorldFeng would be users of the app.BÍ views HD as an independent controller, and that the app only involves the publication of information that individuals could already access through a WorldFeng account.14. BI has argued, among other things, that the transfer of information from WorldFeng to HD is due to a legal obligation on BI to provide access to the requested data in accordance with Article 5 of the Freedom of Information Act No. 140/2021. BÍ believes that due to the organization's role under Regulation No. 442/2011, it is subject to the Law on Public Information, pursuant to Article 3 of the Act, which is a private entity entrusted with a service that a government authority is required by law to perform, or is otherwise considered part of the public function of a government authority.

These are public records created due to a statutory obligation to keep records, in addition to taking into account the perspective of reusing public data for innovation.15. BÍ considered that the public had a right of access to the data in question under the foregoing, and that limitations on that right for private interests, pursuant to Article 9 of the Act on Public Information No. 140/2021, did not apply to individuals' ownership of horses. The interests of others in having such information accessible would outweigh them. The association shared the information in good faith, as it involved an innovative company working closely with the National Federation of Horsebackriders. Neither BÍ nor RML sold the data in question to HD. The agreements clearly state that these are payments for access to data via an API and are intended solely to cover the costs of that service.16. Regarding how the condition of necessity for the aforementioned processing authorization was considered met, in light of the fact that users could stop the processing of their personal data by turning on the aforementioned filter, see Regarding the discussion in paragraph 7, BÍ refers to the fact that the organization, together with RML, considered it appropriate to take the complainant's objections into account, and HD did not object to this.17.

BÍ believes that the organization's processing was consistent with the principles of personal data protection law. Regarding lawfulness, fairness, and transparency, see item 1 of Article 8 of Act No. 90/2018 and Article 5(1)(a) of Regulation (EU) 2016/679, BÍ argues that the disclosure was made on the basis of the Freedom of Information Act No. 140/2021 and that the organization's privacy policy states that information is not disclosed to third parties except in certain cases, including in accordance with laws and regulations. Disclosure based on the Act falls under this category. Furthermore, in BÍ's opinion, it is clear that the information was obtained and processed for a legitimate and substantive purpose, as BÍ has the task of processing it in accordance with the aforementioned regulations and is obligated to provide access to it under the Act on Public Information.Main arguments of HD18.

HD reiterates in its responses that the main purpose of Horseday is the processing of information about the Icelandic horse, which is not considered personal data. The only personal information processed about individuals other than the app's users is the owner's name. Users who see this information in Horseday generally also have access to WorldFeng, where the same information is available. The purpose of the Horseday connection to WorldFeng is for users of the app to view horses in WorldFeng and, as applicable, to retrieve horses for which they intend to record training and/or care information.19. HD's position is that the company's processing of the personal data of individuals other than Horseday users is based on the company's legitimate interests, pursuant to Article 6(1)(f). Article 9(1) of the Act no. 90/2018 and Article 6(1)(f) of Regulation (EU) 2016/679. These are the interests of equestrians and those who train the Icelandic horse, for which it can be argued that the public interest is in their protection.

The interests concern improving the experience of equestrians in horseback riding, and furthermore, the trainers of the horses have legitimate interests in having information about the horses' ownership readily available. The processing also takes place in the interest of HD's constitutionally protected business interests. The processing was necessary for the legitimate interests, as information about the owners' names is, among other things, a necessary part of the management, training, and welfare of horses. The interests or fundamental rights and freedoms of the data subjects do not override the aforementioned legitimate interests.20. Regarding compliance with the principles of data protection law, HD argues that the scope of the processing of personal data in the app is limited and that the data is not of a sensitive nature. Only the owner's name is involved. Regarding the impact of the processing on the data subject, HD points out that it is negligible.

The purpose of the processing is clear and legitimate, and personal data is not processed for other, incompatible purposes. The information is updated as needed, and a strong emphasis is placed on ensuring its security. It is understood from HD's response letter that the company's privacy policy, available on its website, deals exclusively with the processing of personal data of the app's users.Facts and Conclusion Legal Framework 21. This case concerns, on the one hand, the transfer of the complainant's personal data by BÍ from the WorldFeng database to the Horseday app operated by HD, and on the other hand, the latter's processing of the same data in the company's app. 22. The controller is the natural or legal person, public authority, or other body which alone or jointly with others determines the purposes and means of the processing of personal data, see 6th indent of Article 3 of Act No. 90/2018 and 7th indent.

Article 4 of Regulation (EU) 2016/679.23. Personal data is defined as any information relating to an identified or identifiable natural person, see Article 2(1) of Law No. 90/2018. A person is considered to be identifiable if it is possible to identify them, directly or indirectly, for example by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social considerations. In the comments to Article 3 of the bill that became the aforementioned law, it is stated, among other things, that the term "personal data" is broad and includes all information, opinions, and assessments that can be directly or indirectly linked to a specific individual, e.g.,e. information that is personal or personally identifiable.24. All processing of personal data must fall under one of the authorization provisions of Article 9 of Act No. 90/2018, pursuant to Article 6(1) of Regulation (EU) 2016/679.

According to item 3 of the legal provision, see Article 6(1)(c) of the Regulation, processing may be permitted if it is necessary to fulfill a legal obligation to which the controller is subject. Furthermore, processing may be permitted if it is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority vested in the controller, pursuant to Article 9(5) of the Law and Article 6(1)(e) of the Regulation. When it comes to the processing of personal data by public authorities, the above-mentioned bases may apply in particular, see the concluding part of Article 6 of the Regulation. Finally, processing may also be permitted if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, see point 6.

Article 9 of the Act and Article 6(1)(f) of the Regulation.25. In the comments on the provision of Article 5 of Section 9 of Act No. 90/2018, in the bill that became the aforementioned law, it is stated that the project in question must be carried out in the public interest, i.e., have significance for a broad group of people. This could, for example, apply to processing that takes place for historical, statistical, or scientific purposes. It is also stated that processing can be considered to take place in the public interest even if it is not carried out by the public sector, provided it serves the interests of a broad group of people. It also states that if the exercise of public authority has been entrusted to a third party by a service contract or an authorized external delegation of power, the provision implies that this third party may carry out the necessary processing of information in the performance of that administrative task.26.

When the processing of personal data is based on a provision according to item 3 or 5. Article 9 of Act No. 90/2018, pursuant to Article 6(1)(c) and (e) of Regulation (EU) 2016/679, the processing must also comply with the requirements of Article 6(3) of the Regulation. It states that the basis for the processing must be provided for by Union law or the law of a Member State to which the controller is subject, and that the purpose of the processing must be determined on that legal basis. This entails, when based on Article 9(3) of the law, that the legislature must have clearly determined in a law that specific processing must take place, so that a legal obligation exists within the meaning of the provision. When based on point 5 of the same article, it is also assumed that the processing is necessary in light of existing legislation. However, it is not required that the processing be explicitly mandated by law; rather, the authorities have a certain discretion to assess what processing is necessary to carry out their legally mandated tasks in the public interest and in the exercise of public authority.27.

First, the processing must be carried out for the purposes of the legitimate interests pursued by the controller or by a third party. First, the processing must be carried out for the purposes of the legitimate interests pursued by the controller or by a third party. Secondly, the processing must be necessary for the purposes of the legitimate interests pursued, and thirdly, the fundamental rights and freedoms of the data subject, which require the protection of personal data, must not override those legitimate interests. The third condition requires a balancing of interests, where the controller's legitimate interests in the processing are weighed against the interests of the data subject. In practice, this assessment has particularly considered four factors. First, the nature of the controller's legitimate interests is considered. Second, the impact of the processing on the data subject is considered.

In this regard, the nature of the information being processed can be significant, including whether it concerns sensitive personal data. Furthermore, the method of processing can be significant. Third, for the purposes of the balancing test, it is significant whether the controller complies with other provisions of data protection law, such as the principle of proportionality, as this can provide an indication of the processing's impact on the data subject. Fourth, additional measures taken by the controller in connection with the processing may be relevant to the balancing of interests.28. When assessing the basis for processing, provisions in other applicable laws must also be taken into account. As is the case here, the main laws to be considered are the Freedom of Information Act No. 140/2012 and the Act No. 45/2018 on the reuse of public information.29. Section 1 of the Law on Public Information No. 140/2012 states that the purpose of the law is to ensure transparency in public administration and in the handling of public interests, among other things for the purpose of strengthening: the right to information and freedom of expression; the ability of the public to participate in a democratic society; media and public oversight of public bodies; the ability of the media to disseminate information on public affairs; and finally, public trust in the administration.

Article 3 states that the law applies to private entities, whether publicly or privately owned, to the extent that they have been entrusted, by law or by a decision or agreement based on an authorization in a law, with the task of carrying out an administrative act or providing a service that a public authority is required by law to provide or that is otherwise considered part of the public functions of a public authority. Article 5 deals with the public's right of access to documents. Paragraph 1 of the provision states, in part, that upon request, the public must be granted access to existing documents pertaining to a specific matter, with the limitations set forth in Articles 6–10 of the law. The same applies when access to specific existing documents is requested. Section 9 of the Act states, in part, that it is prohibited to grant the public access to data concerning the private or financial affairs of individuals that it is reasonable and customary to keep confidential, unless the individual concerned consents.

In the comments on the aforementioned Article 5 of the bill that became the Public Information Act No. 140/2012, it is stated, among other things, that everyone has the right to access information under the Act, regardless of whether the person is an individual or a legal entity. Furthermore, it does not matter what purpose the person has for requesting access to the data. It is also stated that the term "mál" in the bill does not have as narrow a meaning as the term "mál" in the Administrative Procedure Act No. 37/1993.30. Section 11(1) of the Access to Public Information Act No. 140/2012 states that it is permissible to grant access to documents to a greater extent than is required by the Act, provided that other legal provisions do not prevent it, including provisions of laws on confidentiality and personal data protection. In the comments on Article 11 of the bill that became the Freedom of Information Act, it is stated, among other things, that in paragraph 1 of the provision, the general principle of increased access to data is codified and applies equally to all who fall within the scope of the law.

At the beginning of the comments on Article 11, reference is made, among other things, to the content of Article 3. subsection 3 of section 3 of the then-current Act on Public Information and the unwritten principle that authorities often have the authority to grant the public, among others, broader access to information than is granted by direct legal right, provided that rules on confidentiality do not stand in the way. This principle has been referred to in Icelandic law as the principle of increased access to documents and has its counterpart in the Norwegian Freedom of Information Act (Nor. meirinnsyn) and the Danish Freedom of Information Act (Dan. meroffentlighed). It also states that when applying the rule, it is important to consider whether the matter concerns private or public interests. Without the consent of the individual or legal entity concerned, the public would not be granted additional access to private or financial matters that are reasonably and naturally intended to be kept confidential.

However, when a matter concerns the public interest, the relevant government authority, or another competent body, may decide to grant the public increased access to documents, provided that confidentiality provisions do not stand in the way.31. When Law No. 45/2018 on the reuse of public information came into effect, the provisions of Article 30. of the Public Administration Act No. 140/2012 was repealed, which had provided in general terms for the right to reuse public information that was legally accessible to the public, upon fulfillment of further conditions. Section 1(1) of Act No. 45/2018 states that its purpose is to establish minimum rules on the reuse of public information in order to promote increased innovation and for the benefit of society as a whole. Section 2 of the same provision states, among other things, that the reuse of public information refers to a private party using such information for a purpose other than the one for which it was originally collected by public authorities.

The scope of the law is defined in Article 2, which states in its first paragraph that the law applies to the reuse of existing information that is in the possession of public authorities and to which the public has a right of access. In paragraph 2 of the same provision, the law is said to cover the state, municipalities, their institutions, and other public entities, pursuant to paragraph 3. In paragraph 1. Paragraph 1 of Article 3 states that a public authority is obligated to grant a request for permission to reuse pre-existing information in its possession, to which the public has a right of access under the Law on Public Information or other laws, subject to the conditions set forth in Articles 4–6 of the same law. Section 4 of the Act deals with the general conditions for the reuse of public information, one of which is stated in item 1. Paragraph 1 of the provision, which states that the reuse of the information may not violate, among other things, Act No. 90/2018 on Personal Data Protection and Processing of Personal Data.32.

In addition to the authorization provided above, see discussion in paragraphs 24–27, the processing of personal data must be consistent with all the principles in Article 8(1) of Law No. 90/2018, pursuant to Article 5(1) of the Regulation (EU) 2016/679. It provides, among other things, that personal data shall be processed in a lawful, fair, and transparent manner in relation to the data subject (Article 8(1) of the Act and Article 5(1)(a) of the Regulation); that they be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (point 2 of the legal provision and point b of the regulatory provision); and that they are accurate and, where necessary, kept up to date; personal data that is inaccurate or incomplete, having regard to the purposes for which it is processed, shall be erased or rectified without delay (Article 4 of the Law and Article 4(d) of the Regulation).

The controller is responsible for ensuring that the processing of personal data complies with the aforementioned principles and must be able to demonstrate this, in accordance with the second paragraph of the legal and regulatory provision. 33. When assessing whether the conditions for transparency and fairness are met, in accordance with the aforementioned principle in item 1 of the first paragraph of Article 8 of Act No. 90/2018, see a-item of the first paragraph of Article 5 of the regulation (EU) 2016/679, it may also be necessary to refer to the provisions on the controller's duty to inform the data subject, which are further detailed in Articles 13–14 of the Regulation, pursuant to Article 17 of the Act. When personal data is obtained from the data subject, the information requirements are governed by Article 13 of the Regulation, and when personal data is obtained from other sources, the information requirements are governed by Article 14 of the Regulation.

The controller's duty to inform, i.e., the obligation to provide the data subject with information about the processing of their personal data, generally applies regardless of the legal basis for the processing. According to paragraph 4 of Article 13 of the Regulation However, under Regulation (EU) 2016/679, the controller's information obligation does not apply if and to the extent the data subject is already aware of the information that must be disclosed under the provision. Furthermore, Article 14(5)(c) states that the information obligation does not apply if and to the extent the disclosure of the information would be impossible or would involve disproportionate effort. of the Regulation that the information obligation under the provision does not apply if and to the extent that the acquisition or disclosure of the information is expressly provided for by law to which the controller is subject and which provides appropriate measures to protect the legitimate interests of the dparty.

34. As previously stated, see discussion in paragraph 5, is WorldFengur primarily a database that records information about horses, which, on its own, is not considered personal data within the meaning of the Personal Data Act (No. 90/2018), see discussion in paragraph 23. The personal data at issue in this case is limited to information about the ownership of horses by an identifiable individual. The case therefore concerns the processing of personal data that falls within the scope of Law No. 90/2018 and, consequently, the authority of the Personal Data Protection Authority, pursuant to Article 4(1), Article 1(2) and Article 39(1) of the Act. Processing by BÍ35. BÍ is considered the controller for the processing that consisted of transferring the complainant's personal data from the WorldFeng database to the Horseday app, see point 6. Article 3 of Act No. 90/2018 on Personal Data Protection and Processing of Personal Data and point 7 of Article 4 of Regulation (EU) 2016/679, see discussion in paragraph 22.36.

It appears from BÍ's answers in the later stages of this investigation that the organization bases the processing of personal data, which took place through the aforementioned disclosure, on it being necessary to fulfill a legal obligation to which the organization is subject as the data controller, see item 3. Article 9 of Act No. 90/2018, see Article 6(1)(c) of the Regulation (EU) 2016/679, see discussion in paragraph 14. The association referred to its obligation under the Freedom of Information Act No. 140/2012 in this context.37. The BÍ is the umbrella organization for Icelandic farmers, which is to be their advocate and to work for progress and prosperity in agriculture, as confirmed in the opinion of the Ombudsman of the Althingi in case no. 8808/2016. The opinion also states that the organization is therefore an association of farmers and thus a private entity, not part of the public administration subject to the ombudsman's supervision, except to the extent that the organization may have been legally tasked with making administrative decisions.38.

According to Section 3(3) of Article 3 of the Agriculture Act No. 70/1998 and Annex of Regulation No. 442/2011, BÍ has professional oversight of the public breeding work in Icelandic horse breeding on behalf of, and in accordance with an agreement with, the Minister. Among the tasks handled by the BÍ is the operation of WorldFeng and the registration of various information in it, in accordance with, e.g., Regulation No. 442/2011 on the Origin and Breeding of the Icelandic Horse and Regulation No. 916/2012 on the Marking of Livestock, cf. discussion in paragraph 5. The Personal Data Authority considers that when BÍ handles the registration and collection of information in WorldFeng, the organization, as a private entity, is providing a service, by contract or pursuant to other directives, which are provided for in law for a government authority to perform or are otherwise considered part of the public functions of a government authority, see section 3 of the Law on Public Information No. 140/2012, see discussion in paragraph 29.39.

From the available evidence in the case, it can be concluded that BÍ transmitted information from the WorldFeng database to the Horseday app in order to support the innovation embodied in Horseday. In its responses, BÍ has argued that it was necessary to disclose the information for the aforementioned purpose in light of a legal obligation resting on the organization under the Law on Public Information No. 140/2012 and concerns the public's right of access to information and viewpoints on the reuse of public data, see discussion in paragraph 14. As stated in paragraph 26, the legislature must have clearly mandated in a law that a specific processing must take place, thereby establishing a legal obligation within the meaning of item 3 of Article 9 of Act No. 90/2018, cf. Article 6(1)(c) of Regulation (EU) 2016/679. In the opinion of the Data Protection Authority, the provision of the Information Act on which BÍ bases the disclosure, cf. discussion in paragraphs 14 and 29, does not meet the aforementioned requirement of the data protection legislation for specifying a particular processing operation that must be carried out, as the processing that takes place is always contingent on an information request being made under the law, and the substantive scope of the processing is dependent on the specification of that same request on a case-by-case basis.

However, the Data Protection Authority has taken the view that when the processing of personal data is carried out by public authorities in connection with their statutory tasks, the processing can in particular be based on Article 9(5) of the Act, see Article 6(1)(e) of the Regulation.40. As previously noted, see discussion in paragraph 39, the Data Protection Authority believes that the BÍ falls under Article 3 of the Law on Public Information No. 140/2012 in its activities related to the registration of personal data in WorldFeng. Under that law, those subject to it are not only required to disclose data in response to a request under Section 5 of the law, but it also provides for the authority of the same parties to grant access to data more broadly than is required by the law, cf. Article 11 of the Act, upon fulfillment of further conditions, cf. discussion in paragraph 30.41. As is the case here, it is also the assessment of the Personal Data Protection Authority that the Agricultural Association of Iceland (BÍ) is considered a public authority, within the meaning of Act No. 45/2018 on the reuse of public information, when the organization carries out tasks such as operating the WorldFengs database and registering information in it in accordance with instructions in laws and government regulations, see discussion in paragraph 31.

The purpose of the Law on Public Information No. 140/2012 is to ensure transparency in public administration and in the handling of public interests, while the purpose of the Law No. 45/2018 is to establish minimum rules on the reuse of public information in order to promote increased innovation and for the benefit of society as a whole, see discussion in paragraphs 29 and 31. The latter law provides that public authorities are obligated to grant a request for permission to reuse, provided certain conditions are met, one of which is that the reuse must not violate, inter alia, Act No. 90/2018, cf. discussion in paragraph 31.42. It cannot be determined from the available documents that BÍ received a request from HD pursuant to Act No. 45/2018. Nevertheless, the Data Protection Authority believes that the law reflects the obligation that rests on public entities in the aforementioned context.

In the opinion of the Data Protection Authority, it must be considered that BÍ was, in effect, through its agreements with HD, processing a request for the reuse of public data. BÍ has argued that the personal data was of such a nature that restrictions on its disclosure for private interests did not apply, and that the interests of others in making the information accessible would outweigh the complainant's interests, see discussion in paragraph 15. 43. In light of all the foregoing, the Data Protection Authority finds that BÍ was authorized to disclose the complainant's personal data to the Horseday app, due to the aforementioned provisions in the Act on Public Information No. 140/2012 and the Act No. 45/2018 on the reuse of public information, but in the opinion of the Personal Data Authority, authorities, as well as private entities acting on their behalf, must be granted a certain degree of discretion to assess what processing is necessary to carry out their statutory tasks, see further discussion in paragraph 26.44.

In light of all of the above, the Data Protection Authority considers the aforementioned disclosure of the complainant's personal data to have been necessary for reasons of public interest, pursuant to item 5 of Article 9 of the Act No. 90/2018 and Article 6(1)(e) of the Regulation (EU) 2016/679. This concerns the public interest in increasing public and private access to public data, including for the purpose of innovation.45. Regarding the complaint's allegation concerning BÍ's obligation to inform the data subject that their personal data from WorldFeng would be further disclosed to Horseday, it should be noted that according to Article 13(4) of the Regulation (EU) 2016/679, the controller's information obligation does not apply if and to the extent the data subject is already aware of the information that must be provided under the provision, see discussion in paragraph 33. BÍ's privacy policy states that information may be shared with third parties in accordance with legal requirements, see discussion in paragraph 17.

BI also sought to address the complainant's complaints by offering her the opportunity to stop the dissemination of her personal information, see discussion in paragraph 7.46. Furthermore, in the opinion of the Data Protection Authority, it is not apparent that BÍ's disclosure of the complainant's personal data was unrelated to the purpose underlying the initial registration of the information. The prerequisite for registering a horse in WorldFeng is that a certificate of its individual identification is available, see discussion in paragraph 12, but a microchip is one type of such identification, and it is accompanied by information about the registered owner. In this context, Article 5(1) of Regulation No. 200/1998 on livestock marks, mark registries, and restrictions on the co-marking of livestock states that the purpose of microchipping horses is to best ensure proper origin registration and proof of ownership.

In the opinion of the Personal Data Protection Authority, the information continues to serve the purpose of ensuring the traceability of a horse to its owner for the sake of reliability and correct registration of origin. As for the reliability of the transmission of the complainant's personal data, it is considered guaranteed since the source of the information is a public database.47. In light of all of the foregoing, the Personal Data Authority therefore considers that BÍ's disclosure of the complainant's personal data also complies with the general principles of items 1, 2, and 4. Article 8(1) of Law No. 90/2018, as amended by points (a), (b), and (d) of Article 5(1) of Regulation (EU) 2016/679, to the extent that the institution deemed it necessary to investigate the subject of the complaint. Processing by HD48. HD is considered the controller of the processing of the complainant's personal data in the company's mobile application, pursuant to Article 6.

Article 3 of Act No. 90/2018 and point 7 of Article 4 of Regulation (EU) 2016/679, as discussed in paragraph 22.49. HD has based the processing of personal data at issue here on the company's legitimate interests. Processing of personal data may be permitted on the basis that it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in accordance with Article 6. point (9) of Article 9 of Act No. 90/2018 and Article 6(1)(f) of Regulation (EU) 2016/679. For this to be the case, the three aforementioned conditions must be met, see discussion in paragraph 27. In assessing whether the first condition is met, i.e., whether HD has legitimate interests, it is of primary importance whether the interests are compatible with applicable law.

In the opinion of the Personal Data Protection Authority, the evidence in the case indicates that HD offers an app with a connection to WorldFeng for the purpose of allowing users to view and, as applicable, download horses from the database for which it is intended to record training and/or care information, cf. discussion in paragraphs 6 and 19. It is therefore a legitimate interest of horse owners, as well as those who are involved in the training of horses. Furthermore, there are the commercial interests of HD, which do not appear to be contrary to the law. It must therefore be assumed that HD has legitimate interests in the processing.50. With regard to the other condition, i.e.as to whether the processing is necessary for the purposes of the legitimate interests, the Data Protection Authority finds it clear that the processing of personal data at issue here is fundamental to HD being able to provide its clients with services related to the management of information about training, horse care and breeding, as the origin of the horse and its traceability to the owner is a fundamental prerequisite for breeding activities and a step in the user registering information about the horse's rights.

It must therefore be assumed that the processing is necessary for the purposes of the legitimate interests.51. In assessing the controller's legitimate interests against the interests of the data subject, pursuant to the third condition for the application of the processing authorization, is to support horse owners and trainers in managing information related to improved training and welfare, Furthermore, the processing is intended to support horse owners and trainers in managing information related to the improved training and welfare of the horses, and to generally enhance the equestrian experience. It should also be noted that this is an extremely limited processing of personal data, and the information is already accessible to those who purchase a subscription to WorldFeng. Furthermore, the Data Protection Authority considers that, given the circumstances, the nature of the information is the decisive factor in the outcome of the interest balancing test, but first and foremost, it concerns publicly registered information about horse ownership that is limited to the complainant's name as the horse's owner, and such personal data is neither considered sensitive nor of a sensitive nature.

Furthermore, no such disparity in position between the complainant and HD is apparent as being relevant to the balancing of interests. Finally, nothing has been presented in the case to suggest that HD processes any personal data about the complainant other than is necessary for the purposes of the processing, or that the company has disclosed the information to others who do not need it for the use of the app. In the opinion of the Personal Data Authority, HD ensures the accuracy of the information by obtaining it directly from WorldFeng, which is a public database. In light of this, the Data Protection Authority considers that HD's legitimate interests in the processing outweigh the interests or fundamental rights and freedoms of the complainant that require the protection of personal data.52. In light of all of the foregoing, the Data Protection Authority concludes that HD's processing of the complainant's personal data in the company's mobile application was permitted on the basis of Article 9(2)(f) of Regulation (EU) 2016/679 and Article 6(1)(f) of Regulation No. 90/2018.

(EU) 2016/679 and in accordance with the principle of accuracy, see 4th indent of Article 8(1) of the Act and Article 5(1)(d) of the Regulation. Furthermore, the Data Protection Authority finds that HD has sought to ensure the proportionality and fairness of the processing, by minimizing the processing of personal data as much as possible by limiting the search function to the horse's name, in addition to which the company approved the use of the aforementioned filter that made it possible for the complainant to stop the transfer of their personal data to Horseday. The scope of the processing is primarily limited to information about horse ownership, and it must be considered that the impact of the processing on the data subject is negligible.53. Next, it is considered whether HD has ensured the transparency of the processing and provided the complainant with information in accordance with the relevant provisions of Act No. 90/2018 and Regulation (EU) 2016/679, see discussion in paragraphs 32 and 33.

The Data Protection Authority is of the opinion that at the point when HD obtained the complainant's personal data from BÍ, HD was not required to specifically inform the complainant about that processing, as it must be considered that the complainant was aware of its disclosure on the basis that it was authorized by applicable law, cf. discussion in paragraph 33. In the opinion of the Data Protection Authority, the situation is different regarding subsequent processing operations by HD that involved further processing of the complainant's personal data, including its disclosure to users of the app, on the basis of HD's legitimate interests as described above. As HD itself pointed out, see discussion in paragraph 20, the information in the company's privacy policy pertained solely to its processing of the personal data of the app's users, which they provided to the company with their consent.

Information about HD's processing of third-party personal data, e.g., personal data from the WorldFeng database, was therefore not provided, and the company's information did not meet the requirements of Articles 13 and 14 of the Regulation. In light of these factors, the Data Protection Authority finds that it must be established that HD did not provide the complainant with sufficient information about the processing of personal data at issue here, for which the association was responsible, in accordance with Article 2. paragraph 17 of Act No. 90/2018 and Article 14 of Regulation (EU) 2016/679. It also follows that HD has not demonstrated that the company has complied with the transparency requirement of item 1. paragraph 1 of Article 8 of the Act toward the complainant in relation to the processing, see paragraph 2 of the same article.54. In light of all of the foregoing, the conclusion of the Data Protection Authority is that HD's processing of the complainant's personal data was not compliant with item 1.

Article 8(1) of Law No. 90/2018 and Article 5(1)(a) of Regulation (EU) 2016/679, as well as Article 17(2) of the Law and Article 14 of the Regulation.55. In accordance with this decision and by reference to item 4 of Article 42 of Act No. 90/2018, as amended by Article 58(2)(d) of Regulation (EU) 2016/679, Horseday ehf. is hereby ordered to bring its processing into compliance with the provisions of Article 8(1)(a) of Law No. 90/2018 and Article 5(1)(a) of Regulation (EU) 2016/679. Confirmation that these instructions have been complied with must be received by the Data Protection Authority no later than October 16, 2026. Decision on the exercise of powers 56. The Data Protection Authority may issue a reprimand to a controller or processor if processing operations have violated Regulation (EU) 2016/679, see item 2. Article 42 of Act No. 90/2018, and may impose administrative fines on those who, intentionally or negligently, violate any of the provisions of the Regulation listed in paragraphs 2 and 3 of Article 46 of Act No. 90/2018, cf. paragraphs 1 and 5 of that article.

According to item 1 of paragraph 3 of Article 46 of the Act, these include provisions on the basic rules of processing, in particular in accordance with paragraph 1 of Article 5 of the Regulation.57. In determining whether to apply the above-mentioned provisions authorizing a fine, as well as the amount of the fine, regard shall be had to 1. of Article 47 of Act No. 90/2018, which provides for the factors that may be considered either in mitigation or in aggravation. When the facts of the case are considered in light of the perspectives set forth in the provision, and taking into account the principle of proportionality, see Article 83(1) of the Regulation (EU) 2016/679 and Article 12 of the Administrative Procedure Act No. 37/1993, do not constitute sufficient grounds to impose an administrative fine on Horseday ehf. or to issue a reprimand to the company for the violations of the personal data protection law described in paragraphs 53 and 54 above.

Particular consideration has been given to the nature of the offense and the scope of the processing, as the data concerned was extremely limited and was neither considered sensitive nor of a sensitive nature. D E C I S I O N W O R D S:The processing by the Farmers' Association of Iceland, which consisted of the transfer of [A]'s personal data from the WorldFeng database to the Horseday app, on behalf of Horseday Ltd., was in compliance with Act No. 90/2018 on the Processing of Personal Data and the Regulation (EU) 2016/679, on the legal basis and general principles. Horseday ehf.'s processing of [A]'s personal data in the Horseday app did not comply with item 1. Article 8(1) of Act No. 90/2018 on Personal Data Protection and Processing of Personal Data and Article 5(1)(a) of Regulation (EU) 2016/679.Horseday ehf. is ordered to bring the processing into compliance with the provisions of item 1 of the first paragraph of Article 8 of Act No. 90/2018 and Article 5(1)(a) of Regulation (EU) 2016/679. Confirmation that these instructions have been complied with must be received by the Personal Data Authority no later than October 16, 2026. Personal Data Authority, September 16, 2026 Edda Þuríður Hauksdóttir Ósk Óskarsdóttir