Full text
30 paragraphsThe Data Protection Authority has issued an opinion on the City of Reykjavik's planned data collection from the NPA Center. Specifically, the NPA Center requested an opinion on the City of Reykjavik's proposed collection of bank statements and receipts from the center's members for their out-of-pocket costs for the services of their personal assistants. The purpose of the information gathering was to monitor the use of funds allocated for user-directed personal assistance (NPA). The case concerned, on the one hand, the interest in monitoring the City of Reykjavík's use of public funds. On the other hand, it was considered that the data in question could shed light on the various activities of daily life for NPA users, such as visits to museums and all kinds of events, trips to the swimming pool and for exercise, psychological counseling and medical appointments, attending meetings of political organizations, participation in religious services, and activities of life-affirming associations.The Data Protection Authority considered that the case in particular concerned the fundamental principle of privacy and the United Nations Convention on the Rights of Persons with Disabilities, and these legal sources were taken into account in interpreting the legal framework governing the monitoring of NPA provision.Although the Data Protection Authority considered that, depending on the circumstances, it could be permissible for a municipality to obtain such data in individual cases, when there were valid reasons for it, it was the agency's opinion that it was not consistent with the proportionality requirement of the personal data protection law to collect such data from all users of the NPA service within the municipality for the purpose of general oversight.
Furthermore, it was noted that less intrusive measures could be used to achieve the purpose of the oversight. Therefore, the proposed data collection was not considered to be compatible with the Personal Data Act. Opinion On September 17, 2026, the Data Protection Authority adopted the following opinion in case no. 2025020567: Request for Opinion – Correspondence Facts of the Case 1. On February 7, 2025, the Data Protection Authority received a request from the NPA Center, dated February 6, 2025, regarding an opinion on whether the Social Services Department of the City of Reykjavík may request certain data containing personal information, as the data concerns staff costs for assistants to the center's members with user-directed personal assistance (NPA). Specifically, these are bank statements and receipts in the possession of the members for expenses incurred for the services of support personnel who work under the members' control but are managed by special administrators.2.
The request for an opinion reviews the legislation on NPA, i.e., Law No. 38/2018 on services for people with disabilities with long-term service needs, as well as the implementing regulation, No. 1250/2018. The goal of NPA, which is based on Article 11 of the Act, is to empower people with disabilities to take responsibility for their own lives in accordance with the ideology of independent living, see Article 19 of the United Nations Convention on the Rights of Persons with Disabilities. As stated in the Act, NPA is granted on the basis of an agreement between a person with a disability and the municipality, and it is the individual who personally manages the service. Furthermore, it is provided that special administrators shall manage the provision of NPA under a contract with the municipality.3. The request for an opinion states that the NPA Center is an administrator under the law. It provides support to the work managers, i.e., people with disabilities who have NPA, with their management tasks, such as finding and hiring support staff, preparing attendance schedules, and ensuring that laws and rights are respected.
Additionally, it states that any individual with an NPA agreement can become a member of the NPA Center, which then takes on the administration of the agreement. The center then receives funds from the individual's municipality and allocates them in accordance with the agreement and applicable laws and regulations. The disabled person is always the supervisor, while the NPA Center is the employer of the individual's support staff. It receives the support staff's timesheets and pays their wages based on these reports.4. It is noted that municipalities reimburse the cost of support staff's work in accordance with the detailed provisions of Regulation No. 1250/2018 and the agreement with the NPA Center, i.e., based on monthly timesheets. It is also stated that, to date, all municipalities have reimbursed the costs without requiring a specific breakdown, but that these costs can be varied, as described on page 5 of the request for an opinion in the following manner:"It should be borne in mind that the requested information, i.e., bank statements and receipts, provides the municipality with comprehensive insight into the life, lifestyle, hobbies, events, social participation, and daily patterns of disabled people with NPA.
Information appearing on bank statements and receipts for staff costs inherently provides an overview of what the NPA work coordinator does, i.e., attending museums, events, takes trips, pays for swimming pool admission, uses public transportation, attends events organized by political organizations, works out, goes to a summer cottage once a month, etc. The information appears on these bank statements because the NPA foreman must advance expenses for the employee who accompanies him on each occasion, such as in the form of admission tickets, per diems, paid meal costs at a restaurant, transportation fares, etc. The bank statements are dated, and it is possible to see how much is paid, where, and when. By reviewing the statements, the municipality can map out people's lives, lifestyles, and social participation in a way that the NPA center does not necessarily consider normal or consistent with views on privacy and the protection of personal data.
These can be information, as previously stated, that is classified as sensitive personal data, such as political opinions, religious practices, philosophy, physical or mental health, including healthcare services a person has received, and even their sexual orientation."5. In light of this, the NPA Center states its position that by demanding bank statements and receipts, the City of Reykjavik is exceeding its legal authority, and that the demand is neither necessary nor reasonable. Furthermore, this constitutes an unprecedented data collection. Reykjavíkurborgar's Explanations6. By letter dated April 25, 2025, the Data Protection Authority requested an explanation from the Social Services Department of the City of Reykjavík in connection with the aforementioned request for an opinion. A response was provided in a letter dated May 9, 2025. It provides a general overview of the department's interactions with the NPA Center and the legal rules that apply to the service in question.
In the conclusion of the letter, the department also stated that the inquiry concerned accounting records related to the users' personnel costs, and that, in light of this, no processing of personal data was taking place. Therefore, there was no reason to provide the Data Protection Authority with the requested clarification.7. Upon receiving this response, the Data Protection Authority sent a letter to the Social Welfare Department of the City of Reykjavík on May 13, 2025, outlining the Authority's position that the processing of personal data is taking place. The request for clarification was also reiterated, and the welfare department responded with a letter dated June 16, 2025. It states, among other things, that ever since the enactment of Regulation No. 1250/2018, the publication by the relevant ministry of a handbook on NPA in April 2019, as well as its publication of guidelines on settlement and completion of the operating report for NPA in January 2020, administrators have been aware of their obligation to keep payment receipts for staff costs and return them to the relevant municipality.
However, the City of Reykjavík had not requested this documentation before, but it was now deemed necessary to obtain the data for a more detailed confirmation of the use of funds for personnel costs. It has, however, been discovered during the review and monitoring of the service's implementation that high amounts have accumulated with users, which provides cause for an examination of the said costs for the purposes of the city's internal control.8. Regarding the authority to obtain the aforementioned data, reference is made to Article 21 of Regulation No. 1250/2018, which states, among other things, that at the end of each calendar year, the service provider shall send the municipality a final accounting of the NPA contract for the entire period, but it must include a breakdown of the use of the contract amount, an overview of wage costs and wage-related fees, as well as an overview of the use of the contribution for personnel costs and administrative costs.
applies Art. 21
Additionally, it states that according to the aforementioned handbook, it is assumed that 5% of the municipality's contribution to the NPA will go towards the service users' costs for staff and/or an assistant who accompanies them in play and work, but this is emphasized in the contract between the City of Reykjavik and the NPA Center. It further states that according to the aforementioned guidelines from the ministry, administrators must submit receipts for staff costs to the relevant municipalities in electronic form, such as by scanning them or taking a photograph and sending them via email.9. With reference to the above, the City of Reykjavik refers to items 3 and 5. Article 9 of Law No. 90/2018 on Personal Data Protection and Processing of Personal Data, which serves as a legal basis for the planned data collection, specifically that personal data may be processed when necessary for the purposes of legal obligations and the exercise of public authority.
applies Art. 9
Generally, these are not sensitive personal data, but to the extent such information is present, item 2 applies. Article 11(1) of the Act, pursuant to Article 9(2)(b) of the Regulation, regarding the authorization to process such information as is necessary to fulfill obligations and exercise rights under social protection legislation.10. With regard to the general principles of Article 8(1) of Act No. 90/2018, including the principles of legitimate purpose and proportionality, a discrepancy is noted between the funds allocated for personnel costs and their actual use, which resulted in funds accumulating in user accounts, creating grounds for oversight of their disposition. These funds are tax-exempt and constitute a use of public money, which gives rise to significant oversight obligations, specifically that the grant to the user for hiring staff and an attendant to accompany them is not used for any other purpose.
applies Art. 8(1) , Regulation 1250/2018 Art. 11(1), Regulation 1250/2018 Art. 9(2)(b)
Additionally, users may submit a statement of account for itemized accounts for staff costs, but if they do not have such an account, they may submit screenshots of the transactions for that cost only. Obtaining bank statements, screenshots of transaction records, and receipts is the least burdensome way to achieve the stated audit objective. It is not the intention of the City of Reykjavik to request a complete overview of NPA users' bank accounts, but only an overview of specific accounts and/or specific transactions related to staff costs for the service.11. Before the case could be resolved, the Data Protection Authority considered further clarification from the City of Reykjavik necessary and requested it in a letter to the city's social services department, dated February 3, 2026. Specifically, the Data Protection Authority requested an explanation of how the city believed the proposed data collection fell within the scope of the aforementioned Article 21 of Regulation No. 1250/2018, as well as why the data collection was actually considered necessary to conduct appropriate supervision, i.e., why less information should not suffice.12.
applies Art. 21
A response was provided in a letter from the Social Services Department of the City of Reykjavík, dated February 16, 2026. It refers to the fact that in addition to Regulation No. 1250/2018, issued pursuant to Section 4 of Article 11 of Act No. 38/2018, the minister responsible for the relevant subject matter has issued the aforementioned handbook on NPA under authority of the same legal provision. It is pointed out that according to chapter 2.2 of the handbook, the user is not permitted to use the grant for personnel costs in any manner other than as specified therein, unless otherwise agreed, as well as that in chapter 2.5, users of the service are advised to maintain a separate bank account for such costs with a dedicated payment card. In light of this, the planned information gathering from the NPA Center is considered to fall under Article 21 of the aforementioned regulation.13. Regarding the necessity of the information collection in question, it is stated that without it, it will not be possible to verify that the reported employee expenses were actually incurred for such purposes.
These expenses can be varied, e.g., for travel and transportation; admission tickets for a staff member to museums, concerts, sporting events, etc.; staff facilities at the user's home; and toiletries for caregivers. It also states, among other things, that in 2024 it was discovered, during the processing of an NPA user's application for social housing with the City of Reykjavik, that large sums of money had accumulated in the individual's accounts, which upon further investigation were found to be accumulated staff costs for an NPA agreement. This gave rise to an investigation into whether a similar situation existed with other users, and the data in question in this case—namely, bank statements and receipts for the work of support staff—was therefore requested. Comments of the NPA Center, para. 14. By letter dated March 3, 2026, the Data Protection Authority gave the NPA Center an opportunity to comment on the explanations from the City of Reykjavik.
A response was provided by letter dated 17th of the same month. It refers to the fact that according to the wording of Article 21 of Regulation No. 1250/2018, administrators are to submit a complete accounting to the municipality with a breakdown of the expenditure of funds in accordance with the agreement with the municipality, an overview of wage costs and payroll-related expenses, as well as an overview of the allocation of the contribution for personnel costs and administrative costs. Furthermore, reference is made to the City of Reykjavik's interpretation that under the provision, users may be required to provide bank statements and receipts for the expenditure of funds. This interpretation is considered excessive and goes beyond what the wording and purpose of the provision justify. The provision applies solely to the final settlement of agreements with municipalities, for which the trustees are responsible, not the users, and it does not impose an obligation on the trustees or users to provide the data to the extent requested by the city. 15.
applies Art. 21
The NPA Center then notes that with Law No. 38/2018, emphasis is placed on the human dignity, autonomy, and independence of NPA users. Thus, in paragraph 1 of Article 1 of the Act, the objective is described that service users will enjoy full human rights on an equal basis with others and live in conditions that enable an independent life on their own terms, but it is also stated that in the provision of services to people with disabilities, respect must be shown for their human dignity, self-determination, and independence. Furthermore, it states that in Reykjavíkurborg's responses, reference is made to a single, isolated instance of funds accumulating in one user's account, and that case is used to generalize about the need for extensive data collection on all NPA users in the municipality. Such a requirement would not withstand either the necessity test of Article 8 of Act No. 90/2018 or the proportionality requirements of administrative law, as less burdensome and more targeted measures are available, such as a standardized annual summary and a breakdown by cost categories, a statement of account for a dedicated personnel cost account at the beginning or end of the year, a certificate from an auditor or a sample audit, and targeted data collection in the event of a substantiated suspicion of misuse.Opinion of the Data Protection Authority Scope – Controller 16.
This case concerns a request by the Social Department of the City of Reykjavík for the NPA Center, as the service manager under the Act No. 38/2018 on services for persons with disabilities with long-term service needs, to provide it with specific information. Specifically, these are bank statements and receipts from the center's members for expenses incurred for the services of their support workers who provide user-directed personal assistance (NPA). The matter therefore concerns the processing of personal data within the meaning of the Personal Data Act No. 90/2018, as well as the General Data Protection Regulation (EU) 2016/679, see items 2 and 4. Article 3 of the Act and points (1) and (2) of Article 4 of the Regulation.17. It also follows that the case falls within the scope of the personal data protection legislation, pursuant to Article 4(1) of the Act and Article 2(1) of the Regulation, and thereby within the jurisdiction of the Personal Data Protection Authority, pursuant to Article 2.
Art. 1 and Art. 39(1) of the Act.18. The person responsible for ensuring that the processing of personal data complies with Act No. 90/2018 and Regulation (EU) 2016/679 is called the controller. According to Article 3(6) of the Act and Article 4(7) of the Regulation, this refers to the one who determines the purposes and means of processing personal data. The City of Reykjavik is considered the controller for the processing involved in the Social Services Department's acquisition of personal data of individuals with an NPA from the service provider, in this case the NPA Center. Legal Framework 19. In order to process personal data, the processing must always fall under one of the general authorizations in Article 9 of the Act No. 90/2018 and Article 6 of Regulation (EU) 2016/679. This concerns whether a government authority may obtain certain data containing information about individuals, and in this case, points 3 and 5 of the first paragraph of the provision of the Act and articles c and e of the provision of the Regulation are particularly relevant as legal bases for processing.
applies Art. 4(7), Art. 39(1), Art. 1, Art. 3, Art. 6, Art. 9
This concerns, on the one hand, a processing authorization that is necessary to fulfill a legal obligation of the controller. However, this is a processing authorization that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.20. When processing sensitive personal data, one of the additional conditions for processing such data, as provided for in Article 11(1) of the Act and Article 9(2) of the Regulation, must also be met. (EU) 2016/679. Information about NPA relates to an individual's health, and as stated in Article 3(2)(b) of the Act and Article 9(1) of the Regulation, such information is sensitive. Furthermore, bank statements and receipts for NPA may contain additional sensitive personal data, for example, information about an assistant's accompaniment to a specific social activity could also pertain to political opinions, religion, and philosophical beliefs, see Article 3(2)(a) of the Act and the aforementioned provision of Article 9(1) of the Regulation.21.
applies Art. 3(2)(a), Art. 3(2)(b), Art. 9(1), Art. 9(2), Art. 11(1)
The additional conditions for the processing of sensitive personal data, which may be particularly applicable here, are found in points 2 and 8. Article 11(1) of the Act and subsections 2(b) and (h) of Article 9 of the Regulation. This is an authorization for such processing when it is necessary for the controller to fulfill its obligations under social protection law. However, this is an authorization when the processing is necessary to provide care in the field of social services. In the former case, a legal basis is required that provides for appropriate and specific measures to protect the fundamental rights and freedoms of the data subject. The latter case, however, requires a specific legal basis, as well as the service being performed by a professional in that field who is bound by confidentiality.22. In addition to the authorization for processing personal data as described above, it must always comply with all the basic requirements of Article 8(1) of Act No. 90/2018 and Article 5(1) of the Regulation (EU) 2016/679, including that personal data must be processed in a lawful, fair, and transparent manner in relation to the data subject (Article 8(1) of the Act and Article 5(1)(a) of the Regulation); that they be obtained for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (Article 5(2) of the Law and Article 5(b) of the Regulation); that they must be adequate, relevant, and not excessive in relation to the purposes for which they are processed (3.
applies Art. 5(1), Art. 5(1)(a), Art. 5(2), Art. 8(1), Art. 11(1), Art. 5, Art. 9
Article of the law and c. Article of the regulation); and that they shall be stored in a form that does not allow data subjects to be identified for longer than is necessary in relation to the purpose of the processing (point 5 of the provision of the law and point e of the provision of the regulation). Regarding the latter basic principle, it is subject to the exception of public interest record-keeping by authorities, see also the Public Archives Act No. 77/2014, which places significant restrictions on the deletion of data by public entities.23. When applying the above provisions, provisions in other legislation shall be taken into account as applicable at any given time. As is the case here, this specifically involves Act No. 38/2018 on services for people with disabilities with long-term service needs, which, among other things, addresses user-directed personal assistance (NPA). As defined in item 6 of Article 2 of the Act, this refers to assistance controlled by the service user in such a way that they organize the assistance, decide when it is provided, select the support staff, and decide who handles the administrative aspects of the service.
applies Art. 2
The conditions for NPA are provided for in section 1. subsection 11 of the Act, which states that an individual is entitled to such services if they have a significant and ongoing need for assistance and services, such as with activities of daily living, household chores, and participation in social activities, education, and employment. Furthermore, paragraph 2 of the provision states that the assistance shall be organized based on the user's preferences and under their direction, while paragraph 3 establishes the responsibility of so-called "managers" involved in the service. This refers specifically to an entity, such as an association or a non-profit organization, that has been granted a special operating license to provide the service from the Quality and Supervisory Authority for Welfare Matters, pursuant to Section 1. para. 7 of the Act, but the service coordinator also operates on the basis of a contract with the relevant municipality, pursuant to para. 1 of Article 5 of the Act.24.
applies Art. 5
Further provisions regarding NPA can be found in Regulation No. 1250/2018 on user-directed personal assistance, which discusses, among other things, the relationship between the service coordinator and municipalities, and the latter's supervision of the former. For example, Article 21 of the regulation states that the service provider shall send the municipality monthly statements. At the end of each calendar year, a year-end statement for the NPA agreement for the entire period shall be sent to the municipality. The final accounting must include a breakdown of the disbursement of the NPA contract's funds, an overview of wage costs and payroll-related fees, as well as an overview of the use of the contribution for personnel and administrative costs. As a general rule, the service provider shall reimburse the municipality for any contribution that has not been allocated at the end of each calendar year, at which point a new reporting period begins.25.
applies Regulation 1250/2018 Art. 21
The purpose of the legislation on services for people with disabilities is described in Article 1 of Act No. 38/2018. Among other things, the objective of the first paragraph of that article is specified as ensuring that people with disabilities receive the necessary support so they can enjoy full human rights on an equal basis with others and have the conditions for an independent life on their own terms. Furthermore, the same paragraph states that in the provision of services to people with disabilities, respect shall be shown for their human dignity, autonomy, and independence, and the service shall be based on the individual's needs and circumstances, wishes, and other relevant factors, such as sex, gender, age, ethnic origin, religion, etc., in accordance with paragraph 2 of Article 1 of the Act. Furthermore, Article 3 states that in implementing the Act, the international obligations that the Government of Iceland has undertaken shall be enforced, particularly the Convention on the Rights of Persons with Disabilities, paragraph of the same article that in the implementation of the law, the international obligations that the Icelandic government has undertaken shall be enforced, particularly the United Nations Convention on the Rights of Persons with Disabilities, which has now been enacted into law here, see Article 2 of Act No. 80/2025.
A specific provision regarding respect for privacy is found in Article 22 of the Convention, but reference may also be made here to the general privacy protection provisions of Article 71 of the Constitution and Article 8 of the European Convention on Human Rights. The relevant provision of the Convention on the Rights of Persons with Disabilities states:"1. No person with a disability shall, irrespective of place or form of residence, be subject to arbitrary or unlawful interference with their privacy, family, correspondence or other lawful communications, or to unlawful attacks on their honor and reputation. Disabled people have the right to legal protection against such interference and attacks.2. The States Parties shall protect the confidentiality of information concerning the personal and family circumstances, health and rehabilitation of disabled persons on the same basis as for others."26.
applies Art. 22 , Constitution Art. 71, European Convention on Human Rights Art. 8
Conclusion. The Data Protection Authority considers it clear that the Social Services Department of the City of Reykjavik may process personal data in connection with the monitoring of the expenditure of funds allocated for user-directed personal assistance (NPA), i.e., on the basis of necessity due to a legal obligation, see Article 3. paragraph 3 of Article 9 of the Act No. 90/2018 and Article 6(1)(c) of Regulation (EU) 2016/679. The Data Protection Authority also considers it may be permissible to process sensitive personal data for the same purpose, i.e., on the basis of necessity due to obligations under social protection legislation and for the provision of care in the field of social services, see items 2 and 8. Article 11(1) of the Act and Articles 9(2)(b) and (h) of the Regulation.27. Furthermore, the processing must be compatible with the transparency and proportionality requirements set forth in the basic principles of items 1-3. and Article 5(1)(e) of Regulation (EU) 2016/679.
applies Art. 5(1)(e), Art. 6(1)(c), Art. 9(2)(b), Art. 9(2)(h), Art. 11(1), Art. 3, Art. 9
It was found that in one instance, an NPA user had deposited large sums of money intended to pay for NPA staff costs into their accounts (see paragraph 13). The Data Protection Authority considers that an incident like this may, depending on the circumstances, necessitate a change in procedures and increased diligence in supervision. However, initiating significantly expanded and detailed data collection from all NPA users based on a single, isolated incident, without first exhausting less intrusive remedies, would violate the aforementioned proportionality requirements.28. In this regard, it can be noted that an investigation into the total utilization of each user's funding, regardless of individual cost items, could in itself reveal the deviations that would warrant further investigation, while at the same time, detailed data collection on each individual NPA user could then be considered unnecessary.
It is considered particularly urgent that the possibility of such a procedure be carefully examined, given the detailed picture that information about the provision of NPA can provide of the individual's daily life. Thus, the data requested by the City of Reykjavik, i.e., account statements and receipts for the accompaniment and other services of support personnel, can shed light on the most diverse activities of daily life, such as visits to museums and all kinds of events, trips to the swimming pool and gym, psychological counseling and medical appointments, attending meetings of political organizations, participation in religious services and the activities of life-affirming associations. The data would then be subject to the preservation obligation under the Public Archives Act No. 77/2014.29. In light of the foregoing, the fundamental principle of privacy, see Article 71 of the Constitution and Article 8 of the European Convention on Human Rights, and especially Article 22 of the United Nations Convention on the Rights of Persons with Disabilities, is particularly at issue here.
applies Constitution Art. 71, European Convention on Human Rights Art. 8, European Convention on Human Rights Art. 22
Furthermore, the legal framework governing the provision of NPA must be considered, and its interpretation must take into account, among other things, the aforementioned fundamental principle. A broad interpretation of individual provisions, which would require information sources beyond what is clearly derived from their wording, is therefore not a viable option. In this regard, it should be noted that Article 21 of Regulation No. 1250/2018 only specifies a municipality's acquisition of a consolidated statement from NPA administrators, which must include a breakdown of the use of the contract amount and an overview of specific items. According to common usage, that specification cannot be considered to include an authorization for the kind of detailed data collection that the City of Reykjavik intends for its supervision of NPA.30. However, the Data Protection Authority wishes to state that, depending on the circumstances, it may be within the limits of the law for a municipality to obtain data, such as bank statements or receipts, to demonstrate the actual costs of support person services for specific NPA users in individual cases, provided there are valid reasons for each individual case.
applies Art. 21
However, it is not consistent with the proportionality principle of the personal data protection law to collect such data from all users of the NPA service within the municipality for the purpose of general oversight. 31. The Social Services Department of the City of Reykjavík is also advised, in light of the transparency requirement of item 1 of the first paragraph of Article 8 of Act No. 90/2018 (cf. Article 5(1)(a) of Regulation (EU) 2016/679), to consider ensuring that users of the NPA service are sufficiently informed that they may need to provide the aforementioned data under certain circumstances. Such information could, where appropriate, be provided through explanations in published educational materials about NPA. 32. In light of the foregoing, the Personal Data Authority concludes that the planned data collection by the Social Services Department of the City of Reykjavík from the NPA Center, etc.e. on bank statements and receipts from the members of the center for out-of-pocket expenses for the services of their support personnel, is not compatible with Law No. 90/2018 and Regulation (EU) 2016/679.
applies Art. 5(1)(a), Art. 8
Opinion: The planned acquisition by the Social Department of the City of Reykjavík from the NPA Center of bank statements and receipts from the Center's members for the services of their support workers is not consistent with Act No. 90/2018 and Regulation (EU) 2016/679. (EU) 2016/679. Data Protection, September 17, 2026 Dóra Sif Tynes, Chair Árnína Steinunn Kristjánsdóttir Gunnar Ingi Ágústsson Jónas Sturla Sverrisson Thor Aspelund