The Icelandic Data Protection Authority does not grant permission for scientific research in the health field, but the institution gives a comment to the Scientific Ethics Committee or the Health Research Ethics Committee on applications for scientific research and instructions on the processing of personal data.
The Scientific Ethics Committee and the Health Research Ethics Committee may, before issuing a permit for scientific research in the health field, request an opinion from the Data Protection Authority if there is doubt whether the scientific research in question meets the requirements of the Act on the Protection of Privacy and the Processing of Personal Data.
If the Data Protection Authority considers it warranted to provide a comment, the ethics committee shall be notified within ten working days.
The Data Protection Authority's review shall be available no later than 30 days after sufficient data is available. If the Data Protection Authority considers that the treatment of personal data violates the laws on personal data protection and the processing of personal data, no authorization shall be issued for the investigation.
It should be noted that if the proposed study falls outside the scope of Act No. 44/2014 on Scientific Research in the Health Sector, it may be necessary to apply for a special permission from the Data Protection Authority for the proposed processing.
