Request for deletion of personal data

Right to forget

Individuals have the right to demand that their personal data be deleted from websites, databases or other systems, when certain conditions are fulfilled.

This is called the right to forget.

Waiting time

The organisation must respond as soon as possible and no later than 1 month after the request.

In certain circumstances, the deadline may be extended by 2 months. In this case, the individual must be informed:

within 1 month of the request
on why there is a delay
the right to lodge a complaint with the Data Protection Authority

Conditions

A person may request the deletion of his/her personal data when:

the personal data are no longer necessary for the purpose for which they were collected or processed
the individual withdraws his consent and there is no other legitimate basis for the processing of the information
the individual objects to processing and there is no legitimate reason for continuing processing
the processing of personal data is illegal, for example if it was collected without consent
personal data must be deleted to meet legal obligations
information relating to a child under the age of 16 at the time of collection

Right not applicable

The right to privacy does not generally apply to the processing of personal data by the government, as they are legally bound to keep documents and other information received.

Organisations may refuse to delete information when processing is necessary to:

to exercise their freedom of expression and freedom of information
fulfill a legal obligation to carry out a task carried out in the public interest
ensure public health or public interest
ensure archiving in the public interest, for scientific research, historical research and statistical processing
to set up, maintain or defend legal claims

Getting information erased from online search engines

It is important to assess in each case whether there are conditions for the removal of search results on the Internet and the same views apply as for the right to delete personal data and it is necessary to assess whether it is legitimate for the information to be accessible by looking up a person’s name on a search engine.

Then it is also necessary to weigh:

the interests of an individual's privacy and the protection of personal data about him.
public interest in making information available in this way.

Assessment considerations

the sensitive nature of the personal data in question.
whether the person concerned is a public figure or plays a role in a public arena, so as to affect the privacy protection of the person concerned.
whether the person in question is a child.
the accuracy and reliability of the information.
what the public interest is in the availability of information.
the proportionality or excessiveness of the information in relation to the original purpose of the processing.
the extent to which this access to information has a negative impact on the person's privacy.
how long it has been since the initial processing took place.
where the information originated, i.e. from the individual concerned himself or another, and whether it was intended to be made public.
whether the information was initially made public as part of a news report or other media.
whether the person who originally published the information had a legal obligation to make it available.

According to the search results are deleted if they concern personal data such as:

Personal identification numbers or other such personal identifiers.
Numbers of bank accounts.
Credit card number.
Photos of the signatures.
Nektars or sexually explicit images that have been posted on the Internet without the person's consent.
Individuals' medical records or other data on their health, which are confidential.

Google search results

Google removes search results that contain personal information, such as:

social security numbers or other similar personal identifiers
bank account numbers
credit card numbers
images of signatures
nude or sexually explicit images posted online without the person's consent
medical records or other confidential health information

Personal information that Google does not delete

Some personal information Google generally does not delete, such as:

birthdays
addresses
phone numbers

Google's assessment considerations

When assessing requests to remove search results, Google considers whether:

the specific personal information could increase the risk of identity theft, fraud, or other harm
certain identification numbers are issued by the government
the information is public or confidential
they can generally be used to transfer funds
they can generally be used to obtain further information about a specific individual, which could lead to identity theft or financial harm
the person can be identified in a nude or sexually explicit image

The general rule, according to Google's terms of service, is that search results will not be removed if they concern personal information that is publicly available on government websites.

Contact the search engine and request that the search result be erased.
1. If you wish to have certain search results erased by Google, you can request this by sending it to Google.
Similar resources may be available on websites of other web search engines, but if this is not the case, a message can be sent to the relevant web search engine and requested that certain search results be erased, with appropriate justification.
If a web search engine does not respond to a request for the search result to be erased, a complaint can be sent to the Data Protection Authority if:
the web search engine is Google – Data Protection has already ruled that Google is established in Iceland,
the web search engine is operated by a person established in Iceland or,
the web search engine is operated by a person who does not have a registered office in Iceland but the website's activities are related to (i) offering products or services to individuals within the EEA area, regardless of whether it is for payment or not, or (ii) monitoring the behaviour of individuals within the EEA area, and the Data Protection Authority then resolves the dispute between the parties.

If you can bring your dispute to the Data Protection Authority under the above conditions, you can also bring it directly to the courts.

Decisions by the Data Protection Authority can also be challenged by the courts.

Data Protection Authority

Request for deletion of personal data

Right to forget

Waiting time

Conditions

Right not applicable

Getting information erased from online search engines

Prerequisites for erasing search results

To ask for the search results about you to be erased from search engines on the Internet