Use of identification numbers and data protection

In some cases, the registration of an identification number (kennitala) is required. This can be the case, for example, when a person books appointments with a doctor, at a beauty salon or when a business relationship with a company is established.

The Data Protection Act states that the use of an identification number is only considered permitted if it has a pragmatic purpose and is necessary to ensure a secure identification.

The Data Protection Authority may prohibit or order the use of a social security number, but generally, it does not require permission from the Data Protection Authority to use a social security number.

Thematic purpose

In assessing whether the purpose is objective, it should be considered, among other things, whether a secure identification is important for the individual, for the person using the identification number or for the public interest.

The requirement of a factual purpose will not be met unless other identifiers, such as name, address or business number, are insufficient.

Example of the pragmatic purpose for using an identification number:

Similarly, it can be considered unreasonable to request a social security number in cash transactions, as there is usually no risk involved in such instruments that require identification.

The need to ensure secure identification

Along with the requirement of a factual purpose, the person who intends to require the registration of an identification number must demonstrate that it is necessary to ensure a secure identification, that is, that certain information can be linked to the person concerned.

The use of a personal identification number may be necessary to ensure that information about individuals is not confused and can thus contribute to the safe and reliable information.