Court says Central Bank had to retain Thorsteinn’s personal data

Iceland’s Central Bank was required to preserve a database containing personal information about Thorsteinn Már Baldvinsson and could not delete it without permission from the National Archives of Iceland, Reykjavík District Court ruled, according to mbl.is. The court dismissed his claim for damages.

The court found that retaining the records served a legitimate purpose because related cases were still being handled. Baldvinsson’s personal information was a small, inseparable part of a larger dataset seized during a search of Samherji’s premises in 2012.

Baldvinsson sought more than 2.2 million Icelandic krónur in non-pecuniary damages over the retention of his data from November 2018 to April 2020. The court also found that he had not shown that bank employees acted culpably or that the retention caused him non-pecuniary harm.

The records were copied from Samherji and related companies’ electronic systems during a search on March 27, 2012. They included accounting files, work emails and data from employees’ computer areas, as well as personal information about Baldvinsson, including photographs, a passport copy, travel plans and financial details.

The Central Bank fined Baldvinsson 1.3 million krónur in September 2016 and Samherji 15 million krónur. The Supreme Court overturned Samherji’s fine on November 8, 2018. The bank withdrew Baldvinsson’s fine on April 24, 2019, after reviewing fines and settlements relating to alleged breaches of capital controls.

The district court said the Supreme Court’s ruling in Samherji’s case had not ended Baldvinsson’s own administrative case; that concluded when his fine was withdrawn in April 2019. Baldvinsson and Samherji later brought damages cases against the bank, which were not concluded until the Court of Appeal ruled on March 11, 2022.

In an earlier case, the Court of Appeal awarded Baldvinsson 2.48 million krónur for financial losses and 200,000 krónur in non-pecuniary damages over an unlawful fine decision. The current case concerned the separate issue of retaining his personal data.