Peningamálastjórnun

Peningamálastjórnun, also known as the Regulation on the Protection of Personal Data Relating to the Processing of Personal Data by the Icelandic Data Protection Authority, is a legal framework established in Iceland to regulate the collection, processing, and storage of personal data. The regulation is designed to ensure that personal data is handled in a manner that respects the privacy and rights of individuals, while also promoting the free flow of personal data within the European Union.

The regulation applies to all entities that process personal data, including public authorities, private companies, and individuals acting in a professional capacity. It sets out specific requirements for data controllers, who are responsible for determining the purposes and means of processing personal data, and data processors, who process personal data on behalf of the data controller.

Key provisions of the regulation include the requirement for data controllers to obtain explicit consent from individuals before processing their personal data, with certain exceptions. Data controllers must also ensure that personal data is processed lawfully, fairly, and in a transparent manner. They must implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

The regulation also establishes the role of the Icelandic Data Protection Authority, which is responsible for monitoring compliance with the regulation and enforcing its provisions. The authority can impose administrative fines on data controllers and processors that fail to comply with the regulation.

Peningamálastjórnun is part of Iceland's broader effort to protect individual privacy and promote data protection, and it is aligned with the General Data Protection Regulation (GDPR) of the European Union. The regulation is subject to periodic review and may be amended to reflect changes in technology, legal developments, and best practices in data protection.