The Central Bank of Iceland was not obliged to delete information that the bank seized during a search of Samherji’s house, and the bank had a legal obligation to provide the information to the district prosecutor. This is stated in the ruling of the Data Protection Authority on the complaint of Þorsteinn Mar Baldvinsson, CEO of Samherji.
These are data and information that the Central Bank obtained through a house search in 2012. These included electronic data, such as Þorsteinn Mar’s e-mails, information about his finances, and more. Porsteinn was summoned to report to the Director of Tax Investigations regarding the so-called Samherji documents, where the data was presented to him. The Director of Tax Investigations had received the data from the District Prosecutor, but he received the data from the Central Bank.
The ruling states that Porsteinn considered the delivery of this data a violation of the Privacy Act and that the Central Bank was obliged to delete the data after the bank’s investigation of Þorsteinn Mar and Samherji had ended.
Porsteinn also demanded that the Data Protection Authority goes into the collection of information and data on what conditions or criteria had been in the district court that authorized the search, for a search of Samherji’s house and whether those criteria had been violated. Then it would be necessary to examine exactly what data was involved. It was unclear from the Central Bank’s answers what documents were still in the Bank’s custody.
The case of the Central Bank, Samherji, and Porsteinn Mar ended when the Supreme Court annulled a fine of ISK 15 million against Samherji and Porsteinn for alleged violations of foreign exchange laws. The bank was subsequently ordered to pay Porsteinn Mar ISK 2.5 million in damages.
The Central Bank’s response to Porsteinn’s complaints states that the data on him and Samherji had been stored and that only a handful of the bank’s employees had access to them. The preservation of the data was based on law and that the bank is an independent institution owned by the state, which must hand over its documents to the National Archives. The bank was also obliged to hand over the documents to the district prosecutor.
“In the Central Bank’s view, the delivery of the data was at once lawful, clear and made for objective purposes, as it was the opinion of the District Prosecutor’s office that the data could have probative value in the current investigation of [Samherji]’s cases,” the ruling states.
