Law Library Stacks

Back to Index of of Legal Reports
Back to Comparative Summary

Full Report (PDF, 2.78MB)
Map: COVID-19 Contact Tracing Apps (PDF, 550KB)

Jurisdictions Surveyed:
The Americas: Argentina | Brazil | Mexico
East Asia, South Asia and Pacific: Australia | China | India | Japan | South Korea | Taiwan
Europe and Central Asia: European Union | England | France | Iceland | Italy | Norway | Portugal | Russia | Spain | Turkey
Middle East and Africa: Iran | Israel | South Africa | United Arab Emirates

Iceland

Privacy is a constitutionally protected right under Icelandic law. As a European Economic Area member, Iceland is bound by some EU legislation, and has implemented both the General Data Protection Regulation (GDPR) and the Directive on Privacy and Electronic Communications. Under the GDPR, Iceland permits the collection, storage, and sharing of personal data (including location data) in a limited number of cases, such as when there is public interest or following consent.

As of May 22, 2020, Iceland only had two active cases of COIVD-19 infection, with 1,791 patients recovered and ten fatalities, making it one of the countries globally that has most successfully managed to stem the spread of the disease. Iceland has launched a COVID-19 transmission app to contact trace infections. The app tracks and saves the location of users on their smartphones. If a user is later confirmed infected with COVID-19, the Icelandic Contact Tracing Team requests access to the location data from the phone. While the app has been downloaded by 40% of the population, it has mainly served to complement ordinary contact tracing methods. 

I. Introduction/Overview

A. COVID-19 in Numbers

Iceland is one of the world’s smallest independent nations. It is an island in the North Atlantic sea with approximately 350,000 inhabitants.[1]

Iceland is considered one of the countries that have, so far, successfully limited the spread of COVID-19 within its populace.[2] Iceland reported its first COIVD-19 case on February 28, 2020.[3] Iceland has, as of May 22, 2020, reported 1,803 confirmed cases and 10 fatalities from COVID-19.[4] Of the total confirmed cases, 1,791 patients have recovered.[5] Currently, there are only two active cases, and the country has not recorded any new cases since May 12, 2020.[6] There are currently no patients with COVID-19 treated in hospitals or intensive care units.[7] Also as of May 22, 2020, 58,295 persons have been tested for COVID-19 in Iceland.[8] Only the Faroe Islands (part of Denmark) and Gibraltar (part of the United Kingdom) have tested more residents per capita.[9]

B. Smartphone Use

Smartphone use is widespread in Iceland, with the number of Icelandic cell phone subscriptions outnumbering the total population.[10] With 238,395 contract subscriptions, about 80% of all cell phone users are using the 4G network.[11] It is unclear how willing the population is to share the data.

C. The Rakning C-19 App

On April 19, 2020, Iceland introduced a mobile app to trace people with COVID-19.[12] The app, Rakning C-19,[13] is available via the Apple Store,[14] as well as Google Play.[15] The app was designed on behalf of the Contingency, Department of Civil Protection and Emergency Management.[16] Reportedly, close to 40% of all Icelanders have downloaded the COVID-19 app, making it the most widely downloaded app in any one country as measured per capita.[17] However, some commentators claim that it has not been a “game changer.”[18] Reportedly, the purpose of the app is to help users refresh their memory, and representatives from Iceland treat the app more as a complement to ordinary contact tracing than as a stand-alone approach.[19] There is no requirement to use the app for either infected or uninfected persons. Persons in quarantine are also not required to use the app. Persons in quarantine and isolation are, however, required to check in with their local health care providers daily.[20] Iceland started testing about four weeks before it had a confirmed case.[21] Reportedly, Iceland remains one of the countries with the lowest COVID-19 fatalities measured per capita.[22]

D. Travel Restrictions in Force

Iceland, as a Schengen Area nation, normally allows European Union citizens to enter the country without border checks.[23] Nevertheless, on April 24, 2020, it closed its borders to noncitizens and currently requires everyone arriving in Iceland, regardless of nationality, to self-quarantine for 14 days.[24] If subject to self-quarantine, a person must stay home for 14 days but may use a taxi to visit a doctor or a dentist.[25] A person in quarantine may not, however, shop for groceries in person or take public transport.[26] Quarantine is not a total isolation, but a person in quarantine should limit contacts with others to a minimum.[27] In addition to international travelers, persons who have come in contact with a person with COVID-19 also must self-quarantine.[28] As of May 22, 2020, a total of 20,194 persons have completed a self-quarantine in Iceland, and another 886 are currently self-quarantining.[29] Self-quarantining is less restrictive than isolation, but persons must follow the guidelines.[30] Under Icelandic law, persons who have COVID-19 must isolate for the duration of their illness, meaning they must stay at home alone or together with a person who is also isolating.[31] Persons who are not sick may isolate together with the sick individual but should not come within one meter (three feet) of the sick person, and if another person in the household contracts the disease, the isolation will be prolonged.[32] For the duration of their isolation, the person’s primary care provider will be in contact with the person daily.[33] As of May 22, 2020, two persons are currently in isolation.[34] Violating quarantine and isolation rules is punishable by monetary fines of between ISK50,000 (about US$370) and ISK500,000 (about US$3,700), depending on the severity of the violation.[35] In addition, under the General Penal Code:

causing a danger that a communicable disease will break out or be spread between people by violating the provisions of law on preventive measures against communicable diseases, or precautionary rules on these matters issued by the authorities, shall be [punishable by imprisonment] for up to 3 years. The punishment may take the form of up to 6 years’ imprisonment in the case of diseases which the authorities have taken special measures to contain or to prevent their entering the country.[36]

Currently, the Rakning C-19 app is not used to monitor compliance with the quarantine or isolation rules.

II. Legal Framework

A. Privacy and Data Protection

Iceland regulates privacy rights and data protection. The Icelandic Constitution guarantees the right to privacy in article 71.[37] However, such rights may be limited “by statutory provisions if this is urgently necessary for the protection of the rights of others.”[38] Iceland is also a signatory to the European Convention on Human Rights, which guarantees the right to privacy in article 8.[39] As a European Economic Area (EEA) member, Iceland is bound by the General Data Protection Regulation (GDPR).[40] Moreover, because of its EAA membership, Iceland must also follow all of the EU legislation on electronic communications.[41] Iceland transposed the GDPR into Icelandic law through the Act on Data Protection and Processing of Personal Data (Act No. 90/2018) in 2018.[42] The purpose of the Act on Data Protection and Processing of Personal Data is to“promote that personal data be treated in accordance with fundamental principles and rules on the protection of personal data and respect for private life, and to ensure the reliability and quality of such data and their free flow within the EEA single market.”[43]

Personal data is defined in article 3.2 as:

“Information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Sensitive personal data is defined in article 3.3 as data that reveals racial or ethnic origin, political opinions, philosophical beliefs, trade union membership; data related to physical or mental health (including substance abuse); data on a person’s sex life or sexual orientation; genetic data; and biometric data.[44]

Both personal and sensitive data may be processed on the basis of consent.[45] Consent (to the treatment of personal data) is defined as: “A freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”[46] A person must be at least 13 years of age to give consent.[47]

In addition to processing based on consent, personal data may also be processed if it is necessary for the performance of a contract, compliance with a legal obligation, protecting a vital interest of the person the data pertains to or of another person, or a task undertaken in the public interest. [48] Article 52 specifically states that personal data may be used to fight or prevent contagious diseases.[49] Article 14, which deals with electronic surveillance, states that it must be carried out for an objective purpose.[50]

B. Electronic Measures to Fight COVID-19 Spread

Data retention is authorized by a number of Icelandic statutes, including the Telecommunications Act,[51] Patients’ Rights Act (medical records),[52] and contagious diseases legislation.[53] Moreover, as an EEA member, Iceland has an obligation to implement the Directive on Privacy and Electronic Communications.[54] This obligation was carried out by implementation of the Telecommunications Act.[55]

Location tracking and electronic surveillance is regulated in law, specifically in the Law on Electronic Communications and the Rules on Electronic Surveillance.[56] Typically, the tracking of individuals is restricted. Tracking may only be used if there is a legitimate need, such as “significant security factors, by consent of the data subject, or according to other specific authorization, e.g. by wage contracts or provisions of law.”[57] In addition, tracking a vehicle requires a lawful and reasonable objective for needing to track the location of the driver.[58] Monitoring attendance either at school or at work (such as a work schedule) is typically not restricted by this legislation.[59] Electronic surveillance must only “be carried out for specified, explicit and legitimate purposes, such as security or property protection.”[60] The police may also share and use data under a limited set of circumstances.[61] For example, the police may use electronic surveillance of persons who are suspected of having committed a crime that carries a sentence of at least one year.[62] Personal information that pertains to a person’s medical records is regulated by the Patients’ Rights Act.[63]

Responses to epidemics are regulated by the Act on Health Security and Communicable Diseases.[64] Article 3 states that the Chief Epidemiologist is responsible for maintaining a record of persons with communicable diseases and also has a right to access health record information in accordance with the Medical Act.[65] However, the information must be made unidentifiable.[66] Retaining personal data is one of the main duties of the Chief Epidemiologist, “in order to monitor the spread of communicable diseases, by gathering detailed data on their diagnosis from laboratories, hospitals and physicians.”[67] Article 7 of the Act on Health Security and Communicable Diseases regulates the individual’s responsibility in a pandemic, which includes tracing.[68] However, there is no obligation on behalf of the individual, or right on behalf of the authorities, to go through the person’s phone to trace the person’s whereabouts.[69] The Chief Epidemiologist may, however, request help from the police if the person does not comply with measures to stop the spread, but measures that may be taken by the police include only isolation measures, not measures focused on tracing the spread.[70]

C. Enforcement

Enforcement of data protection rules is carried out by the Icelandic Data Protection Authority.[71] The Authority is independent and oversees the implementation and compliance with the GDPR.[72] It also issues daily as well as administrative fines for noncompliance.[73] Daily fines can be up to ISK200,000 (about US$1,480) for each day that a party violates an Authority order.[74] Administrative fines range from ISK100,000 (about US$740) to ISK1.2 billion (about US$8.9 million), and are typically issued to the designated data controller of the corporation or institution that handles personal data in breach of the personal data legislation.[75] Both physical persons and legal entities can be fined.[76]

On May 19, 2020, the Authority issued a comment regarding the sharing of health information, asking the Icelandic Parliament to define the scope of the legal protection.[77]

III. Electronic Measures to Fight COVID-19 Spread

As discussed in section I.C. above, Iceland has developed a smartphone app, the Rakning-19 app, to respond to the COVID-19 pandemic. The app has received international recognition as being one of the least invasive apps from a privacy perspective.[78]

The app collects location data and retains it for 30 days on the user’s smartphone.[79] To use the app, the smart phone must allow GPS tracking.[80] It does not track who you have been in contact with, as the data is only saved on the user’s phone, and the Department of Civil Protection and Emergency Management’s Contact Tracing Team sends a request to users who have been diagnosed with COVID-19 to share its previously recorded data with the Contact Tracing Team Database.[81] To share the data, an individual must type his or her ID number into the app.[82] Once shared, the Contact Tracing Team will store the data for 14 days.[83] According to the privacy statement for the app, the data controller is the Icelandic Department of Health.[84]

Although the Contingency Agency developed the Rakning-19 app with the purpose of tracing the spread of COVID-19 in Iceland, it is not the primary source for contact tracing. Use of the app remains voluntary, whereas daily calls with the local health care provider are mandatory.[85] Iceland has focused on tracking persons who are confirmed as infected with COVID-19 or who have been in direct contact with a person who has been confirmed as infected with COVID-19.[86]

Back to Top

Prepared by Elin Hofverberg
Foreign Law Specialist
June 2020


[1] The World Factbook: Iceland, CIA, https://perma.cc/PES2-Y39T.

[2] Thomas K. Grose, What Iceland Can Teach the World About Minimizing COVID-19, US News (May 4, 2020), https://perma.cc/628Z-NTG3.

[3] COVID-19 in Iceland—Statistics, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., https://perma.cc/E967-55UV.

[4] Id.

[5] Id.

[6] Id.

[7] Id.

[8] Id.

[9] COVID-19 Coronavirus Pandemic, Worldometer (May 22, 2020), https://perma.cc/93LJ-8FNK

[10] Tölfræði um íslenska fjarskiptamarkaðinn Fyrri helmingur ársins 2019 [Statistics on the Icelandic Telecommunications Market: The First Half of 2019] (Nov. 2019), PFS, https://perma.cc/4VVP-2JNW.

[11] Id. at 18;see also Statistics Report on the Icelandic Telecommunications Market in 2019, Iceland Post & Telecom Admin. (May 14, 2020), https://perma.cc/TE9N-KJCF.

[12] Contagion Tracing Is a Community Affair, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., https://perma.cc/4DDX-ADMM.

[13] Rakning C-19 appið, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., https://perma.cc/V55B-9SNG. Rakning means tracking/counting in Icelandic.

[14] Rakning C-19, Apple Store, https://perma.cc/V4SY-LHZP.

[15] Rakning C-19, Google Play, https://perma.cc/KE5D-TDWH.

[16] Contagion Tracing Is a Community Affair, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., supra note 12.

[17] Covid Tracing Tracker—Read Only, MIT Tech. Rev., https://docs.google.com/spreadsheets/d/1ATalASO8KtZMx__zJREoOvFh0nmB-sAqJ1-CjVRSCOw/edit#gid=0; Bobbie Johnson, Nearly 40% of Icelanders Are Using a Covid App—and It Hasn’t Helped Much, MIT Tech. Rev. (May 11, 2020), https://perma.cc/G22G-FQAK.

[18] Id.

[19] How Iceland Handles Contact Tracing, NPR (May 17, 2020), https://perma.cc/EBW8-2QQZ.

[20] Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine, https://perma.cc/7L4H-VLJH; Directorate of Health Iceland, Instructions for Persons Under Home-Based Isolation, https://perma.cc/V5TQ-MRPG.

[21] Todd Bishop, COVID-19 Lessons from Iceland: How One Nordic Country Has All but Stopped the Virus in Its Tracks, GeekWire (May 17, 2020), https://perma.cc/RKS6-LG4G.

[22] Id.

[23] Schengen Area, Eur. Commission, Migration & Home Aff., https://perma.cc/5SVB-B68C.

[24] Press Release, Government of Iceland, Iceland Introduces Temporary Schengen Border Controls and 14-Day Quarantine for International Arrivals (Apr. 22, 2020), https://perma.cc/3XV2-GJ9T.

[25] How Does Quarantine Work?, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., https://perma.cc/35QE-7C5M; Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine, supra note 20.

[26] Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine, supra note 20.

[27] Id.

[28] How Does Quarantine Work?, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt.,supra note 25.

[29] COVID-19 in Iceland—Statistics, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., supra note 3.

[30] Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine, supra note 20.

[31] How Does Isolation Work?, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt.,https://perma.cc/KE53-E625; Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine, supra note 20.

[32] Id.

[33] Id.

[34] COVID-19 in Iceland—Statistics, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., supra note 3.

[35] Ríkissaksóknari, Brot gegn sóttvarnarlögum og reglum settum samkvæmt þeim, sbr. 19. gr. sóttvarnalaga nr. 19/1997, vegna heimsfaraldurs COVID-1 (Mar. 27, 2020), https://perma.cc/3S5X-N94P.

[36] General Penal Code 1940 No. 19 (12 February) as amended, art. 175 [hereinafter General Penal Code], https://perma.cc/6HDC-XYNU.

[37] Constitution of the Republic of Iceland (No. 33, 17 June 1944, as amended 30 May 1984, 31 May 1991, 28 June 1995 and 24 June 1999), https://perma.cc/HFS6-A3DL [in English].

[38] Id.

[39] European Convention on Human Rights, 213 U.N.T.S. 221 (entered into force Mar. 9, 1953), https://perma.cc/XP8C-Z7HJ.

[40] EEA Joint Committee No. 154/2018 of 6 July 2018 Amending Annex XI (Electronic Communication, Audiovisual Services and Information Society) and Protocol 37 (Containing the List Provided for in Article 101) to the EEA Agreement [2018/1022], 2018 O.J. (L 183) 23, https://perma.cc/W5ZR-BZ5P (in English); https://perma.cc/VV5M-CBRL (in Icelandic); Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), [2018/1022], 2016 O.J. (L 119) 1, https://perma.cc/9TR8-YS5R.

[41] Decision of the EEA Joint Committee No 80/2003 of 20 June 2003 Amending Annex XI (Telecommunication Services) to the EEA Agreement, 2003 O.J. (L 257) 31 [hereinafter Decision of the EEA Joint Committee No 80/2003], https://perma.cc/2UWT-AKPS; Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 Concerning the Processing of Personal Data and the Protection of Privacy in the Electronic Communications Sector (Directive on Privacy and Electronic Communications) 2002 O.J. (L. 201) 37 [hereinafter Directive 2002/58/EC], https://perma.cc/YCY4-M68Z.

[42] Act on Data Protection and the Processing of Personal Data (No. 90 of 27 June 2018), https://perma.cc/T52A-NWPB (unofficial English translation by the Data Protection Authority). For an overview of the Icelandic implementation of the GDPR, see Ingvi Snær Einarsson, Iceland—National GDPR Implementation Overview, DataGuidance(Nov. 2019), https://perma.cc/8L97-RW3G. According to article 2 of the implementing legislation (Act on Data Protection and Processing of Personal Data (Act No. 90/2018)), “as it is incorporated into the Agreement on the European Economic Area, shall apply in Iceland with the adaptations resulting from the Decision of the EEA Joint Committee amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement.”

[43] Act on Data Protection and the Processing of Personal Data art. 1.

[44] Id. art. 3.3.

[45] Id. arts. 9 and 10.

[46] Id. art. 3.3.

[47] Id. art. 10.

[48] Id. art. 9.

[49] Id. art. 52.

[50] Id. art. 14.

[51] Electronic Communications Act No. 81, 26 March 2003, art. 43 [hereinafter Electronic Communications Act], https://perma.cc/74QZ-7PNT.

[52] Patients’ Rights Act, No. 74/1997, as amended by Act No. 77/2000, No. 40/2007, No. 41/2007, No. 112/2008, No. 55/2009, No. 162/2010, No. 126/2011, No. 34/2012 and No. 44/2014, https://perma.cc/QQ6V-J4EN (unofficial English translation by the Ministry of Justice).

[53] Act on Health Security and Communicable Diseases, No. 19/1997, as amended by Act No. 90/2000, No. 93/2002, No. 164/2002, No. 55/2004, No. 43/2007, No. 167/2007, No. 88/2008, No. 112/2008, No. 162/2010, No. 126/2011 and No. 117/2016 [hereinafter Act on Health Security and Communicable Diseases], https://perma.cc/3785-TYNX

[54] Decision of the EEA Joint Committee No 80/2003; Directive 2002/58/EC.

[55] Electronic Communications Act.

[56] Electronic Communications Act art. 43; Rules No. 837/2006 on Electronic Surveillance, https://perma.cc/2FQG-UWCV.

[57] Rules No. 837/2006 on Electronic Surveillance art. 8.

[58] Id.

[59] Id. art. 1.

[60] Id. art. 4.

[61] Regulation on Management of Personal Information by the Police, No. 322 9 April 2001 with Amendment No. 926/2004, arts. 6 and 7 [hereinafter Regulation on Management of Personal Information by the Police], https://perma.cc/NV5K-SX44 (unofficial translation by Ministry of Justice of Iceland), as well as Amendment No. 926/2004, https://perma.cc/W4VK-GJQF.

[62] Rules No. 837/2006 on Electronic Surveillance. See also Regulation on Management of Personal Information by the Police, as well as Amendment No. 926/2004, and the General Penal Code.

[63] Patients’ Rights Act, No. 74/1997, as amended by Acts No. 77/2000, No. 40/2007, No. 41/2007, No. 112/2008, No. 55/2009, No. 162/2010, No. 126/2011, No. 34/2012 and No. 44/2014, https://perma.cc/QQ6V-J4EN (unofficial English translation by the Ministry of Justice).

[64] Act on Health Security and Communicable Diseases. 

[65] Id. art. 3.

[66] Id.

[67] Id. art. 5.

[68] Id. art. 7.

[69] Id.

[70] Id. art. 14.

[71] Act on Data Protection and the Processing of Personal Data art. 1.

[72] Id. art. 38.

[73] Id. arts. 45 and 46.

[74] Id. art. 45.

[75] Id. art 46.

[76] Id.

[77] Álit um skrár Embættis landlæknis, Personuvernd (May 19, 2020), https://perma.cc/E66E-FVTV; Álit um skrár Embættis landlæknis: Mál nr. 2020010064, Personuvernd (May 19, 2020), https://perma.cc/VM9E-LZ86.

[78] Patrick Howell O’Neill et al., A Flood of Coronavirus Apps Are Tracking Us. Now It’s Time to Keep Track of Them, MIT Tech. Rev. (May 7, 2020), https://perma.cc/GH99-JWER.

[79] Contagion Tracing Is a Community Affair, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., supra note 12. 

[80] Id.

[81] Id.

[82] Id.

[83] Id.

[84] Privacy Statement, Directorate of Health Iceland and Dep’t of Civ. Protection & Emergency Mgmt., https://perma.cc/U4L8-J95F.

[85] Directorate of Health Iceland, Instructions for Persons Under Home-Based Quarantine,supra note 20; Directorate of Health Iceland, Instructions for Persons Under Home-Based Isolation, supra note 20.

[86] How Iceland Handles Contact Tracing, NPR (May 17, 2020), supra note 19.

Last Updated: 12/30/2020