Law note · Iceland
Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from Iceland
Article 16 of Act No. 90/2018, read directly, provides that a European Commission adequacy decision under General Data Protection Regulation (GDPR) Article 45 applies in Iceland only in accordance with the EEA Joint Committee's own decision, and requires the Minister to confirm such decisions and publish notice in the Law Gazette before they take domestic effect. This is a genuinely distinctive two-step mechanism: an adequacy decision does not apply automatically the moment the Commission adopts it.
Otherwise, a transfer outside the EEA requires appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49-equivalent derogation; transfers within the EEA, including to Norway and Liechtenstein, move freely.
What it asks of an app
- Confirm that a European Commission adequacy decision has its own EEA Joint Committee decision and ministerial confirmation, published in the Law Gazette, before relying on it for a transfer of personal data of a person in Iceland outside the EEA, under Act No. 90/2018 Article 16.
- Rely on Standard Contractual Clauses, Binding Corporate Rules, or a narrow derogation where no confirmed adequacy decision covers the destination country.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Althingi official consolidated-law database, fetched and read directly, Article 16