Chapter VI (Articles 30+) Data Protection Authority + Enforcement. Personuvernd (Icelandic Data Protection Authority) - independent statutory regulator established 2000 + reorganised 2018 under Act 90/2018; statutory powers per GDPR Articles 51-59 + Iceland-specific: investigation (own-motion + complaint) + audit + inspection + Compliance Review + access to data + premises + systems; Information Sharing with other supervisory authorities (EDPB + EEA EFTA Surveillance + ESA + Nordic privacy authorities); Personuvernd Board (5 members appointed by Iceland Minister for 4 years); Commissioner + staff. Article 38 Processing in Employment Context - Iceland-specific employment data: monitoring + email + camera + GPS + biometric + drug testing + Personuvernd 2017 + 2021 + 2024 Guidance + employee notice obligations + works council consultation; Iceland Labour Code + Privacy Act intersection. Article 41 Exemptions from Certain GDPR Provisions - Iceland-specific exemption for academic + artistic + literary + journalistic expression (Article 85 GDPR transposition); journalistic exemption per Iceland Constitution Article 73 freedom of expression. Article 35 Right of Access details + 1 month response. Article 39 Compensation for Damages - GDPR Article 82 transposition; civil liability + non-material damage recoverable. Administrative Fines per GDPR Article 83 - up to EUR 20 million or 4 percent global turnover (tier 2) for serious violations; up to EUR 10 million or 2 percent (tier 1); Personuvernd may impose fines + cease-and-desist + ban + injunction. Criminal Penalties per Penal Code Section 228 - up to 1 year imprisonment + up to 3 years for aggravated; corporate criminal liability. Appeals: Personuvernd decisions appealable to District Court of Reykjavik + Supreme Court of Iceland. Iceland Act 90/2018 + Personuvernd + Enforcement + Section 228 + Court Appeals applies.
This control maps to 22 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 22 it maps to, and the evidence behind each claim, over MCP and REST.