Sectoral application of Act 90/2018 with Iceland-specific implementing guidance. Employment (Article 38 + Personuvernd Guidance 2017 + 2021 + 2024) - employee monitoring + email + camera + GPS + biometric + medical + drug testing + DNA testing limited; notice obligations + works council consultation + transparency; Iceland Labour Code + Act on Working Environment intersection. Children: Article 10 sets consent age 13 (lower than GDPR Article 8(1) default 16); Personuvernd Guidance on Children's Data + EdTech operator due diligence + parental consent verification + school context. Direct Marketing: Act on Electronic Commerce No 30/2002 transposing EU Directive on Electronic Commerce + opt-in for new consents + opt-out via easy mechanism + Personuvernd register. Automated Decision-Making + Profiling: Article 21 + GDPR Article 22 transposition; restrictions on legal or similarly significant effects on data subject; Personuvernd Generative AI Guidance 2024 (alongside EDPB) for ChatGPT + LLMs. Cookies: Act on Electronic Communications No 70/2022 transposing EU ePrivacy Directive Article 5(3) - consent required for non-essential cookies + clear notice + easy refusal; Personuvernd 2023 Guidance on Cookies. Sensitive sectoral: health data (Act on Patient Records + Act on Health Records + Act on Genetic Information) + financial sector (Iceland Financial Supervisory Authority FME + Act on Personal Information in Financial Service) + telecommunications (Post and Telecom Administration PFS + Act on Electronic Communications). Iceland Cybersecurity Act 2024 (NIS2 transposition) - intersection with Personuvernd on breach reporting + critical infrastructure. Iceland Act 90/2018 + Sectoral + Iceland-specifics applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.