Processing of personal data by day parents in Reykjavík

1. Processing of personal data related to the Department's supervision of day parents and preparation of official statements for daycare permit requests

This information primarily concerns the processing of personal data related to the Department's supervision of day parents and the preparation of official statements for daycare permit requests, as per the second paragraph of Article 5 and Article 18a of Regulation No. 907/2005 on Daycare in Private Homes, with later amendments (hereafter referred to as the Regulation). According to the first paragraph of Article 34 of Act No. 40/1991, the social affairs committee or another committee as decided by the local government oversees child daycare in private homes and the operation of supervised playgrounds for children. The Quality and Supervisory Agency of Welfare grants operating licenses for daycare in private homes and supervised playgrounds for children. According to Article 4 of the Regulation, municipalities are responsible for supervising and internally monitoring day parents' operations. Article 5 of the Regulation states that the social affairs committee in each municipality bears general responsibility for children's welfare and must ensure proper conditions for children, as per the first paragraph of Article 30 of the Municipalities' Social Services Act No. 40/1991. Reference is also made to item c of Article 2 of Appendix 2.6 of the Resolution on the Management and of Reykjavík City and City Council Minutes, which authorizes the Director of the Department of Education & Youth to conduct statutory supervision of day parents' operations.

The social affairs committee (the Department of Education & Youth in Reykjavík) must cooperate with the public health committee and child protection services regarding children's conditions with day parents as needed, according to Article 6 of the aforementioned Regulation. Chapter X of the Regulation further details the supervision and monitoring of day parents' operations. If children's conditions are found to be inadequate according to Article 36 of the Regulation, or if a child is considered at risk according to Article 37, the social affairs committee (the Department of Education & Youth in Reykjavík) must take appropriate measures. According to the second paragraph of Article 36 of the same Regulation, the Quality and Supervisory Agency of Welfare must be immediately informed of such cases. The third paragraph states that the social affairs committee (the Department of Education & Youth in Reykjavík) must notify the Agency if guidelines are not followed. Cases under the first paragraph of Article 37 must be reported to the Quality and Supervisory Agency of Welfare and the public health authority, as per the second paragraph of Article 37.

Article 22 of Act No. 88/2021 on the Quality and Supervisory Agency of Welfare states that the Agency may request any information it deems necessary from those subject to its supervision for the implementation of the Act. The Quality and Supervisory Agency of Welfare is also permitted to share personal data, including sensitive information such as health data, family circumstances, social problems, and information about criminal conduct or alleged criminal conduct, with other supervisory authorities to the extent necessary for them to perform their statutory duties, based on point 1 of the first paragraph of Article 9 and point to of the first paragraph of Article 11 of Act No. 90/2018 on Data Protection and the Processing of Personal Data. For the same purpose, these supervisory authorities may share personal data with the Quality and Supervisory Agency of Welfare to the extent necessary for the Agency to perform its duties under these laws. Those authorized by law or regulation to provide official statements for operating license applications under these laws may process personal data, including sensitive information, to the extent necessary for carrying out the task.

What is the purpose for processing and its basis?

The Department of Education & Youth of Reykjavík City needs to process personal data of day parents, other household members, parents of children in daycare, and their children to supervise day parents and prepare official statements for daycare permit requests, as per the second paragraph of Article 5 and Article 18a of the Regulation.

Based on the above, the processing is grounded in the points 3 and 5 of the first paragraph of Article 9, and points 2, 4, and 7 of the first paragraph of Article 11 of Act No. 90/2018 on Data Protection and the Processing of Personal Data, which states that processing is permitted when necessary to fulfill legal obligations, for tasks carried out in the public interest or in the exercise of official authority vested in the data controller, and as part of the legitimate activities of Reykjavík City.

The processing may also be based on the first, third, and fourth paragraphs of Article 22 of Act No. 88/2021 on the Quality and Supervisory Agency of Welfare.

If the Department of Education & Youth of Reykjavík City is not provided with requested information, it may affect the supervision results, potentially leading to a notification to the Quality and Supervisory Agency of Welfare, which issues and revokes daycare permits. It may also affect the Department's official statement to the Quality and Supervisory Agency of Welfare regarding applications for daycare permits in private homes, as per the second paragraph of Article 5 of the Regulation on Daycare in Private Homes, and the first, third, and fourth paragraphs of Article 22 of the Act on the Quality and Supervisory Agency of Welfare.

No automated decision-making takes place based on the provided information.

What data is processed?

General personal information about day parents and their household members: Name, ID number, legal residence, phone number, email address, workplace address, home address, information from Reykjavík Public Health, day parent's placement agreements with parents of children in daycare, and other information provided by the day parent or others for internal supervision of daycare, as well as information that may be received from other parties.

Sensitive personal information about the day parent and their household: Information that appears on criminal records and medical certificates. Information from Child Protection Services and other sensitive personal information as defined in the third paragraph of Article 3 of the Personal Data Protection Act that day parents or others provide for internal monitoring of day care, as well as information that may be received from other parties. The Quality and Supervisory Agency of Welfare may also share personal information, including sensitive data such as health information and potentially sensitive details like family circumstances, social problems, and information about criminal behavior or suspected criminal behavior, with other supervisory authorities as necessary for them to perform their statutory duties. For the same purpose, these supervisory authorities may share personal data with the Quality and Supervisory Agency of Welfare to the extent necessary for the Agency to perform its duties under these laws.

General personal information about parents and child: Child's name, ID number, legal residence, period of child's stay, number of hours of care according to the care agreement, names of parents, ID numbers of parents, phone numbers, email addresses, and marital status. If a sibling is of preschool age, this is indicated on the child's record, along with information relevant to higher subsidies such as parents' marital status, whether the individual is disabled, a student, or an employee of a Reykjavík City preschool.

Sensitive personal information about parents and children: Sensitive personal information may be processed as defined in the third paragraph of Article 3 of the Personal Data Protection Act that day parents or others provide for internal monitoring of day care, as well as information that may be received from other parties.

Where does the information come from, and where is it recorded?

The Department of Education & Youth receives information from the Quality and Supervisory Agency of Welfare, day parents and parents, day-care advisors, supervisors, and potential reporters.

The Office of the Department of Education & Youth uses the Hlaðan registration and document management system based on a processing agreement with Hugvit hf. The Department of Education & Youth uses Microsoft 365 in its operations.

Information about children's and day parents' legal residence in Vala is cross-checked with Registers Iceland. For day care inspections, certain general information about the day care is recorded in the iAuditor program. After inspection visits, the supervisor converts completed inspection reports to PDF files in the iAuditor program. The supervisor then securely stores the PDF documents.

The Department of Education & Youth and other municipalities in the capital area may collect and share information about the number, names, ID numbers, hours of stay, and subsidy amounts for children legally residing in the municipalities and registered in day care. They may also share information about the children's parents' names and email addresses. The municipalities may also share and obtain information about the names and ID numbers of day parents who have children with legal residence in other municipalities in their care.

2. Processing of personal information related to payment and monitoring of the Department of Education & Youth's subsidies

This education also concerns the processing of personal information related to payment and monitoring of the Department of Education & Youth's subsidies to day parents for children legally residing in Reykjavík. According to Article 42 of the Regulation on Daycare in Private Homes, local governments may subsidize the cost of home-based day care. Reykjavík City's rules on subsidies for children with day parents state that the subsidy is paid to reduce parents' day care fees. The subsidy follows the child, and day parents and parents make an agreement that the Department of Education & Youth's subsidy goes to the day parent, subject to certain conditions. In certain cases, parents can apply to the Department of Education & Youth for an increase in the subsidy to the day parent.

• Rules on subsidies for children with day parents

What is the purpose for processing and its basis?

The Department of Education & Youth needs to process personal information of day parents, other household members of day parents, parents of children in day care, and children to process and handle requests for subsidies to day parents.

Based on the above, the processing is based on the points 2, 3, and 5 of the first paragraph of Article 9, cf. also points 2, 4, and 7 of the first paragraphs of Article 11, of Act No. 90/2018 on Personal Data Protection and Processing of Personal Data, which states that processing is permitted if necessary to fulfill a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract, if the processing is necessary to comply with a legal obligation, and if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

The processing may also be based on the first, third, and fourth paragraphs of Article 22 of the Act on the Quality and Supervisory Agency of Welfare.

If the requested information is not provided to the Department of Education & Youth, it may result in the inability to process a subsidy request or related matters.

No automated decision-making takes place based on the provided information.

What data is processed?

General personal information about day parents and household members: Name, ID number, legal residence, phone number, email address, workplace address, home address, account number, day care fee schedule, invoices to parents with confirmation of payment, day parent's preschool placement agreements with parents of children in day care, and other information that day parents or others provide for monitoring subsidies, as well as information that may be received from other parties. The Department of Education & Youth also has the right to information about whether a day parent closes their day care.

Sensitive personal information about the day parent and their household:Sensitive personal information may be processed as defined in point 3 of the third paragraph of Article 3 of the Personal Data Protection Act that day parents or others provide for monitoring subsidies and subsidy applications, as well as information that may be received from other parties.

General personal information about parents and child: Child's name, ID number, legal residence, period of child's stay, number of hours of care according to the care agreement, names of parents, ID numbers of parents, phone numbers, email addresses, and marital status. If a sibling is of preschool age, this is indicated on the child's record, along with information relevant to higher subsidies such as parents' marital status, whether the individual is disabled, a student, or an employee of a Reykjavík City preschool.

Sensitive personal information about parents and children: Sensitive personal information may be processed as defined in the point 3 of Article 3 of the Personal Data Protection Act that parents wish to provide during the application process, day parents or others provide for monitoring subsidies, as well as information that may be received from other parties. For applications for higher subsidies due to disability, a disability certificate for the parent in question must be included.

Where does the information come from, and where is it recorded?

The Department of Education & Youth receives information from the Quality and Supervisory Agency of Welfare, day parents and parents, day-care advisors, supervisors, and potential reporters.

The Office of the Department of Education & Youth uses the Hlaðan registration and document management system based on a processing agreement with Hugvit hf. The Department of Education & Youth uses Microsoft 365 in its operations.

Information about the day parent and agreements on subsidies and changes to agreements are recorded in the electronic registration and information system Vala preschool based on a processing agreement made with Advania ehf.

Information about children's and day parents' legal residence in Vala is cross-checked with Registers Iceland. For day care inspections, certain general information about the day care is recorded in the iAuditor program. After inspection visits, the supervisor converts completed inspection reports to PDF files in the iAuditor program. The supervisor then stores the PDF files in a locked shared folder for Department of Education & Youth staff involved with home-based day care.

The Department of Education & Youth has the right to receive a preschool placement agreement made between day parents and parents in connection with monitoring day parent operations, the day care fee schedule, and invoices to parents with confirmation of payment, as well as other information that may be necessary to obtain.

The Department of Education & Youth and other municipalities in the capital area may collect and share information about the number, names, ID numbers, hours of stay, and subsidy amounts for children legally residing in the municipalities and registered in day care. They may also share information about the children's parents' names and email addresses. The municipalities may also share and obtain information about the names and ID numbers of day parents who have children with legal residence in other municipalities in their care.