D2.3 USER UNDERSTANDING OF PERSONAL INFORMATION PROTECTION ONLINE This factor looks at whether Internet users and stakeholders within the public and private sectors recognise and understand the importance of protection of personal information online, and whether they are sensitised to their privacy rights. Maturity Stage: Formative Iceland has adopted and enforced data protection legislation such as the Data Protection Act, No. 77/2000 which lays out general conditions for the collection of personal data and protection from misuse, and which promotes a practice of personal data processing in accordance with fundamental principles and rules regarding data protection and privacy. Based on the Act, the DPA has published rules No. 299/2001 on the Security of Personal Data. The rules explicitly ask for measures regarding higher risks to personal data when they are processed on the Internet (Article 4) as well as requiring all controllers to implement security measures in accordance with the risk involved in the processing of personal data along with measures to mitigate the risk. Iceland is also in the process of implementing the EU General Data Protection Regulation (GDPR). Moreover, the Regulation in the Protection of Information in the Public Communications Networks No 1221/2007 aims “to enhance consumer protection”. Users and stakeholders within the public and private sectors have general knowledge about how personal information is handled online but (proactive) cybersecurity practices are rarely used, either due to perceived inconvenience or due to the way people weigh up the tradeoffs in service and protection of their personal information. Participants noted that social security numbers and personal information are widely used for authentication. However, users do yet not perceive that information as private. Once again, the discussion led to the cultural aspect and the everyday practices of the Icelandic society based on ‘implicit trust’. 34 | Cybersecurity Capacity Review Iceland, 2017