online content that violates the law, in accordance with the Directive 2000/31/EC of the European Parliament. Data protection legislation in Iceland has been implemented with the adoption of Act No. 77/2000 on the Protection of Privacy as regards the Processing of Personal Data (“Data Protection Act”) which implements Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. It includes general conditions for the collection of personal data and protection from misuse, and it promotes a practice of personal data processing in accordance with fundamental principles and rules regarding data protection and privacy. Icelandic law recognizes fundamental human rights on the Internet, including privacy online, freedom of speech, freedom of information, and freedom of assembly and association. The country has also ratified or acceded to several international agreements, such as the UN Universal Declaration of Human Rights, the Convention for the Protection of Human Rights and Fundamental Freedoms of the Council of Europe, the Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and those of the International Labour Organization and the Organization for Security and Co-operation in Europe. Comprehensive legislation on the protection of children has been adopted and enforced according to Iceland’s Child Protection Act, No. 80/2002. Iceland has ratified the UN Convention on the Rights of the Child and other relevant international conventions. Substantive cybercrime legal provisions are contained in the general criminal law. In 2007 the country ratified the Council of Europe Convention on Cybercrime, also known as the ‘Budapest Convention’, whose recommendations are consistently implemented into domestic law. The General Penal Code No. 19 contains substantive cybercrime legal provision since its amendment in 2014. The government is working towards the implementation of the NIS Directive and the GDPR in 2018, therefore it is expected that existing gaps in legal and regulatory frameworks will be fulfilled. Across the criminal justice system, capacities are at initial stages of development in Iceland. The police, headed by the National Commissioner of the Icelandic Police (NCIP), has only limited digital-forensics capacity and cases are investigated by the digital forensics unit of the Reykjavik Metropolitan Police. Two policemen in the Metropolitan Police are specifically assigned to investigate sexual violence against children on the internet. The country needs more skilled personnel as well as the procedural and technological resources to conduct investigations in a comprehensive way. Training for law-enforcement officers on cybercrime and digital evidence is ad-hoc or not specialised. Formal mechanisms of international cooperation have been established in order to prevent and combat cybercrime. Iceland has established agreements with Interpol and Europol as well as agreements with neighbouring countries on cross-border information sharing. Moreover, informal relationships between government and criminal justice as well as between ISPs and law enforcement exist with clear communication channels resulting in the regular exchange of information on cybercrime cases. Some specialised cybercrime 10 | Cybersecurity Capacity Review Iceland, 2017