Iceland.
Section 73 expression. IMMI written for publishers. Geographic distance.

Section 73 of the Stjórnarskrá (Constitution of the Republic of Iceland, No. 33/1944, as amended by Constitutional Act No. 97/1995) is the freedom-of-expression clause. Paragraph 1 states that everyone has the right to freedom of opinion and belief, and that no one may be forced to disclose their opinion. Paragraph 2 guarantees the right to express thoughts in print or otherwise, with responsibility under law for what is said — and explicitly prohibits censorship and any other comparable restrictions on freedom of expression. Paragraph 3 permits restrictions only by Act of the Althing in the interests of public order, the security of the State, the protection of health or morals, or the rights or reputation of others — provided the restrictions are necessary in a democratic society. The 1995 reform was deliberately drafted to align the clause with Article 10 of the European Convention on Human Rights and goes one structural step further in its categorical prohibition of censorship.

The Icelandic Modern Media Initiative (IMMI) was adopted by the Althing as a parliamentary resolution on 16 June 2010 (Þingsályktun 23/138). The resolution itself is a programmatic instruction to the government: it mandates the executive to identify the best international practice in source protection, whistleblower protection, intermediary liability limits, prior-restraint prohibitions, libel-tourism resistance and ultra-fast-takedown resistance — drawing explicitly on Sweden, Norway, Belgium and Estonia — and to enact corresponding domestic statutes. The resolution was passed unanimously and was the legislative response to Iceland's experience with the 2008 banking collapse and the role WikiLeaks played in publishing related material. The resolution itself is not directly justiciable, but it is the legislative mandate behind a series of subsequent statutes: the 2011 Media Act, the 2012 Whistleblower Act, amendments to the Information Act and others. IMMI is therefore best described not as a single statute but as a published constitutional programme whose implementation has been gradual.

The operative statute is Lög um fjölmiðla nr. 38/2011 (the Media Act), which implements the IMMI source-protection mandate. Section 25 establishes the source-confidentiality privilege: media services, their employees and editorial collaborators must not disclose the identity of a person who has provided information or material on the condition of anonymity, nor information that could reveal that identity. Section 26 extends the privilege to evidence held in any form, including digital records. The privilege can only be set aside by court order in the prosecution of grave specified offences and only where the information sought is unobtainable elsewhere — a strict necessity test. The combined effect is one of the more comprehensive source-protection regimes in Europe.

Iceland is a member of the European Economic Area (EEA) and, like Norway, implements GDPR (Regulation (EU) 2016/679) by EEA Joint Committee Decision 154/2018 incorporating the regulation into Annex XI. Domestic implementation is by Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 (the Data Protection Act). The substantive obligations are identical to those facing an EU-based provider. The structural consequence — and this is the load-bearing one — is that Iceland is OUTSIDE the EU e-Evidence regulation (2023/1543). Cross-border requests run through MLAT, the 2000 EU MLA Convention (Iceland is a Schengen associate, so it has access to the convention's procedures), and bilateral instruments. Slower, judicially-supervised, with dual-criminality requirements.

Persónuvernd is the Icelandic Data Protection Authority. As a small-jurisdiction DPA (Iceland's total population is ~390,000) it issues fewer headline fines than Datatilsynet or IMY, but its decisions are consistent with the broader Nordic strict-enforcement tradition. Recent published actions include decisions on biometric overreach in schools, restrictions on cookie-consent dark patterns, and investigations into public-sector data sharing. The proportional metric — enforcement actions per capita relative to other European DPAs — places it solidly in the upper-middle of Nordic enforcement intensity.

This is the honest weakness worth naming. Iceland's 390,000 population means that diplomatic and economic pressure from larger states is structurally amplified — there is less institutional bandwidth to absorb sustained external pressure than in, say, Germany or France. The Icesave dispute (2010–2013, UK and Netherlands invoking anti-terrorism legislation against Icelandic banks) and the mackerel dispute (2010–2014, EU threats over fisheries-quota disagreements) are the canonical examples of how small-state economic exposure can become political pressure. Neither directly affected hosting jurisdiction, but they illustrate the structural reality: a determined large-state adversary has more leverage over Iceland than over a larger jurisdiction. For most workloads this is not the determinative factor; for politically high-salience workloads it is part of the honest calculus.

The 2023–2024 Reykjanes peninsula volcanic activity (Sundhnúksgígar fissure system, multiple eruptions through 2024) triggered evacuations of the town of Grindavík and prompted serious discussion of data-centre siting risk in Iceland. NordBastion's Reykjavík bastion RKV.001 is not in the Reykjanes hazard zone and is sited specifically with this risk profile in mind; the Icelandic data-centre industry generally has matured its hazard-zone awareness substantially over 2024–2025. That said, geophysical risk in Iceland is a genuine factor that does not exist to the same degree in the other three Nordic jurisdictions and is worth knowing about. The /network/ page covers physical-resilience details per bastion.

Only through an Icelandic court order, on a named subject, for data we actually hold — and that intersection is narrow by design. Sections 25–26 of the 2011 Media Act create a strong source-confidentiality privilege for editorial collaborators that can only be set aside under the strict-necessity test described above. For ordinary hosting customers, the binding limit is what does not exist: we do not collect identity at signup, we do not retain payment-card data (crypto only, no KYC), and infrastructure logs are kept on the rotation published in the transparency report.

Partially, and that is worth being honest about. The 2011 Media Act source-protection provisions have been cited in Icelandic case law (most notably in editorial-confidentiality disputes through 2015–2022), and they have held. The wider IMMI programme — particularly libel-tourism resistance and ultra-fast-takedown limits — has had less direct courtroom testing because the cases that would generate such tests have not, to date, been brought. IMMI is therefore a strong programmatic and statutory framework with growing but still-incomplete case-law backing. The constitutional Section 73 protections that sit underneath it have been tested extensively and are well-grounded.