Estonia has adopted new Personal Data Protection Act

​At the end of 2018 Estonian parliament managed finally to adopt new Personal Data Protection Act. The new Act came into force January 15, 2019; and elaborates and supplements the General Data Protection Regulation. 

The prolongation of adoption of new Personal Data Protection Act was due to intense discussions in spring 2018 on conditions when and under which conditions can take place processing of personal data for journalistic purposes. The discussions led to a situation whereby the draft law was in summer 2018 withdrawn from the Parliament; and new version came before the Parliament only in fall 2018.

Personal Data Protection Act foresees specific grounds for processing of personal, processing of personal data by law enforcement authorities in prevention, detection and proceedings of offences and execution of punishment; and state and administrative supervision. Finally the Act foresees new applicable fines in case of violation of personal data protection regulation.

We hereby highlight changes that concern private and public persons.

According to the Personal Data Protection Act, the specific grounds for processing of personal data are:

• Processing for journalistic purposes  - Personal data may be processed and disclosed in the media for journalistic purposes without the consent of the data subject, in particular disclosed in the media, if there is public interest therefor and this is in accordance with the principles of journalism ethics. Disclosure of personal data must not cause excessive damage to the rights of any data subjects.
• Processing for academic, artistic and literary expression - Personal data may be processed without the consent of the data subject for the purpose of academic, artistic and literary expression, in particular disclosed if this does not cause excessive damage to the rights of the data subject.
• Processing for needs of scientific and historical research and official statistics - Personal data may be processed without the consent of the data subject for the needs of scientific and historical research and official statistic, in particular in a pseudonymised format or a format which provides equivalent level of protection.
• Processing for archiving in public interest 

Processing of child’s personal data

In case of processing of children’s personal data for provision of information society services, Estonia has foreseen that such processing can be done only in case of child at least of 13 years old. If the child is below 13 years the personal data processing is permitted only in case the consent has been given by the legal representative (in most cases  parent) of the child.

Processing of personal data after death of person

According to the Personal Data Protection Act, the consent of the person remains valid during the lifetime of the person and for 10 years after the death of the person, unless the person  decided otherwise. If the person died as a minor, his or her consent shall be valid for the term of 20 years after the death of the minor.

Processing of personal data in connection with violation of obligation

Transmission of personal data related to violation of any obligation to third parties and processing of the transmitted data by any third party is permitted for the purpose of assessment of the creditworthiness of the data subject or for any other similar purposes and only in the case the controller or processor has verified the accuracy of the data transmitted and the legal basis for transmission of personal data and registered the data transmission.

Collection and transmission of personal data in connection with violation of obligation is not allowed if:

• Special categories of personal data are processed;
• these are data concerning commission of an offence or falling victim to an offence before a public court hearing, or making of a decision in the matter of the offence or termination of the court proceeding in the matter;
• it would excessively damage the rights or freedoms of the data subject;
• less than 30 days have passed from the violation of a contract;
• more than five years have passed from the end of the violation of an obligation.

Processing of personal data in public places

The Personal Data Protection Act contains also regulation on processing of personal data in public places. When making in public places of audio or visual recordings intended for future disclosure, the consent of data subjects shall be substituted by an obligation to notify the data subjects thereof in a manner which allows the persons to understand the fact of the recording of the audio or visual images and to give the persons an opportunity to prevent the recording of their person if they so wish. The notification obligation does not apply in the case of public events, recording of which for the purposes of disclosure may be reasonably presumed.