Court case 3-24-2146/23 – Court Ruling (Estonia, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Estonian Parliament member was reprimanded for publishing a private phone call that disclosed sensitive health information. This case is important because it shows that even public figures must respect privacy rights.
What happened
The member published a recording of a private conversation that included personal health data without consent.
Who was affected
The official from the Ministry of Social Affairs, whose health information was disclosed, was affected.
What the authority found
The Estonian DPA ordered the member to stop disclosing personal data, and the court upheld this decision.
Why this matters
This ruling sets a precedent that public interest does not override individual privacy rights. Public figures should be cautious about sharing personal information.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by Article 6(1)(e) GDPR. The Administrative court dismissed the action. The controller subsequently appealed the Administrative court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The court rejected the argument t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 3-24-2146/23 in EE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 3-24-2146/23 - Estonia (2026). Retrieved from cookiefines.eu
Last updated: