Court case 3-24-2146/23 – Court Ruling (Estonia, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative Court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by article 6(1)(e) GDPR. The Administrative Court dismissed the action. The controller subsequently appealed the Administrative Court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The Court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The Court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The Court rejected the argument t
GDPR Articles Cited
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative Court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by article 6(1)(e) GDPR. The Administrative Court dismissed the action. The controller subsequently appealed the Administrative Court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The Court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The Court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The Court rejected the argument t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 3-24-2146/23 in EE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 3-24-2146/23 - Estonia (2026). Retrieved from cookiefines.eu
Last updated: