Court case 3-24-2146/23 – Court Ruling (Estonia, 2026)

A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by Article 6(1)(e) GDPR. The Administrative court dismissed the action. The controller subsequently appealed the Administrative court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The court rejected the argument that the processing fell outside EU law or within the EU common foreign and security policy exception under Article 2(2) GDPR. A parliamentarian’s Facebook publication of a call with a ministry official could not be characterised as an activity outside the GDPR merely because the underlying topic concerned international or EU policy. The court further held that there was no consent under Article 6(1)(a) GDPR, as the data subject had expressly objected to publication of the recording. Also, under Article 6(3) GDPR, processing based on a public-interest task or official authority must be grounded in EU or Member State law. The court found no Estonian or EU provision allowing a parliamentarian to publish an official’s personal data on a personal Facebook account. The right to request information from public authorities did not automatically include the right to disclose the personal data contained in that information. The court also held that parliamentary immunity of the controller did not prevent DPA supervision. Immunity does not give members of parliament broader rights to infringe the rights of others, and the DPA’s order did not prevent the controller from carrying out parliamentary duties. He remained free to communicate the substance of the issue without disclosing the data subject’s personal data. The court also found that Article 2(2)(a) GDPR does not apply in the case since this Article cannot be automatically applied to a specific activity merely because it involves the activities of the state or a public authority itself.