Harri Värs – Court Ruling (Estonia, 2026)

The data subject asked the county court (Harju County Court) to disclose several documents held by the court. The request covered three different categories of information. First, the data subject wanted to inspect and copy the file of a closed criminal case. Second, requested the applications submitted by third parties who had asked to access another criminal case file. Third, requested the employment contract and job description of the court’s press officer. He also asked whether the press officer had received any disciplinary sanctions. The court answered only part of the request. It stated that no disciplinary sanctions had been imposed on the press officer. However, it refused the remaining parts. It considered that the request required legal assessment and could therefore be treated as a request for clarification rather than as an access-to-information request. It also argued that the criminal case file and the third-party access applications contained personal data and restricted information. The employment contract was also refused on the basis that it contained information subject to access restrictions. The complainant challenged the refusal before the administrative court, which dismissed the complaint and upheld the county court refusal. He then appealed to the second instance court (Tallinn Circuit Court), which also dismissed the appeal. The data subject later appealed to the Supreme Court, which had to decide whether county court had correctly handled the request as a public information request and how access to court-held documents should be reconciled with the protection of personal data. The case raised issues under Article 6 GDPR, since disclosure of personal data by a public authority requires a legal basis; Article 9 GDPR, since archived criminal case files may contain special categories of personal data; and Article 86 GDPR, since the dispute concerned public access to official documents held by a public authority. The Supreme Court partially upheld the appeal. It first held that the complainant’s submission had to be treated as a public information request. The fact that the court had to review documents, assess access restrictions, anonymise information or redact personal data did not change the nature of the request. In other words, an authority cannot avoid the stricter access-to-information framework merely because the request requires a legal and factual assessment. On the archived criminal case file, the court accepted the refusal. It found that such files contain extensive personal data, including data about defendants, victims, witnesses and other persons mentioned in the proceedings. Some of that information may also fall under Article 9 GDPR. The complainant relied on a general interest in checking whether the criminal proceedings had been fair, but the court considered that this was not strong enough to justify access to the whole file. Since any disclosure would require a valid legal basis under Article 6 GDPR and, where sensitive data was involved, an Article 9 GDPR condition, the court held that the rights and interests of the persons mentioned in the file prevailed. However, the court reached a different conclusion for the third-party access requests and the press officer’s employment contract. These documents could not be refused automatically just because they contained personal data. Under Article 86 GDPR, public access to official documents and data protection rights must be reconciled, not treated as mutually exclusive. The authority therefore had to examine the actual documents and assess whether disclosure was possible in part, for example by removing names, contact details or other personal data. The Supreme Court ordered county court to reconsider these parts of the request, while leaving the refusal of access to the archived criminal case file in place.