DPA case 2.1-3/20/287 – Order (Estonia, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Estonian authority is investigating complaints about the publication of personal data in public registers. The issue is whether the data can be reused for other purposes without consent. This case highlights the need for clear rules on how personal data can be used.
What happened
The DPA is looking into whether personal data published in the commercial register can be reused without consent.
Who was affected
Individuals whose personal stories were disclosed in the public registers without their permission.
What the authority found
The authority emphasized that just because data is in a public register doesn't mean it can be used freely for other purposes.
Why this matters
This situation underscores the importance of having a legal basis for reusing personal data. Companies should be cautious about how they handle publicly available information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant submitted a complaint to the DPA regarding the disclosure of data relating to the complainant in the public registers. The personal data concerned relate to the personal stories of board members. The central issue was the fact that the complainant had not given his consent to the processing of personal data for the commercial register. The DPA had to decide whether the publication of data relating to members of a management board was lawful. According to the law, the data of the members of the company's management board are published in the commercial register. The DPA emphasized this does not mean that these data may be re-used and disclosed for any purpose. Data that is disclosed in the open data portal can be unrestricted reused for commercial or non-commercial purposes. There must also be a legal basis for the re-use for other purposes. The Commercial Register disclosing the data of the members of the management board on the basis of law cannot guarantee that no one will use this data for other purposes without a legal basis. The Inspectorate has received several complaints regarding the disclosure of data in information portals and will decide this matter. If it turns out that there is no legal basis for processing the data, the Inspectorate will oblige to stop the illegal processing of personal data.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2.1-3/20/287 in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2.1-3/20/287 - Estonia (2020). Retrieved from cookiefines.eu
Last updated: