DPA case 2.1-3/20/347 – Complaint Upheld (Estonia, 2020)

Complaint Upheld
Andmekaitse Inspektsioon9 March 2020Estonia
final
Complaint Upheld

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

A journalist's request for police information was initially denied, but the authority ruled that the police must provide the information since the restriction period had expired. This case matters because it emphasizes the need for transparency and timely access to public information.

What happened

The police refused a journalist's request for information based on outdated access restrictions.

Who was affected

The journalist seeking access to police records that were over ten years old.

What the authority found

The authority ruled that the police must remove access restrictions and provide the requested information if it is not classified.

Why this matters

This decision highlights the importance of timely access to public information and the need for authorities to review restrictions regularly.

National Law Articles
AI-identified
§ 40 (1) PSA
§ 45 (1) AvTS
§ 51 (1) AvTS

Source checks

Archived or cached source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

A journalist submitted a request to receive information from the police. The police refused the request based on national law (§ 40 (1) of the PSA) that foresees restrict access for information intended for the internal use up to five years. In the current case almost 16 years have passed since the creation of the document and the Public Information Act does not provide for the possibility of imposing restrictions for a period exceeding a maximum of 10 years. The AKI assessed, whether information needs to be protected sixteen years after the creation by restrict access, even when the national law only foresees restrictions to the access for a period of maximum ten years. The AKI states that in some cases, ten years may be too short a time and a restriction may be needed on the document established for a longer period. This is especially true of documents that have been recognized archival value, but the restrictions cannot be extended without a legal basis. Therefore, the AKI agrees with the Police and Border Guard Board that the grounds for the restriction must be reviewed before the request for information can be complied with. It remains incomprehensible to the AKI that when the Police understood that even after 10 years, the document contains information that is still needed to be protected why no steps have been taken to legitimize the protection of such information. Due to the above, the AKI argued that because the Public Information Act does not provide an opportunity to impose on information restrictions for more than 10 years and the Data Protection Inspectorate cannot change this, the Police shall remove access restrictions and provide the claimant with the information he or she wishes if it is not a state secret and there is no other reason to restrict access to information.

Outcome

Complaint Upheld

A data subject complaint that was upheld by the DPA.

Related Enforcement Actions (0)

No other enforcement actions found for DPA case 2.1-3/20/347 in EE

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

9 March 2020

Authority

Andmekaitse Inspektsioon

GDPRhub ID

gdprhub-2303

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. DPA case 2.1-3/20/347 - Estonia (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: