DPA case 2.1.-1/21/1550 – Complaint Upheld (Estonia, 2021)

The processor, Viimsi Uudised OÜ, published a story on its website featuring information about the Complainant. The Complainant responded by lodging a complaint with the DPA. The DPA reached out to the processor and asked it to either to issue a copy of the personal data to the Complaintant or to refuse to issue data by providing a clear reference to the national law that permits restriction of the rights of a person under Article 23 GDPR. The processor sent a reply but did not comply with the requests of the DPA. The data subject now submits an Art 15 GDPR access request from the processor. The DPA clarified that data subject has the right to inspect the data collected about him / her pursuant to Article 15 GDPR and to receive explanations on the circumstances of the processing. This provision entitles the data subject to request a copy of their personal information. There is a journalistic exception, but refusal to release personal data should be justified through description of how the data of the data subject would be detrimental to third parties if transferred to him or her. Because the data subject can ask for personal data about himself / herself under Article 15, the processor must comply or else face a EUR 2000 fine.