- Enforcing jurisdiction
- Estonia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2.1.-1/21/129 – Complaint Upheld (Estonia, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person found out that their debt information was shared with a credit register without proper communication. The Data Protection Inspectorate ruled that the company did not have a valid reason for sharing this information. This case highlights the importance of clear communication and consent when handling personal data.
What happened
The company shared a person's debt information with a credit register without properly informing them.
Who was affected
The person whose debt information was shared without adequate communication.
What the authority found
The Data Protection Inspectorate decided that the company lacked a valid legal basis for sharing the debt information.
Why this matters
This ruling emphasizes that companies must communicate clearly with individuals about their data. It serves as a reminder for businesses to ensure they have valid reasons for processing personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject found out that the controller had included his information regarding the generation of a debt of €2,706.41 in a transfer and listing with ASNEF (a credit default register). The data subject then requested information regarding the generation of the debt and communication of the payment request. The controller did not respond, and the data subject filed a complaint with the Data Protection Inspectorate (Andmekaitse Inspektsioon - AKI). The AKI sent an enquiry to the controller with the following questions: # What was the legal basis for the processing? # Was a transfer made to ASNEF? If so, when and under what legal basis? # Were there documents relating to the data subject's debt, and if so, have these been received by the controller? # Was the insolvency file's accuracy verified before transfer? # Was the data subject informed of the transfer, and if so, how? # Why hadn't the controller replied to the data subject's access request? The controller responded to the AKI, claiming that the legal basis for this processing was Article 6(1)(b) GDPR (neccessary for the performance of a contract). The controller's contract with the data subject stipulated that the controller had the right to make such a transfer following overdue payment or default. The controller claimed the purpose of this provision was to allow the data subject the opportunity to monitor his debts and to give others the opportunity to process the subject's data on the basis of legitimate interest to assess his creditworthiness. The controller also claimed the data subject had known of this right to transfer since it was included in the contract. The AKI disagreed with the controller about the legal basis for the transfer because it was not necessary for the completion of the contract. Instead, the AKI held that the correct basis was legitimate interest (subject to a legitimate interests test). The AKI found that the controller did not comply with [https://gdpr-info.eu/art-12-gdpr/ Ar
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2.1.-1/21/129 in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2.1.-1/21/129 - Estonia (2022). Retrieved from cookiefines.eu
Last updated: