- Enforcing jurisdiction
- Estonia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 18.02.2097 – Complaint Upheld (Estonia, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Estonian data protection authority upheld complaints against a transportation service for failing to provide personal data access and erasure. The authority found that the service did not adequately respond to requests from users. This ruling highlights the need for businesses to improve their communication and processes regarding personal data requests.
What happened
The Estonian data protection authority upheld complaints against a transportation service for not properly handling personal data requests from users.
Who was affected
The individuals affected were users of the transportation service who requested access to and deletion of their personal data.
What the authority found
The authority decided that the transportation service failed to comply with users' requests for data access and erasure, violating GDPR rules.
Why this matters
This case shows that businesses must ensure they have effective processes for managing personal data requests to comply with privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Estonian DPA (DPA) acted as a lead supervisory authority for three different complaints regarding the same controller. Although not specifically disclosed, the controller seemed to be a transportation service. Complaint 1: Latvian data subject The data subject contacted the controller by e-mail (in Latvian) on 28 September 2018, followed by several follow-ups. At a certain point (not clear from decision), the data subject filed a complaint at the Latvian DPA because he wanted to receive information regarding data collected about him. The Latvian DPA transferred this complaint on 4 November 2019 to the Estonian DPA. The DPA also send several inquiries to the controller in 2020. The controller stated that the data subject had already received the requested data and information on 28 October 2018. Complaint 2: Polish data subject 1 This Polish data subject sent e-mails to three different e-mail addresses on 16 may 2019, requesting access and erasure of his personal data. The data subject also used the application of the controller to request erasure. The controller deleted the account of the data subject but was not able to provide access to personal data. There seemed to be a lot of miscommunication between the data subject and the controller. The controller stated for example that the data subject had not read the confirmation of deletion of the first account, while the data subject created a second account to request erasure again. This second account was later also deleted by the controller, without providing access. On 25 June 2019, the data subject filed a complaint at the Polish DPA, which transferred the complaint to the Estonian DPA on 2 January 2020. After several inquiries by the latter, the controller admitted that it had not been able to comply with the access request, amongst other things caused by the abundance of communication channels. The controller stated it was preferred that data subjects would submit requests using the controller’s appli
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 18.02.2097 in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 18.02.2097 - Estonia (2022). Retrieved from cookiefines.eu
Last updated: