- Enforcing jurisdiction
- Estonia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2.1.-1/23/2891-5 – Violation Found (Estonia, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
In Estonia, a company created a public Facebook group to share information about debtors, but did not get consent from the people whose information was shared. The Estonian Data Protection Authority found that the company did not have a legal reason to disclose this personal data, which is crucial for protecting people's privacy.
What happened
A company shared personal data about debtors in a public Facebook group without obtaining consent from those individuals.
Who was affected
The individuals whose personal data was shared in the Facebook group without their consent.
What the authority found
The Estonian DPA determined that the company did not have a valid legal basis for processing the personal data, violating GDPR rules.
Why this matters
This ruling emphasizes that companies must obtain consent before sharing personal data, especially in public forums. It serves as a reminder for businesses to review their data-sharing practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller opened a Facebook group aimed at sharing information about debtors in order to warn people not to carry out commercial transactions with them and to pressure them to settle their debts. This Facebook group was public and the personal data published therein were available to everyone without any restrictions. Upon learning that their data had been published in the group, a data subject filed a complaint with the Estonian DPA. The DPA launched an investigation and asked the controller to cease the activity. The controller failed to comply with the proposal. The DPA pointed out that Article 4(7) GDPR defines the controller as the one who determines the purposes and means of the processing operations. In the case at hand, it held that the controller was the group administrator as they determined the group purposes (name and rules) and means (choice of social media platform, public group). Therefore, the administrator was considered responsible for ensuring that the disclosure of data in the group was lawful. The DPA also highlighted that personal data processing needs to be grounded on one of the legal basis of Article 6 GDPR. In view of this, the DPA proceeded to analyze whether there was a legal basis for the processing. Firstly, the DPA noted that the controller did not provide any evidence that data subjects have consented to the processing of their data. Thus, it was not possible to rely on Article 6(1)(a) GDPR. Secondly, the DPA recalled that, according to Article 6(1)(f) GDPR, processing of personal data on the basis of a legitimate interest is only possible when these interests do not override the rights and freedoms of the data subjects. In the case at hand, the DPA held that the processing of personal data for the sole purpose of warning the public about debtor is not legitimate. Furthermore, the controller failed to provide the DPA with a legitimate interest assessment. Thirdly, the DPA stated that there was no public interest in the publ
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2.1.-1/23/2891-5 in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2.1.-1/23/2891-5 - Estonia (2023). Retrieved from cookiefines.eu
Last updated: