DPA case 2.1.-4/26/1106-2333-4 – Violation Found (Estonia, 2026)

The controller was a private individual who operated a website that collected documents from public authorities’ document registers and made them easier to search and access online. The DPA found that some documents remained available on the website even after the original authorities had imposed access restrictions. Public authorities and data subjects had also contacted the controller requesting the removal of personal data. The controller relied on Article 6(1)(f) GDPR, arguing that the processing served the legitimate interest of facilitating access to public information. He also argued that continuously checking all republished documents for subsequent access restrictions was technically difficult. The DPA held that the controller was independently responsible for ensuring that the republication of personal data complied with the GDPR. The fact that personal data had previously been published by a public authority did not automatically provide a legal basis for its further publication. The DPA found that the controller lacked sufficient technical and organisational measures under Articles 5(2), 24 and 25 GDPR to prevent personal data from remaining publicly accessible after the original source had restricted access. Regarding Article 6(1)(f) GDPR, the DPA held that a general legitimate-interest assessment could not justify the republication of all documents containing personal data. The controller had to assess whether a valid legal basis existed for the specific processing, particularly where access restrictions had subsequently been imposed. Where special categories of personal data were involved, Article 9 GDPR also had to be satisfied. The DPA also required the controller to ensure proper handling of requests under Articles 15 to 22 GDPR. Under Article 58(2)(c) and (d) GDPR, the DPA ordered the controller to implement safeguards preventing unlawful publication, stop processing personal data when no legal basis existed, review documents for subsequent acce