EPLÜ – Complaint Upheld (Estonia, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Estonian authority ordered the reopening of a court case after a person requested meeting minutes from the Estonian Shooting Association and was denied. The authority ruled that the person's right to access their data wasn't affected by the association's private law status. This case emphasizes that individuals have rights to access their personal data, even from private organizations.
What happened
The Estonian Shooting Association refused to give a person access to meeting minutes related to them, but the authority upheld the person's right to access.
Who was affected
The individual who requested access to meeting minutes from the Estonian Shooting Association.
What the authority found
The authority ruled that the person's right to access their personal data was valid, regardless of the association's private law status.
Why this matters
This decision reinforces that individuals have a right to access their personal data, even from private entities. Organizations should ensure they comply with data access requests under GDPR.
GDPR Articles Cited
National Law Articles
A individual submitted a request to receive information to the Estonian Shooting Association, hereinafter EPLÜ. The information regarded minutes of meetings of the EPLÜ's board about issues concerning the individual -among others. EPLÜ refused to comply with the request claiming that it is a legal entity mainly governed by private law. Only information which relates to the performance of its public tasks could be disclosed upon request. EPLÜ also claimed that some of the requested documents had been destroyed. The individual complained before the DPA revoking Article 15(1) and (3) GDPR and the DPA to order the delivering of the requested information. The DPA found that there was a court decision on the the issue at stake and the same parties, which was final and prohibited the request the information at stake. Moreover, the fact that the parties made a settlement of their claims does not deprive an individual from their right of access when their personal data is processed. The fact that the information requested does not concern the public tasks of EPLÜ as a data controller is not relevant for the exercise of the right of access according to Article 15 GDPR. The DPA ordered the reopening of the judicial proceedings with regard to the issue at stake.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for EPLÜ in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. EPLÜ - Estonia (2020). Retrieved from cookiefines.eu
Last updated: