Eesti Ehitusinseneride Liit MTÜ – Violation Found (Estonia, 2023)

An attorney-at-law submitted a request for access to information to the Estonian Association of Civil Engineers, the data controller. The association refused to provide information about applicants for qualification as engineers based on the access restriction provided for by 12(1)(35) AvTS. The attorney filed a complaint with the Estonian claiming that this restriction applies only to data that could significantly damage the integrity of the data subject's private life and not to those related to their professional activities. The DPA issued a decision ordering the disclosure of the requested data to the extent that it does not contain restricted information and the justification of any refusal. Subsequently, the data controller provided some information to the attorney, but the attorney submitted an objection arguing that the decision was not fully complied with because data such where and how long the applicants attended school, what additional training they completed and the assessments of their level of knowledge and abilities had not been included without any justification. On one hand, the complainant argued that the refusal to provide the information was only possible when its disclosure would lead to a significant harm to the data subject’s private sphere.  They claimed that the Estonian Association of Civil Engineers was violating their right to access public information. On the other hand, the Estonian Association of Civil Engineers, sustained that these data concern the applicants’ private life and that the disclosure would substantially interfere on their right. It referred to the case law of the European Court of Human Rights, which highlighted that data relating to professional/commercial activities can also fall under the notion of private life information. It also alleged that there was no legal basis for making these data available for an unlimited number of persons. While recognizing that, in general, information provided to professional organizations should be regarded as public, the DPA emphasized that this is not true to all kinds of data. It recalled that the Estonian Constitution guarantees the inviolability of private life and grants protection to personal data, including those related to a person's education and skills. According to the DPA, there must be a balancing exercise between the right to privacy and the right to access public information. It held that the disclosure of information by Estonian Association of Civil Engineers was appropriate to the extent that it did not contain protected data. However, the DPA ordered the controller to reassess the request and to provide all the relevant information concerning works, studies and projects carried out by the applicants, except for those relating to third parties. In case the controller refuses to disclose the aforementioned data, it must explain how the disclosure would affect the inviolability of the individuals’ private life.