Nura OÜ – Complaint Upheld (Estonia, 2025)

Two patients (the data subjects) submitted access requests to Nura OÜ (the controller) on 12 May 2025 and 16 May 2025, respectively, in order to obtain copies of the final results of their treatment and the scans of their retainers. The same month, the data subjects filed complaints to the Estonian DPA (AKI) alleging that the controller did not disclose the medical information they requested. During the proceedings in front of the DPA, the controller claimed that it informed in August 2025 the two data subjects of the fact that it had not received the files from the manufacturer at that time. The DPA found that the controller did not provide the data subjects with the requested copies of medical data. Therefore, the DPA issued a warning to the controller, ordering it to provide the data subjects with a copy of the final results of their treatment and the scans of their retainers. The DPA specified that, if the controller failed to abide with the order, a fine of €2,000 may be imposed until the order was complied with.