Delfi Meedia AS – Complaint Upheld (Estonia, 2025)

An individual (the data subject) filed a complaint with the Estonian DPA (AKI) after failing to receive a response from a media publisher (the controller) to his request for data erasure under Article 17 GDPR. The data subject requested the controller to remove his name and photo from news articles arguing that the processing of his personal data affected his and his family’s livelihood and well-being. The DPA made the same request to the controller. The controller proposed an alternative solution, namely de-indexing the articles. However, the data subject rejected the controller’s solution. Therefore, the DPA re-submitted the request for data erasure. The controller once again refused to comply with the erasure request and de-indexed the articles. The DPA found that the news articles in question caused excessive harm to the data subject. Furthermore, the DPA noted that there was diminished public interest in the information contained in the news articles. Therefore, the DPA ordered the controller to remove the image of the data subject and to replace his name with initials in specific articles in line with Article 17 GDPR. Failing to do so, the DPA may impose a penalty payment of €200 repeatedly and for each violation until the controller complies with the order.