AKI (Estonia) - 2.1-1/25/737-1585-20
From GDPRhub
| AKI - 2.1-1/25/737-1585-20 | |
|---|---|
 | |
| Authority: | AKI (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 13.10.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | Nura OÜ |
| National Case Number/Name: | 2.1-1/25/737-1585-20 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Estonian |
| Original Source: | AKI (in ET) |
| Initial Contributor: | dt |
The DPA issued a warning to a controller along with an order to provide two patients with information on their medical treatment after failing to respond to their access requests.
English Summary
Facts
Two patients (the data subjects) submitted access requests to Nura OÜ (the controller) on 12 May 2025 and 16 May 2025, respectively, in order to obtain copies of the final results of their treatment and the scans of their retainers.
The same month, the data subjects filed complaints to the Estonian DPA (AKI) alleging that the controller did not disclose the medical information they requested.
During the proceedings in front of the DPA, the controller claimed that it informed in August 2025 the two data subjects of the fact that it had not received the files from the manufacturer at that time.
Holding
The DPA found that the controller did not provide the data subjects with the requested copies of medical data.
Therefore, the DPA issued a warning to the controller, ordering it to provide the data subjects with a copy of the final results of their treatment and the scans of their retainers. The DPA specified that, if the controller failed to abide with the order, a fine of €2,000 may be imposed until the order was complied with.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.
PROTECTION OF PRIVACY AND STATE TRANSPARENCY PRECAUTION-WARNING in the case of personal data protection no. 2.1-1/25/737-1585-20 Precept maker Helen Laane, lawyer of the Data Protection Inspectorate Time of precept making 13.10.2025 in Tallinn and place Recipient of precept – Nura OÜ (12780061) e-mail address of the personal data processor: sven@drkalle.com Member of the management board of the personal data processor responsible person RESOLUTION Based on § 56 (1) of the Personal Data Protection Act and Art. 58 (2) (c) of the General Regulation on the Protection of Personal Data , the Data Protection Inspectorate issues a mandatory precept to Nura OÜ for compliance: 1) submit to the complainant I, in accordance with Art. 15 (3) of the Personal Data Protection Act, a copy of the final result of his treatment and a scan of the production of the first retainer cabinets files; a. if Nura OÜ does not provide Complainant I with a copy of the final result of his treatment and the scan files of the first retainer cabinets production, then inform Complainant I of the reasons for the non-submission in accordance with IKÜM Art 12, Paragraph 4; 2) provide Complainant II with a copy of the final result of his treatment and the scan files of the first retainer cabinets production in accordance with IKÜM Art 15, Paragraph 3; a. if Nura OÜ does not provide Complainant II with a copy of the final result of his treatment and the scan files of the first retainer cabinets production in accordance with IKÜM Art 12, Paragraph 4; 3) forward a copy of the response sent to Complainant I and Complainant II (without the scan files) to the Data Protection Inspectorate at the e-mail address info@aki.ee. The Data Protection Inspectorate sets the deadline for compliance with the injunction as 27.10.2025. Notify the Data Protection Inspectorate of the compliance with the precept by this deadline at the latest at the e-mail address info@aki.ee. CHALLENGE REFERENCE This precept can be challenged within 30 days by submitting either: - a challenge under the Administrative Procedure Act to the Director General of the Data Protection Inspectorate or - a complaint under the Administrative Court Procedure Code to the administrative court (in this case, the challenge in the same matter can no longer be reviewed). Challenging the precept does not suspend the obligation to comply with it or the implementation of the measures necessary for compliance. PENALTY WARNING If the precept is not complied with by the specified deadline, the Data Protection Inspectorate will impose on the addressee of the precept: a penalty of 2,000 euros. A penalty may be imposed repeatedly until the precept is complied with. If the addressee does not pay the penalty, it will be transferred to the bailiff to initiate enforcement proceedings. In this case, the penalty payment will be supplemented by the bailiff's fee and other enforcement costs. WARNING OF MINORITY PENALTIES For failure to comply with the precept pursuant to Article 58(2) of the General Regulation on the Protection of Personal Data, misdemeanor proceedings may be initiated on the basis of Section 69 of the Personal Data Protection Act. The person may be punished with a fine for this act. The extrajudicial proceedings for the misdemeanor are conducted by the Data Protection Inspectorate. FACTS On 16.05.2025, the Data Protection Inspectorate (AKI) received a complaint from the applicant I, according to which Nura OÜ had not issued him medical data in accordance with his request under Article 15 of the Personal Data Protection Act submitted on 12.05.2025. On 31.05.2025, the AKI received a complaint from the applicant II, according to which Nura OÜ had not issued him medical data in accordance with his request under Article 15 of the Personal Data Protection Act submitted on 16.05.2025. The AKI initiated supervision proceedings based on § 56 (3) (8) of the Personal Data Protection Act and sent Nura OÜ to the e-mail address sven@drkalle.com indicated in the commercial register on 26.05.2025 inquiry no. 2.1- 1/25/737-1585-2 and on 27.06.2025 inquiry no. 2.1-1/25/819-1760-2, to which the data processor did not respond within the deadline. On 14.07.2025, the AKI issued a precept-warning to Nura OÜ in personal data protection case no. 2.1-1/25/737-1585-5, requiring the data processor to respond to the AKI's inquiries. The data processor sent a response to the precept on 16.07.2025 stating that, according to its understanding, the issue regarding the data requested by the complainants has been resolved. AKI sent an appeal to the data processor on 18.07.2025 to obtain an answer to the questions posed in the inquiry regarding the implementation of precept No. 2.1-1/25/737-1585-7, to which the data processor sent explanations to the complainants on 27.07.2025 regarding the release of medical data. AKI sent an appeal to the complainants on 29.07.2025 to provide additional opinions or objections. The complainants replied to AKI on 29.07.2025 that not all medical data had been released to them yet. Due to the complainants' objections, on 08.08.2025 the AKI sent additional inquiries No. 2.1-1/25/737-1585-12 and 2.1-1/25/819-1760-6 to the data processor, to which the deadline for responding was 22.08.2025 for both inquiries. On 03.09.2025 the AKI called the mobile phone number +372 5051415 indicated in the commercial register of Nura OÜ. As a result of the phone call, the data processor sent on 05.09.2025 an excerpt from the correspondence with the complainants in response to the inquiry, but did not answer all of the questions posed in the AKI inquiry. AKI called the data processor additionally on 17.09.2025 and 18.09.2025, but the data processor did not respond. In order to request additional explanations, AKI sent the data processor a summons in supervision proceedings No. 2.1-1/25/737-1585-16 on 19.09.2025 and a reminder to respond to the summons No. 2.1-1/25/737-1585-17 on 25.09.2025. Nura OÜ did not respond to the summons and did not appear for an interview with the Data Protection Inspectorate (Tatari 39, Tallinn) on 06.10.2025. AKI called the complainants on 08.10.2025, who said that they still have not been issued with a copy of the files of the final treatment result and the scan of the first retainer cabinets. Complainant I forwarded to AKI 09.10.2025 an e-mail received from the data processor on 31.08.2025 and confirmed that the data processor has not contacted him since then. According to Complainant II, his last communication with the data processor was an e-mail also received from the data processor on 31.08.2025. 2 (4) PERSONAL DATA PROCESSOR'S EXPLANATION: Nura OÜ sent AKI a follow-up response on 16.07.2025, 26.05.2025 and 27.06.2025, stating that it was a misunderstanding and that the data processor understood that the issue regarding the requested data had been resolved. On 27.07.2025, Nura OÜ responded to AKI's initial inquiries and submitted correspondence to the complainants regarding the transfer of medical data. In response to the additional inquiries sent as a result of the complainants' objections, Nura OÜ sent screenshots of the conversations with the complainants on 05.09.2025. According to the screenshots, Nura OÜ last sent an e-mail to complainant I on 31.08.2025, according to which: “I am still waiting for the final results of both of your treatments and the scan files of the production of the first retainer cabinets and I sent a separate inquiry today.” According to the screenshot, Nura OÜ sent an e-mail to complainant II on 31.08.2025 with the following content: “During our last visit on 28.08.2024, I did not take photos of the final results, but I did take photos of the final results of the scans and I am still waiting for the scan files from the cabinet manufacturer, which I will forward immediately.” JUSTIFICATIONS FOR THE DATA PROTECTION INSPECTION: 1 1. Article 15 of the General Data Protection Regulation (GDPR) provides for the right of the data subject to obtain from the controller confirmation as to whether his or her personal data are being processed. The main way of obtaining access to personal data is to provide the data subject with a copy of the personal data being processed in accordance with Article 15(3) of the GDPR. The controller must take appropriate measures to ensure that the information provided to the data subject is complete, accurate and up-to-date and reflects as accurately as possible the state of the data processing at the time of receipt of the request. The right to access data in accordance with Article 15(3) of the GDPR includes full information about all data. 2. However, the right to obtain a copy under Article 15(3) of the GDPR is not absolute, but there are three grounds for limitation when the data subject's request may not be fulfilled. Firstly, the data processor must take into account the limitation in Article 15(4) of the GDPR, according to which the right to a copy must not prejudice the rights and freedoms of other persons. If the requested copy also contains personal data of other persons, in this context it must be assessed whether the limitations in Article 15(4) of the GDPR apply, but the result of the consideration cannot be a complete refusal to provide the data subject with information. Secondly, the right of access to the data subject can be restricted in accordance with Article 23 of the GDPR on the basis of national law, but in this case a specific legal basis must be referred to on the basis of which this is done. A third limitation can arise from Article 12(5)(b) of the GDPR, according to which the data processor can refuse to take the requested measures if the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive nature. Unjustification and excessiveness are interpreted narrowly in this context and the fulfilment of this condition must be proven by the data processor. 3. It is the responsibility of the controller to respond to a request for a copy of personal data pursuant to Article 15 of the GDPR. If a processor within the meaning of Article 28 of the GDPR has also been used in the processing of the data, it is still the responsibility of the controller to ensure that a request made pursuant to Article 15 of the GDPR is responded to. 4. Pursuant to Article 12(3) of the GDPR, the data processor must respond to the data subject's request without undue delay, but not later than within one month. This period may, if necessary, be extended by two months, but the controller must inform the data subject of any such extension and the reasons for the delay within one month of receipt of the request. If the data processor does not take action in accordance with the data subject's request, i.e. in particular refuses to comply with the request, it must, pursuant to Article 12(4) of the GDPR, inform the data subject of the reasons for this within one month at the latest. 5. According to the excerpt of the correspondence forwarded by Nura OÜ to the AKI on 05.09.2025, the data processor sent the following letter to the complainant I on 31.08.2025: “I am still waiting for your 1Regulation (EU) 2016/679 of the European Parliament and of the Council. 3 (4) scan files of the final result of both treatments and the production of the first retainer cabinets and I sent a separate request today.” The data processor sent the following letter to the complainant II on 31.08.2025: “At our last visit on 28.08.2024, we did not take photos of the final result, but we did scan the final result and I am still waiting for the scan files from the cabinet manufacturer, which I will forward immediately.” 6. According to their words, neither the complainant I nor the complainant II have been provided with the corresponding files as of 08.10.2025, although the data processor has promised to do so at the earliest opportunity. Nura OÜ is obliged, pursuant to Article 15(1) and (3) of the Data Protection Act, to send the complainants a copy of all of their personal data, unless there are grounds for restricting the complainants' rights. Even if the data processor refuses to provide the requested personal data, it must provide the complainants with a reason for the refusal pursuant to Article 12(4) of the Data Protection Act. In this case, Nura OÜ is obliged to provide the complainants with the missing copy of the files of the final result of their treatment and the scan of the first retainer cabinets or to inform the complainants of the reasons why the files are not being provided. 7. The complainants have not received any additional information from the data processor regarding their request for the release of their medical data after the emails sent on 31.08.2025, and therefore more than a month has passed since the complainants were last notified. Even if the provision of a copy of their personal data to the complainants has been delayed due to the inaction of the cabinet manufacturer as an authorized processor, the complainants must be notified of this. 8. In accordance with § 27(2)(3) of the Administrative Procedure Act (APA), a document made available or transmitted electronically is deemed to be delivered if the document or notification has been transmitted to the email address entered in the company's commercial register. AKI has sent its communications to the email address of the data processor, sven@drkalle.com, as shown in the commercial register. The data processor last replied to AKI from the email address sven@drkalle.com on 05.09.2025. The data processor has not responded to the summons sent by the AKI on 19.09.2025 or to the reminder to respond to the summons on 25.09.2025 . The data processor did not appear for an interview at the place of the Data Protection Inspectorate on 06.10.2025 and did not later justify its failure to appear upon the summons. 9. With the above, the Inspectorate has fulfilled its obligation under § 40 (1) of the HMS to give the participant in the proceedings an opportunity to submit their opinion and objections on the matter before issuing an administrative act. The AKI has repeatedly given the data processor opportunities to provide additional explanations and has informed the data processor that, pursuant to § 42 (1) of the HMS, the data processor's appearance at the place specified in the summons to provide explanations is mandatory. 10. In accordance with § 58(1) of the Personal Data Protection Act and Article 58(2)(c) of the GDPR, the Inspectorate has the right to demand that the controller satisfy the data subject's requests regarding the exercise of his or her rights under the GDPR. 11. Complainant I first contacted the data processor with a request to release data on 12.05.2025 and Complainant II on 16.05.2025. It appears from the correspondence forwarded to the AKI that Nura OÜ has issued the treatment data to the complainants in parts and as of 08.10.2025 has still not sent the complainants the final treatment result and the scan files of the first retainer cabinets production requested in the initial request. Taking into account that Nura OÜ has not responded to AKI's repeated requests since the response sent on 05.09.2025 , AKI finds that issuing a mandatory injunction is necessary for the conduct of the administrative procedure in this case and for the exercise of the rights of the data subjects. (signed digitally) Helen Laane Lawyer Authorized by the Director General 4 (4)
