AKI (Estonia) - 2.1.-1/23/1294-3237-26
From GDPRhub
| AKI - 2.1.-1/23/1294-3237-26 | |
|---|---|
 | |
| Authority: | AKI (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 17(1) GDPR Article 21(1) GDPR § 4 IKS |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 31.07.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | Estonian Public Broadcasting |
| National Case Number/Name: | 2.1.-1/23/1294-3237-26 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | AKI (in EN) |
| Initial Contributor: | dt |
The DPA ordered the Estonian Public Broadcaster to remove a person's photos and their name from some articles since the depicted events no longer constitute public interest.
English Summary
Facts
The data subject filed a complained with the Estonian DPA (AKI) on 11 December 2023. They alleged a violation of Article 4 of the Estonian Personal Data Protection Act (as it implements the GDPR in national law) by the Estonian Public Broadcaster (the controller). The data subject requested an order against the controller to remove the data subject’s photos from articles and to pseudonymise their name.
In its first decision on 28 June 2024, the DPA found no violation against the controller.
The data subject appealed the DPA's decision. In the appeal, the court ordered the DPA to re-examine the data subject’s complaint.
Subsequently, the DPA sent a proposal to the controller to remove the data subject’s photos and pseudonymise their name. The controller rejected the proposal and offered the alternative of de-indexing the articles concerning the data subject. The data subject rejected the option of de-indexing the articles.
Holding
The DPA found that displaying the name of a data subject in a news article years after the original publishing no longer serves the purpose for which the data were processed.
Specifically, the DPA found that there was no public interest in the data subject’s identity, since they were not a public figure. At the same time, it noted that fraud as a criminal offence is a matter of public interest. However, the DPA emphasised that reporting the offence can be done without publishing personal data. Finally, the DPA noted that public interest diminishes over time and 14 years had passed since the oldest articles were published.
Additionally, the DPA found the infringement on the data subject’s rights to be excessive and an obstacle to their hiring prospects, amounting to a permanent infringement on the rights of a rehabilitated person. The DPA emphasised the vulnerability of the data subject due to the information being disclosed over the internet.
Finally, the DPA found that de-indexing would reduce the availability of the articles, but would not eliminate their long-term negative impact on the complainant's private life.
Therefore, the DPA order the controller to delete the photos of the data subject from certain articles and to replace the name with initials. Moreover, it placed a permanent restriction on processing the data subject’s personal data in the specific articles.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
PROTECTION OF PRIVACY AND STATE TRANSPARENCY PRECAUTION-WARNING in the case of protection of personal data no. 2.1.-1/23/1294-3237-26 Precept maker: Kaire Jürgenstein, lawyer of the Data Protection Inspectorate Time of precept making 31.07.2025 in Tallinn and place Recipient of the precept – Estonian Public Broadcasting personal data processor Registration code: 74002322 Address: Kesklinna linnaosa, F. R. Kreutzwaldi tn 14, Tallinn, Harju County 15029 e-mail address: err@err.ee Personal data processor Members of the Management Board responsible person RESOLUTION Section 56 (1), (2) (8), (58) (1) of the Personal Data Protection Act (IKS) and the General Regulation on the Protection of Personal Data (IKÜM) Article 58 (2) (a), (c) and (f), also taking into account point g of the same paragraph, the Data Protection Inspectorate issues a mandatory precept to be complied with: - remove the photos and name of the Estonian Public Broadcasting referred to in this precept-warning from the articles XXX and replace the name with initials or characters. The Data Protection Inspectorate has set the deadline for compliance with the precept as 13.08.2025. The compliance with the precept must be reported to the Data Protection Inspectorate by this deadline at the latest at the e-mail address info@aki.ee. CHALLENGE REFERENCE This precept can be contested within 30 days by submitting either: - a challenge under the Administrative Procedure Act to the Director General of the Data Protection Inspectorate or - a complaint under the Code of Administrative Court Procedure to the administrative court (in this case, the challenge in the same matter can no longer be reviewed). Contesting the precept does not suspend the obligation to comply with it or the implementation of the measures necessary for compliance. PENALTY WARNING If the precept has not been complied with by the specified deadline, the Data Protection Inspectorate will impose the following on the addressee of the precept: A penalty of 200 euros for each violation related to the article. The penalty may be imposed repeatedly until the precept is complied with. If the addressee does not pay the penalty, it will be transferred to the bailiff to initiate enforcement proceedings. In this case, the bailiff's fee and other enforcement costs will be added to the penalty. MINORITY PENALTY WARNING For failure to comply with the precept pursuant to Article 58(2) of the General Data Protection Regulation, misdemeanor proceedings may be initiated on the grounds of § 69 of the Personal Data Protection Act. A natural person may be punished with a fine for this act. The Data Protection Inspectorate is the extrajudicial investigator of the misdemeanor. FACTS On 11.12.2023, XXX submitted a complaint to the Data Protection Inspectorate (AKI), requesting the AKI to initiate supervisory proceedings against the Estonian Public Broadcasting (ERR) to establish a violation of § 4 of the Personal Data Protection Act (IKS) and to oblige ERR to remove XXX's photos from articles concerning the complainant (hereinafter ERR articles) and to replace XXX's first and last names with a pseudonym or a character. During the supervisory proceedings, the AKI sent an inquiry No. 2.1.-1/24/78-159-2 to the Estonian Public Broadcasting on 14.02.2024, requesting justifications and an explanation on what grounds the personal data in question is being processed and continues to be published. The data processor responded to the inquiry on 28.02.2024 No. 2.1.- 1/24/78-159-4, in which it presented its own position on the lawfulness of data processing. On 28.06.2024, the AKI terminated the proceedings, finding that the right to freedom of information outweighed the right to privacy, upon which the complainant turned to the administrative court. The Tallinn Administrative Court assessed the right to privacy of a person as more important than freedom of information and, by the decision of the Tallinn Administrative Court on 10.01.2025 in administrative case No. 3-24-2086, ordered the Inspectorate to re-adjudicate the complaint of XXX on 11.12.2023. On 16.04.2025, the AKI sent the data processor proposal No. 2.1.-1/23/1294-3237-14 to remove the complainant's photographs and name or replace the name with characters. The data processor responded to the proposal on 30.04.2025, refusing to comply with the proposal, but offering an alternative option for de-indexing the data. The AKI forwarded the data processor's offer of de-indexing to the complainant, asking for an opinion on the suitability of de-indexing as a measure to restrict data processing. The complainant did not agree with the alternative proposed by the data processor, considering the measure inappropriate. At the time of the injunction, the complainant's personal data were still public in the aforementioned articles. PERSONAL DATA PROCESSOR'S EXPLANATION: Estonian Public Broadcasting (ERR) stuck to the reasons and explanations previously provided in its response letter of 30.04.2025 and does not consider the anonymization of the articles to be justified. In the opinion of the data processor, excessive attention has been paid to the complainant's privacy in the preparation of the current proposal. At the same time, the principles of freedom of expression and information set out in Article 10 of the European Convention on Human Rights and § 45 of the Constitution of the Republic of Estonia and the important considerations concerning the preservation of the integrity of the archives of media publications have been disregarded. Journalists covered the court proceedings in both Estonia and the USA for several years, emphasizing the importance of correct facts and historically significant events in the articles. The data processor pointed out that 12–13 years ago belongs to the recent past, therefore the period of time between the publication of the articles and the coverage of the applicant's actions cannot be considered disproportionately long. The data processor does not agree with the court's position that anonymization in the digital archive is not 2 (8) interference with freedom of the press. This is an alteration of articles that affects the integrity of media archives and is protected by Article 10 of the European Convention on Human Rights. The Court's statement that the articles are kept "just in case" does not correctly reflect the importance of historical preservation. The dispute also focuses on the balance between privacy and the public interest, but the Court's assessment places too much emphasis on privacy, leaving the aspect of freedom of expression in the background. The data controller emphasises that anonymisation undermines the credibility of the articles and the freedom of the press. The applicant was not a secondary figure, but a central figure in the context of misuse of public funds and criminal proceedings. In such cases, the public interest and the consequences of coverage must be taken into account. The press must have the right to decide what to cover, and the events in question also attracted the attention of other major media outlets. In the opinion of the data processor, the fact that the applicant attempted to prevent public coverage in a court case related to a media complaint in 2024 by requesting that the hearing be declared closed also demonstrates the continuing public interest. The unprecedented claim for damages against the media outlet indicates a desire to silence the press. The case and the person's previous activities are therefore still an object of public interest. ERR also refers to the dissenting opinion of the judges in the ECHR decision Hurbain v. Belgium, according to which making data inaccessible in search engines could be preferred over anonymization. ERR believes that restricting the availability of data in search engines would be the primary and less infringing measure on freedom of the press. The data processor also noted that in the future the media outlet could be involved as a third party if challenging the AKI's decision in court could affect its rights and obligations, in order to ensure the opportunity to present its views. REASONS FOR THE DATA PROTECTION INSPECTION: 1. According to Article 5(1)(b) and (c) of the General Data Protection Regulation, personal data may only be processed for specified and legitimate purposes and may not be used in a manner incompatible with their original purpose. In this case, the original purpose of the articles was to inform the public about specific events and legal proceedings. However, the purpose must be reassessed years later, when the news value has lost its relevance or the course of life has changed, and whether the continued display of his or her name in the digital archive is still necessary. If this purpose can be fulfilled by processing less data, such as by anonymizing it, this should be preferred, so as not to interfere with the rights of the individual more than is necessary. 2. Pursuant to Article 17 of the GDPR, the individual has the right to request from the data processor that personal data relating to him or her be erased. The individual has the right to request the deletion of their data and the controller is obliged to delete them if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; the individual withdraws consent and there are no other grounds for continuing the processing; the individual objects and there are no overriding legitimate grounds for the processing. If the previous coverage has become historical and the individual is no longer the subject of public attention, the removal of their name from the article may be justified. All the more so if this does not change the content of the article or exclude the public from obtaining information about what happened. Pursuant to Article 17(3) of the GDPR, the deletion of data cannot be requested to the extent that the processing of personal data is necessary for the exercise of the right to freedom of expression and information. However, if there is no public interest in disclosing personal data or it would disproportionately harm the rights of the data subject, the disclosure of personal data must cease. 3. Pursuant to Article 21(1) of the GDPR, the data subject has the right, on grounds relating to his or her particular situation, to object at any time to the processing of personal data concerning him or her, which is carried out on the basis of 1Explanatory Memorandum to the Personal Data Protection Act, § 4. 3 (8) Article 6(1)(f) of the GDPR. The controller shall not further process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. In this case, the complainant has addressed the data processor with his or her request and has lodged an objection within the meaning of Article 21(1) of the GDPR with a complaint to the AKI. 4. In the present case, the data processor relies on Article 6(1)(f) of the General Data Protection Regulation (GDPR) for the processing of personal data, according to which processing is permitted if it is necessary for the legitimate interests of the controller or a third party, provided that the rights and freedoms of the data subject do not outweigh these interests. In Estonian national law, this regulation is specified in § 4 of the Personal Data Protection Act (IKS), according to which the processing of personal data is permitted, among other things, if it is necessary on the basis of a legitimate interest and if it does not disproportionately infringe the rights of the data subject. In the case of journalistic content, § 4(2) of the IKS must also be taken into account, which provides for the admissibility of data processing for journalistic purposes. 5. According to the case law of the European Court of Human Rights (ECHR), the protection of privacy includes all data about a person. However, privacy is not an absolute right – it is limited by the rights of other persons. Among other things, privacy is also limited to protect freedom of expression. 2 Such a restriction is also included in the Personal Data Protection Act, according to § 4 of which personal data may be disclosed for journalistic purposes without the person’s consent if the following conditions are simultaneously met: 1) there is a public interest in disclosing the identity of a specific person, 2) this is done in accordance with the principles of journalistic ethics, and 3) the disclosure of the data does not unduly harm the rights of that person The AKI will analyze the fulfillment of the aforementioned criteria in the given situation below. I. Public interest 6. Articles reflect XXX. In the event of public interest, it must be distinguished whether the public interest is directed solely at the event covered or whether it also extends to the identification of a specific person. The disclosure of a person's name may be justified only if it is necessary for the realisation of a public interest, is proportionate to the aim pursued and is in accordance with the fundamental rights of the person, in particular the right to privacy. The overriding public interest must be determined on the basis of the circumstances of the specific case, by comparing the circumstances in favour of the disclosure of the data with the consequences that would be caused to the person. 7. As regards the public interest, case law has found that the press has a wide discretion in defining the range of topics of public interest, due to the nature of the freedom of the press. Freedom of the press is important in a democratic society, but it does not give the media an absolute right to retain all personal data indefinitely. If the events being reported no longer have a wider impact on society or are of public interest, the rights of the data subject must be given priority. 8. In the opinion of the AKI, the applicant is no longer a public figure today and does not play a role that would permanently subject him to the public interest. The applicant has not stood out in the media and in his activities, is XXX. Also, information about the person's current activities cannot be found using public search engines. There are no circumstances that would indicate that his activities would affect society more broadly or would affect the public's right to be informed about important social developments. 2According to both Article 8(2) of the European Convention on Human Rights and § 26 of the Constitution, privacy may be restricted also to protect the rights and freedoms of others. 3Rule of the Supreme Court of 23.03.2016 in administrative proceedings No. 3-3-1-85-15, paragraph 23; ECtHR judgment Hurbain v. Belgium (paragraphs 100‒104 and the case law cited there) 4 (8) The person's behavior indicates that he does not wish to be the subject of media coverage. The Tallinn Administrative Court has also acknowledged that the person is not a public figure, the person has not changed as a public figure over time, and his subsequent actions have not exceeded the threshold of news. 4 Consequently, the preservation or dissemination of his personal data to the public cannot be justified under the banner of freedom of the press. 9. The press may investigate and report on issues related to economic abuse and misuse of positions of power, taking into account that such coverage would not exceed the limits of the protection of personal rights. In the opinion of the Inspectorate, the disclosure of the applicant's personal data does not add any additional value to the public debate regarding the criminal charges from years ago, since the purpose of the debate is to highlight whether the crime and the decision-making processes have been lawful or not. The disclosure of the personal data of a single specific person does not contribute to the public debate. In this case, there is no public interest in the identity of the applicant that would justify the disclosure of his personal data and it would be more important if the protection of the person's private life and the journalistic objective could be achieved without the disclosure of personal data. In the case law of the European Court of Justice, a relevant case is C-73/07, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Suomen kunttud listatus (SVT), where the court emphasised the responsibility of media outlets to ensure the protection of personal data and privacy. The court confirmed that the exercise of journalistic freedom cannot be a justification for damaging the reputation and privacy of a person, especially if the accusations are outdated and are no longer of interest today. 10. The AKI acknowledges that fraud as a criminal event falls within the public interest. However, the disclosure of personal data may not be necessary for its understanding or substantive treatment. Personal data must be removed from articles if they have become out of date or may be misleading. The content of the articles can remain formally accurate, but the context – the person’s sentence being served, their rehabilitation – changes the meaning of the disclosure of information. The disclosure of personal data for illustrative purposes only is not lawful if it is not essentially necessary for understanding the subject and no longer serves the public interest, but disproportionately harms the rights of the data subject. 11. The existence of public interest diminishes over time, as information that is initially relevant and necessary for public debate becomes less relevant, especially when it concerns information about the person’s private life. The oldest articles about the applicant were published 14 years ago, which is a relatively long time in the opinion of the AKI and from the court’s point of view. The Court has stressed that, although crimes that exploit people's trust are highly reprehensible, in the case of such acts, the time elapsed since their commission, together with the perpetrator and his subsequent conduct, should nevertheless be taken into account. The applicant does not dispute that the disclosure of personal data in the disputed articles was lawful at the time of the disclosure, but claims that their continued publication, along with his full name and photographs, is not lawful. The applicant is not a public figure, he has not become one over time, and his subsequent actions have not come into the public orbit of interest. The articles should not become a “virtual criminal record” for a person, which will stigmatize him for the rest of his life and prevent him from participating normally in society. The Court has pointed out that the relevance of information may change over time and therefore it may no longer serve the public interest. Particular attention must be paid to whether the publication of the information would cause inconvenience or harm to the data subject, the extent of which exceeds the need for public interest. 12. The AKI acknowledges that the press has the right to report on convictions in the public interest, but this must be done in a way that does not cause excessive harm or violates 7 the right to privacy and to be forgotten of rehabilitated persons. If the publication of articles is 4 Tallinn Administrative Court of 10.01.2025 decision in administrative case no. 3-24-2086, p. 15.3. 5 The time dimension has been discussed in the case law of the European Court of Justice Google Spain v. AEPD and Mario Costeja González, C- 131/12) p. 45 et seq. 6 High Court of England and Wales (Civil Division): [2018] EWHC 799 (QB). NT1 and NT2 v. United Kingdom (2018) p 223. 7Google Spain v. AEPD and Mario Costeja González C-131/12) p 45 et seq. 5 (8) a long period has passed and the person concerned is no longer involved in the same role in public life, the exercise of the right to be forgotten is justified, since the relevance of the information and the need for public interest have diminished over time. More than 14 years have passed since the events, which is a long time, and public interest in the person has significantly diminished, which is why the interference with the person’s private life is more intense. 13. In the opinion of the AKI, ERR, as a data processor, has not presented sufficient and convincing arguments as to why the disclosure of the personal data of a specific person in the context of events that took place more than 14 years ago would serve the public interest. 14. The AKI is of the opinion that in this case there is no public interest in the person of the applicant. II. Journalistic ethics requirements 15. When publishing articles for journalistic purposes, the publisher must also comply with the Journalistic Ethics Code. According to the Journalistic Ethics Code, journalism serves the public's right to receive true, honest and comprehensive information about what is happening in society. The principles of journalistic ethics include, among others, the independence of the journalist, impartiality, balance, the controllability of material and information, and the possibility of giving an objection. 16. During the supervision procedure, the AKI did not identify any contradiction in the content of the reported information with the referred Code of Journalistic Ethics. No evidence has been found that the controller has reported incorrect factual statements or has reported incorrect/distorted information. The information published in the articles is based on the statements of the sources and the court decision. 17. Taking the above into account, the AKI has not identified any violation of the principles of journalistic ethics and, to the knowledge of the AKI, the Press Council has not found anything to the contrary. III. Excessive harm to the rights of the applicant 18. According to the case law of the ECHR, all data about a person fall within the scope of protection of private life. However, privacy is not an absolute right – it is limited by the rights of other 8persons. Among other things, privacy is also limited to protect freedom of expression. The essence of the distinction provided for in § 4 of the IKS lies in finding a balance between two fundamental rights through the protection of personal data – freedom of expression versus the right to protection of private life. The protection of the rights of the data subject is less in the case of journalistic purposes, and it is stipulated that the processor of personal data for journalistic purposes must analyse whether the processing does not entail excessive harm to the rights and freedoms of the data subject. If harm to the rights and freedoms of the data subject occurs, but it is not excessive, it is permissible to process personal data. 19. The argument put forward by the applicant that, due to the content of his XXX ERR digital archive, will prove to be a serious obstacle to proving true. It is also vitally plausible for the AKI that the circumstances and events reflected in the disputed articles may be a deterrent to applying for certain jobs and positions. In the case, the court also drew attention to the fact that if XXX, then the impact of the publication in the press must be considered. Regardless of whether the press has a justified right to report accusations related to a person on grounds of public interest, the press does not have the right XXX. As the court has also found in the same case, the existence of a potential public interest does not justify the infringement of the rights of a rehabilitated person and the press remains free to report the acts charged against the person only in such a way that they cannot be attributed to XXX. 9 As the court has also found, a potential public interest does not justify a permanent infringement of the rights of a person. The AKI is of the opinion that the continued availability of the articles in the ERR digital archive violates the applicant's right 8According to both Article 8(2) of the European Convention on Human Rights and § 26 of the Constitution, the right to privacy may also be restricted for the protection of the rights and freedoms of others. 9Tallinn Administrative Court, 10.01.2025, decision in administrative case no. 3-24-2086, p. 15.1. 6 (8) disproportionately to private life, insofar as it affects XXX. Over time, public interest in the disputed events has waned, therefore XXX is not justified. 20. When the press uses digital archives, it should be ensured that this does not make the damage caused to a person's reputation or privacy excessive or continuous. Therefore, the principles of proportionality and minimization of harm must always be carefully considered when publishing information. Articles that focus on bringing out outdated information, but do not contain an adequate balance to ensure the protection of a person's private life inevitably lead to unjustified invasion of privacy. 21. It is also important that the articles are available on the Internet and thus the disclosure of the applicant's personal data was made to an unlimited number of people, therefore it must be taken into account that electronically available material reaches a larger circle of people. Disclosure of data on the Internet increases people's vulnerability, since this environment is sometimes uncontrolled and it is not possible to identify who has received the information related to personal data and what is being done with it . 22. Considering the aforementioned circumstances and the position of the Tallinn Administrative Court, the AKI estimates that the invasion of privacy caused by the publication of the applicant's personal data is disproportionately large compared to the importance of the pursued objective. In summary, the Inspectorate finds that the applicant's rights have been excessively damaged by the publication of personal data in the articles. IV. Deindexing as a means of making articles available 23. In its proposal, the data processor proposed deindexing, which would make the articles inaccessible to search engines and ensure the best balance of media rights and would be the measure that least infringes on freedom of the press. The AKI forwarded the data processor's proposal to the applicant. The applicant did not agree with the proposed measure, considering it ineffective and inappropriate. 24. The AKI agrees with the applicant and considers that in this case this measure is not proportionate to the intensity of the interference . If there is no public interest in the article and the person or event it deals with, de-indexing in itself may not be a sufficient measure to protect the privacy of an individual. Although de-indexing may reduce the findability of the data through search engines, it does not eliminate the accessibility of the article or its potential harmful impact on the reputation and rights of an individual. In particular, in a situation where the article is outdated, no longer has current value and does not serve a public interest, anonymization or complete removal of its content may be justified. The case law of the European Court of Human Rights and the European Court of Justice confirms that the protection of personal data requires a case-by-case approach and that effective and proportionate measures must be implemented to ensure privacy, which may, if necessary, go beyond de-indexing. 25. The AKI finds that the applicant is not a public figure, he has not become one over time, and his subsequent actions have not exceeded the threshold of news. The person's requests to media outlets and the AKI rather show that he wishes to avoid the media. The coverage of the articles should not become a "virtual criminal record" for the person, which stigmatizes them for their entire life and may prevent them from participating normally in society. 26. The proposed measure of de-indexing would reduce the availability of the articles, but would not eliminate the long-term negative impact of the articles on the applicant's private life. De-indexing (limiting visibility in search results) is not equivalent to deleting personal data. Limiting visibility is only a matter of making access more difficult, not a matter of reducing data processing. Conclusion 27. Considering the circumstances and evidence presented in the complaint and the explanations provided by the media, the Inspectorate finds that the continued publication of the articles published by ERR causes excessive harm to the complainant in this case, because the extent of public interest in the published circumstances and events (including the complainants' personal data) has changed over time, according to the AKI and the court, compared to the moment of publication of the article. Based on the above, the Inspectorate finds that the publication of the complainant's personal data for journalistic purposes in the disputed articles has not met all the requirements for publication provided for in § 4 of the IKS due to the lack of public interest and excessive harm to the complainant's rights. If there is no legal basis for the processing of personal data, the processing of personal data is inadmissible. 28. The AKI also finds that the data processor, as the controller, has insufficiently assessed the data subject's right to erasure of data provided for in Article 17(1) of the GDPR and the objection to the processing of personal data provided for in Article 21(1) of the GDPR, as the time factor, the decrease in the relevance of the information, the decline in the public interest, or the excessive impact of the data processing on the private life and social functioning of the data subject have not been taken into account. 29. In accordance with § 58(1) of the Personal Data Protection Act and Article 58(2)(c) and (f) of the General Data Protection Regulation, the Inspectorate has the right to issue an order to grant the data subject's requests for the erasure of personal data in the referenced articles and to impose a temporary or permanent restriction on the processing of personal data, including a ban on processing. This precept imposes a permanent restriction on the processing insofar as it concerns the disclosure of XXX personal data in the articles referenced in the precept. (digitally signed) Kaire Jürgenstein Lawyer Authorized by the Director General 8 (8)
