RK - 3-22-2263
From GDPRhub
| RK - 3-22-2263 | |
|---|---|
 | |
| Court: | RK (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 5 GDPR Article 6(1)(e) GDPR Article 6(1)(f) GDPR Article 9(2) GDPR |
| Decided: | 16.04.2026 |
| Published: | |
| Parties: | Harri Värs Harju County Court |
| National Case Number/Name: | 3-22-2263 |
| European Case Law Identifier: | |
| Appeal from: | Tallin Circuit Court (Estonia) |
| Appeal to: | Unknown |
| Original Language(s): | Estonian |
| Original Source: | Riigi Teataja (in Estonian) |
| Initial Contributor: | bms |
The Supreme Court held that a country court may not disclose whole criminal files in response to a freedom of information request since no legal bases under Article 6 and 9 GDPR are applicable. However, for other requested official documents, a case-by-case analysis is necessary.
English Summary
Facts
The data subject asked the county court (Harju County Court) to disclose several documents held by the court. The request covered three different categories of information. First, the data subject wanted to inspect and copy the file of a closed criminal case. Second, requested the applications submitted by third parties who had asked to access another criminal case file. Third, requested the employment contract and job description of the court’s press officer. He also asked whether the press officer had received any disciplinary sanctions.
The court answered only part of the request. It stated that no disciplinary sanctions had been imposed on the press officer. However, it refused the remaining parts. It considered that the request required legal assessment and could therefore be treated as a request for clarification rather than as an access-to-information request. It also argued that the criminal case file and the third-party access applications contained personal data and restricted information. The employment contract was also refused on the basis that it contained information subject to access restrictions.
The complainant challenged the refusal before the administrative court, which dismissed the complaint and upheld the county court refusal. He then appealed to the second instance court (Tallinn Circuit Court), which also dismissed the appeal. The data subject later appealed to the Supreme Court, which had to decide whether county court had correctly handled the request as a public information request and how access to court-held documents should be reconciled with the protection of personal data. The case raised issues under Article 6 GDPR, since disclosure of personal data by a public authority requires a legal basis; Article 9 GDPR, since archived criminal case files may contain special categories of personal data; and Article 86 GDPR, since the dispute concerned public access to official documents held by a public authority.
Holding
The Supreme Court partially upheld the appeal. It first held that the complainant’s submission had to be treated as a public information request. The fact that the court had to review documents, assess access restrictions, anonymise information or redact personal data did not change the nature of the request. In other words, an authority cannot avoid the stricter access-to-information framework merely because the request requires a legal and factual assessment.
On the archived criminal case file, the court accepted the refusal. It found that such files contain extensive personal data, including data about defendants, victims, witnesses and other persons mentioned in the proceedings. Some of that information may also fall under Article 9 GDPR. The complainant relied on a general interest in checking whether the criminal proceedings had been fair, but the court considered that this was not strong enough to justify access to the whole file. Since any disclosure would require a valid legal basis under Article 6 GDPR and, where sensitive data was involved, an Article 9 GDPR condition, the court held that the rights and interests of the persons mentioned in the file prevailed.
However, the court reached a different conclusion for the third-party access requests and the press officer’s employment contract. These documents could not be refused automatically just because they contained personal data. Under Article 86 GDPR, public access to official documents and data protection rights must be reconciled, not treated as mutually exclusive. The authority therefore had to examine the actual documents and assess whether disclosure was possible in part, for example by removing names, contact details or other personal data. The Supreme Court ordered county court to reconsider these parts of the request, while leaving the refusal of access to the archived criminal case file in place.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.
S U R I G I C O U T I N G C O U T ADMINISTRATIVE BOARD JUDGMENT In the name of the Republic of Estonia Case number 3-22-2263 Date of decision 16 April 2026 Composition of the court Chairman Ivo Pilving, members Oliver Kask, Hannes Kiris, Julia Laffranque, Saale Laos, Heiki Loot and Nele Siitam Case Harri Värs's appeal to oblige Harju County Court to issue information Parties to the proceedings Appellant Harri Värs Respondent Harju County Court Contested court decision Tallinn Circuit Court's decision of 7 March 2025 Basis of the proceedings in the Supreme Court Harri Värs's appeal in cassation Review of the case Written procedure THE S U R I G I C O U T DECIDES 1. To partially grant the appeal in cassation. 2. To annul the decisions of the Tallinn Circuit Court of 7 March 2025 and the Tallinn Administrative Court of 10 October 2023 in the part by which the complaint was dismissed regarding the employment contract of the Harju County Court's press representative, and in the part concerning the applications of persons outside the proceedings in criminal case No. 1-19-8262. 3. To make a new decision in the annulled part, obliging the Harju County Court to re-adjudicate the request for information of Harri Värs of 17 August 2022 in the part concerning the application to examine the employment contract of the Harju County Court's press representative and the applications of persons outside the proceedings in criminal case No. 1-19-8262. 4. To leave the decisions unchanged in the part concerning the resolution of the request for information in connection with the application to examine the job description of the Harju County Court's press representative. 5. To amend the reasons for the decision of the Tallinn Circuit Court of 7 March 2025 in other respects in accordance with the reasons for the current decision. 6. To leave the parties to the proceedings to bear their own costs. FACTS AND PROCEEDINGS 1. On 17 August 2022, Harri Värs submitted an appeal to the Harju County Court, requesting the following: 1) access to the materials of criminal case No. 1-15-11024 in order to “familiarize himself with the materials of the file from cover to cover and make copies with his personal camera” or to familiarize himself with the contents of the file. If the file has been liquidated, then to receive a document reflecting this; 2) to send the applications of all persons outside the proceedings who have requested access to the materials of criminal case No. 1-19-8262; 3) to send the employment contract and job description of the Harju County Court press secretary; 3-22-2263 2(12) 4) send information on whether the press representative has been imposed disciplinary sanctions, and documents proving the latter. 2. On 9 September 2022, Harju County Court partially satisfied the applicant's appeal with response No. 11-2/22-97, stating that no disciplinary sanctions have been imposed on the court's press representative. The appeal was otherwise dismissed. The County Court provided the following reasons. 2.1. The applicant's appeal is a request for clarification within the meaning of the Act on Responding to a Memorandum and Request for Explanation and Submission of a Collective Appeal (MSVS). It is not a request for information, since in order to fulfill the requirements presented in the application, the information must be further analyzed and the possibility of fulfilling the requirement assessed in accordance with the legislation regulating the introduction of criminal case materials to persons outside the proceedings (Article 23(2)(5) of the Public Information Act (AvTS). The request for clarification shall be responded to in accordance with the procedure provided for in the MSVS, i.e. within a 30-day period (MSVS § 6 in the version in force until 27 December 2024 (inclusive)). 2.2. Information collected in the course of criminal proceedings is public information within the meaning of § 3 (1) of the AvTS. Therefore, the application must be resolved on the basis of the AvTS. The court proceedings in criminal case No. 1-15-11024 were closed for almost the entire period of the proceedings (2/3). The materials of the case contain documents with access restrictions, the inspection of which is subject to the prohibition provided for in § 23 (1) (1) of the AvTS. Pursuant to § 9 (2) (7) of the AvTS, the holder of information is obliged to ensure compliance with access restrictions when providing access to information. Processing the court file in such a way that all access-restricted information is removed from it is not possible. 2.3. When granting access to personal data, the provisions of the Personal Data Protection Act (PDA) should be taken into account. The wish to examine the materials of criminal case No. 1-15-11024 in order to verify whether the proceedings were fair does not qualify as an exception specified in Sections 4–7 of the PDA, which allow the processing of personal data without the consent of the data subject. 2.4. The compilation of a summary of all appeals from persons outside the proceedings in case No. 1-19-8262 violates the legitimate expectation of persons outside the proceedings that their personal data will not be disclosed. The appeals are registered in the public document register, but have been declared for internal use (Section 35(1)(12) of the Personal Data Protection Act). Therefore, the applicant's appeal is also dismissed in this regard on the basis of Section 23(1)(1) of the Personal Data Protection Act. 2.5. The spokesperson of Harju County Court does not have a valid disciplinary sanction and works under an employment contract. The job description of employees working under an employment contract is not published. An employment contract is information with restricted access. Therefore, the appeal is also dismissed in this regard on the basis of § 23 (1) (1) of the Employment Act. 3. On October 22, 2022, the applicant filed a complaint with the Tallinn Administrative Court, requesting that the respondent be ordered to reconsider the applicant's appeal of August 17, 2022, and to issue the requested information. According to the applicant, he submitted a request for information within the meaning of the Employment Act and it should have been responded to within five working days. The County Court unlawfully refused to comply with the request for information. 4. By decision of October 10, 2023, the Tallinn Administrative Court dismissed the appeal. The grounds for the decision were as follows. 4.1. The respondent's actions were lawful. The respondent reasonably treated the applicant's appeal as a request for clarification and responded to it within a 30-day period. The resolution of the appeal required a legal analysis and the submission of explanations and justifications based on it (Article 23(2)(5) of the Code of Civil Procedure). 3-22-2263 3(12) 4.2. A court file, including a criminal file, is not freely accessible to a person outside the proceedings, because it presumably contains a large amount of information with various restrictions, including personal data. It is not possible to process all court files in such a way that all information with access restrictions is removed from them. An application for access to a criminal file requires the identification of the person and an indication of the reason for access (Article 14(2) of the Code of Civil Procedure). If these prerequisites are met, the county court has discretion to decide whether the applicant's interest in accessing the court file and obtaining a copy of the procedural document outweighs the interest of the party or a third party in protecting the information. 4.3. The respondent acted lawfully when it refused to grant access to the court file of criminal case No. 1-15-11024 and access to the requested materials of criminal case No. 1-19-8262. The respondent indicated the legal and factual basis for the refusal, sufficiently justified the refusal and appropriately weighed the interests of the applicant and third parties. 4.4. The respondent informed the applicant that no disciplinary sanctions had been imposed on the press representative. The information requested by the applicant has thus been provided to the applicant. The respondent's reasons for not being able to issue the press representative's employment contract and job description are lawful. 5. By its decision of 7 March 2025, the Tallinn Circuit Court dismissed the applicant's appeal, left the decision of the administrative court unchanged and ordered the parties to bear the costs of the appeal. The Circuit Court's reasons were as follows. 5.1. The respondent could have relied on § 23(2)(5) of the Estonian Code of Criminal Procedure regarding access to the court file of criminal case No. 1-15-11024 and the materials of criminal case No. 1-19-8262. In order to apply § 23(2)(5) of the Estonian Code of Criminal Procedure, the application must meet the characteristics of a request for information within the meaning of § 6 of the Estonian Code of Criminal Procedure. § 23(2)(5) of the Estonian Code of Criminal Procedure is primarily a procedural norm, i.e. the substantive resolution of a request for information that meets the characteristics specified in the provision must be based on the Estonian Code of Criminal Procedure, but the procedural procedure arises from the Estonian Code of Criminal Procedure. 5.2. However, the applicant's request for the release of the employment contract and disciplinary sanctions of the court spokesperson does not meet the characteristics of § 23(2)(5) of the Estonian Code of Criminal Procedure. The respondent should have responded in this regard within the time limit provided for in § 18(1) of the Estonian Code of Criminal Procedure. However, this fact does not provide grounds for satisfying the appeal for a declaration of liability. The applicant's request to receive information about disciplinary sanctions was fulfilled by the respondent on 9 September 2022, and in the remaining part, the respondent lawfully left the applicant's appeal unsatisfied in substance. 5.3. When restricting access to the court file in criminal case No. 1-15-11024, the respondent rightfully relied on two grounds. Firstly, the respondent's considerations for the application of § 23 (1) (1) of the Criminal Procedure Code in conjunction with § 9 (2) (7) of the Criminal Procedure Code are relevant. The criminal proceedings were partially closed and a large part of the materials in the court file is information with restricted access. Secondly, § 39 (1) of the Criminal Procedure Code obliges the holder of the information to be guided by the norms of personal data protection. The applicant's desire to verify the correctness of the court proceedings does not correspond to any of the grounds for processing personal data provided for in §§ 4–7 of the Criminal Procedure Code. The court file contains a large amount of information collected about third parties, including data with private content. It is not public to a person outside the proceedings without restrictions, and the county court has discretion to decide whether the applicant's interest outweighs the interest of the party or a third party in protecting the information (see the decision of the Tallinn Circuit Court of 20 May 2020 in case no. 3-19-1076). 5.4. The respondent did not refer to § 23(2)(3) of the Public Prosecutor's Office when restricting access to the court file in criminal case no. 1-15-11024, but nevertheless proceeded from it. The purpose of § 23(2)(3) of the Public Prosecutor's Office is to protect the public interest broadly (to prevent a decrease in the ability of public authorities to perform their basic functions), not narrowly restricting unreasonable requests for information. In the case of a court, this primarily means the public interest in the proper organization of court proceedings and the resolution of cases within a reasonable time. This is a legitimate aim arising from §§ 44 and 46 of the Constitution of the Republic of Estonia (PS) with a simple 3-22-2263 4(12) reservation of law to restrict fundamental rights. Processing the entire criminal case file in such a way as to remove all access-restricted information from it would significantly disrupt the main activities of the court. In such a situation, the question raised by the applicant whether it is in accordance with the Constitution that there is no provision in the law that would oblige the respondent to ask for the consent of all data subjects related to the criminal case file for the disclosure of the court file cannot be considered relevant. Such an obligation would mean an even greater additional burden for the holder of the information. 5.5. The respondent correctly rejected the applicant's application for access to the employment contract of the court's press representative and inquiries regarding criminal case No. 1-19-8262 on the basis of § 23(1)(1) of the Act on the Protection of the Rights of the Child. The applicant initially requested the publication of the employment contract in its entirety, but later explained that he was not interested in the telephone number, place of residence or salary of the press representative. Therefore, the applicant's real intention is to examine the employment contract of the county court press representative, except for the aforementioned information. The state concludes an employment contract with an employee in the public service in a civil law relationship. By concluding a civil law employment contract, the employee has not entered into a public law relationship with the state and has not submitted himself to the rules for the publication of the details of an official's service relationship. The legislator has excluded the possibility of declaring for internal use only information on the remuneration paid to the employee from the budget, based on § 36 (1) (9) of the Civil Service Act. The recognition of other information as internal information is subject to the manager's discretion, including the assessment within the meaning of § 35(1)(12) of the Act on the Protection of Personal Data, whether and to what extent the disclosure of the employment contract as information containing personal data would significantly harm the privacy of the data subject, i.e. the employee. The provision refers to personal data in a broad sense, which, within the meaning of Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), includes "any information relating to an identified or identifiable natural person", not only special categories of personal data within the meaning of Article 9 of the GDPR. JUSTIFICATIONS OF THE PARTIES TO THE PROCEEDINGS 6. The appellant requests in the cassation appeal to annul the decision of the district court and to grant the appeal or at least to award the procedural costs in favour of the appellant. The appellant maintains its positions presented in the previous court proceedings and does not consider it necessary to repeat them. 7. The respondent agrees with the decision of the district court and requests that the cassation appeal be dismissed and that the appellant bear the procedural costs himself. 8. By a ruling of 14 November 2025, the Supreme Court added to the case the court files of criminal cases No. 1-19-8262 and No. 1-15-11024 and the employment contract of the Harju County Court press officer. STATEMENT OF THE BOARD 9. The decisions of the Administrative and District Courts must be annulled on the basis of § 230 (1) of the Code of Administrative Court Procedure (HKMS) due to incorrect application of substantive law norms and a significant violation of the norms of judicial procedure in the part concerning the applicant's request for information to examine the employment contract of the Harju County Court press representative and the applications of persons not involved in the proceedings in criminal case No. 1-19-8262. The Board grants the cassation appeal in this regard and makes a decision itself without sending the matter for a new hearing in the court proceedings (§ 230 (5) (5) of the HKMS). The Harju County Court must adjudicate the applicant's request for information of 17 August 2022 in the referred part in accordance with the deadlines provided for in §§ 18 and 19 of the AvTS. 10. In addition, the panel replaces the reasons for the decision of the district court with the reasons for the current decision in the part concerning the resolution of the applicant's request for information in connection with the request to inspect the court file of criminal case No. 1-15-11024 archived in the county court (Section 230 (5) (6) of the Code of Civil Procedure). Since the spokesperson of Harju County Court 3-22-2263 5(12) does not have a job description, the decision of the district court in this regard remains unchanged (Section 230 (5) (1) of the Code of Civil Procedure). 11. The panel first assesses compliance with the procedural rules on the issue of whether the court resolving the appeal against the refusal to satisfy the request for information must inspect the information media containing the requested information (I). Secondly, it specifies what information the applicant requested (II). The panel then explains the distinction between a request for information and a request for clarification on the basis of § 23 (2) (5) of the Act on the Protection of Personal Data (III) and analyses the resolution of the applicant's request for information by type of information requested: access to the criminal case file archived in the county court (IV) and access to other types of public information (V). Finally, the panel resolves procedural issues (VI). I Compliance with procedural norms 12. In a case concerning a refusal to provide a data subject with his or her personal data, the panel emphasised that, when challenging a refusal, the court is generally unable to decide on the legality of the access restriction without directly examining the data medium as evidence. The extent to which the court must examine the disputed data medium in order to verify the correctness of the defendant's claims and how detailed the court's reasoning must be depends on the specific case. In the case of very large data carriers, it is sufficient for the court to show in a random manner why there is or is not a legal basis for refusal or why the personal data processor should decide again on granting access. Presuming the correctness of the defendant's factual allegations is a significant violation of the procedural norm. (RKHKo 3-16-2348/21, paragraphs 15–16.) The administrative case file must contain all documents of importance for resolving the case, on the basis of which the court determines the circumstances justifying the claims and objections of the parties to the proceedings or their absence (e.g. RKHKo 3-20-19/62, paragraph 12). 13. Neither the administrative court nor the district court demanded the information carriers containing the requested information nor did they take them into evidence. There is also no indication in the administrative case file that the courts had examined the information carriers in any other way as a procedural act (e.g. in the court information system). 14. The Chamber is of the opinion that the principles described above (see paragraph 12 of the decision) also apply in a dispute concerning the application of the AvTS - the court must generally examine the disputed information medium. However, an exception may be a situation where, taking into account the circumstances that the parties do not dispute and the applicable legal provisions, it is obvious what the solution to the case will be, and that too without the court having examined the information medium. 15. Whether the courts violated procedural norms in the present case by not examining the information media containing the disputed information will be assessed by the Chamber in the substantive analysis of different types of information (see parts IV and V). II Information requested by the applicant 16. The applicant submitted four applications to the Harju County Court in its application of 17 August 2022. First, he requested access to the materials of criminal case No. 1-15-11024 as a person outside the proceedings in order to examine the materials of the file and make copies with a camera (alternatively, to examine the table of contents of the file or the act of destruction of the file). 16.1. A criminal file is a collection of documents collected in a criminal case (§ 1601(1) of the Code of Criminal Procedure (CCP), but in practice it primarily refers to material collected in pre-trial proceedings. After the case is sent to court, a court file is formed from the documents related to it and the objects related to the proceedings (§ 1601(2) of the CCP). 3-22-2263 6(12) 16.2. The applicant applied to the county court for information, requesting access to the court file of criminal case No. 1-15-11024, which was resolved in general proceedings. The case file in question is archived in the county court (see also the first sentence of § 34(5) and § 37 of the Regulation No. 7 of the Minister of Justice of 8 February 2018 “Rules of Procedure of the County, Administrative and Circuit Court Office” (hereinafter the Rules of Procedure of the Office). Therefore, the following will focus only on the right of access of a person outside the proceedings to the criminal case file archived in the county court. 16.3. According to the case law of the Supreme Court (see, for example, RKKKm 1-19-8262/17, paragraphs 39–47 with references to previous case law), after the criminal case proceedings, access to the file must be decided, depending on the situation, either on the basis of the AvTS (if the person requesting information is a person outside the proceedings) or on the basis of the IKS/IKÜM (if the person requesting information is a data subject) or the Archives Act. Despite the repeated references of the Supreme Court, the legislator, unlike the Codes of Administrative Court Procedure and Civil Court Procedure, has not created relevant procedural norms in the Criminal Procedure Code. 16.4. In addition to documents prepared by the court itself, the archived criminal case file inevitably also contains documents prepared by another institution or person (e.g. the prosecutor's office, an investigative body, a credit institution). Considering the nature of the administration of justice, the court, as the holder of information, must decide whether and what kind of access restriction to impose on the court file and the documents contained therein (Article 34(2) of the Code of Civil Procedure) and whether to mark the information medium accordingly (Article 41(2) of the Code of Civil Procedure). This is regardless of whether the person who prepared the document (if the person is the holder of information within the meaning of the Code of Civil Procedure) has imposed an access restriction on it and added an appropriate mark. This is due to the specific nature of the court file as a collection of documents compiled in the interests of and serving the administration of justice (cf. also RKHKm 3-3-1-8-17, p. 19). The above does not extend to access to the document, however, if it is preserved by the document compiler himself and the information requester addresses him, not the court, to obtain it. 17. Secondly, the applicant wished to be sent the applications of those persons outside the proceedings who wanted access to the materials of criminal case no. 1-19-8262. Although the Harju County Court's response referred to this as the applicant's wish to receive an overview of the applications, it is apparent from the applicant's initial application and the positions presented in the court proceedings that he wished to receive the applications themselves. 17.1. Pursuant to § 25(2) of the Rules of Procedure of the Chancellery, the notice page of the case file shall include, among others, the fact that the file has been familiarised with. In practice, an appropriate note that persons outside the proceedings have examined the file may also be made in the court information system. However, requests for access by persons outside the proceedings are not added to the court file and are registered in the document register of the institution like any other appeal to the institution (see § 17 of the Rules of Procedure of the Chancellery, §§ 11 and 12 of the Code of Civil Procedure). 17.2. In light of the above, the applicant's request (to be sent the requests of persons outside the proceedings who wished to examine the file of criminal case No. 1-19-8262) is aimed at obtaining other types of public information, not at obtaining access to the file of the criminal case. 18. Thirdly and fourthly, the applicant requested the employment contract, job description and information on the disciplinary sanctions imposed on the press officer of the Harju County Court. It is not disputed that the county court has provided the applicant with information regarding the latter. The courts have also established that no job description has been established for a press representative as a person working on the basis of an employment contract. Therefore, only the applicant's request to inspect the press representative's employment contract remains unresolved. III Classification of the applicant's appeal 19. The Circuit Court agreed with the Harju County Court that both the requests for access to the court file in criminal case no. 1-15-11024 and the requests for inspection in criminal case no. 1-19-8262 were subject to § 23(2)(5) of the Act on the Protection of Personal Data. In other words, the county court could respond to the applicant in the referred part within 30 days in accordance with the procedure provided for in the MSVS 3-22-2263 7(12) (MSVS § 6 in the version valid until 27 December 2024). The District Court admitted that the information concerning the press representative should have been answered within five working days in accordance with the procedure laid down in the Act on Information Protection. 20. In the opinion of the Board, the applicant's application as a whole was a request for information, in which all four requests should have been resolved in accordance with the procedure laid down in the Act on Information Protection. 21. According to § 6 of the Act on Information Protection, a request for information is a request submitted by the requester to the holder of information in accordance with the procedure laid down in the Act on Information Protection to obtain or reuse information. The first sentence of § 23(2)(5) of the Act on Information Protection provides that the holder of information may refuse to comply with the request for information if the information needs to be further systematised and analysed in order to comply with the request for information and new information needs to be documented on this basis. The second sentence adds that such a request for information is considered a request for clarification and will be answered in accordance with the procedure laid down in the Act on Information Protection. 22. Upon receipt of a request for information, the information media containing the requested information must be examined and their contents analysed in order to understand whether the requested information may contain information with restricted access. Then, by interpreting and applying the legal provisions, a decision must be made as to whether the information can be released in whole or in part or whether it must be refused. The above is part of responding to every request for information and does not turn the request for information into a request for clarification. Depending on the volume of the information requested, the complexity of the decision on the restriction of access, etc., it may be more or less time-consuming. The request for information must be fulfilled without delay, but no later than within five working days (Section 18(1) of the Access to Information Act), and this period may be extended to up to 15 working days if the holder of the information needs to clarify the request for information or if the information is time-consuming to obtain (Section 19 of the Access to Information Act). A request for information qualifies as a request for clarification pursuant to § 23 (2) (5) of the Act on the Protection of Personal Data only if the synthesis and analysis result in new information that must be documented (cf. also RKHKm 3-20-992/26, p. 11, on the distinction between the general scope of application of the Act on the Protection of Personal Data and the Protection of Personal Data). The Board is of the opinion that the need to conceal the information contained in the information medium or to pseudonymise the names of persons does not change the request for information into a request for clarification within the meaning of § 23 (2) (5) of the Act on the Protection of Personal Data. Therefore, no new information would arise if the applicant's request for information were granted. IV Access to the court file of the criminal case archived in the county court 23. The applicant's request for information as a person outside the proceedings, in which he wished to inspect the court file archived in the county court in criminal case no. 1-15-11024, has been correctly rejected in the final instance on the basis of § 23 (1) (1) of the Criminal Procedure Code in conjunction with § 35 (1) (1) and § 39 of the Criminal Procedure Code. However, the reasoning of the decision of the Circuit Court must be replaced by the reasoning of the current decision. 24. The principle of public court proceedings follows from § 24(3) and (4) of the Constitution, which serves the interests of fair trial and the objective of transparency of court proceedings and helps to ensure fair court proceedings (see RKHKm 3-21-2196/19, p. 12 and also RKPJKm 5-21-7/4, p. 17). The provisions referred to in the Constitution expressly speak of public only in the context of the public announcement of the court hearing and the court decision. These provisions do not give rise to the subjective right of the applicant, as a person outside the proceedings, to demand access to the court file of a criminal case archived in a county court. The restriction on access to the information referred to does infringe the right arising from § 44(2) of the Constitution. This is a general provision that obliges public authorities and their officials to provide Estonian citizens with information about their activities upon their request (cf. also RKPJKm 5-21-7/4, p. 14), with the exception of data the disclosure of which is prohibited by law, as well as data intended exclusively for internal use. This fundamental right is subject to a simple statutory reservation, which means that it may be restricted for any reason that is not in conflict with the Constitution. In accordance with § 44(2) of the Constitution, the legislator has established the corresponding general grounds for access restrictions, among others, in § 35 of the Act on Access to Information (see also RKÜKo 3-3-1-5-09, p. 26; RKPJKo 5-25-3/5, p. 17 and 18). 25. Section 23(1)(1) of the Act on the Protection of Personal Data provides that the holder of information shall refuse to comply with a request for information if access restrictions apply to the requested information and the person requesting the information does not have the right to access the requested information. 3-22-2263 8(12) The provision is not an independent basis for refusing to comply with a request for information - in the event of refusal, the holder of information must also refer to the norm in which the relevant access restriction is provided. 26. Section 35(1)(1) of the Act on the Protection of Personal Data provides that the holder of information is obliged to recognise information collected in criminal or misdemeanour proceedings as information intended for internal use, except for information to be disclosed under the conditions provided for in the Code of Misdemeanour Procedure and the Criminal Code. Therefore, although the Act on the Protection of Personal Data is based on the principles of an open society (Section 1 of the Act on the Protection of Personal Data) and on the fact that publicity is the rule and restrictions are the exception, the imperative starting point established with regard to criminal proceedings is the opposite. In other words, all information collected in criminal proceedings must be recognized as restricted information pursuant to § 35 (1) (1) of the Criminal Procedure Code (see also RKÜKo 5-25-7/29, § 36 and references therein), unless the Criminal Procedure Code prescribes an obligation to disclose, e.g. oral information given at a public hearing (Criminal Procedure Code § 11, see also §§ 12 and 13), publication of a court decision that has entered into force (Criminal Procedure Code § 4081), and access to the victim's file (Criminal Procedure Code § 206 (3)). The Criminal Procedure Code does not regulate access to the criminal case file archived in a county court. Since the scope of application of § 35(1)(1) of the Civil Procedure Code does not depend on what data the disputed court file contains (see also §§ 27.2 and 35 of the decision on personal data) and what stage of the proceedings it is at, the access restriction therefore extends to the entire criminal case file archived in the county court (see § 35 of the decision on the term of the access restriction). 27. § 38(4) of the Civil Procedure Code does, however, provide for the possibility of deviating from the access restriction provided for in § 35(1)(1) of the Civil Procedure Code. According to this, the head of an institution may decide to allow persons outside the institution access to information declared as internal to the institution, if this does not harm the interests of the state or local government. This is both a competence and an authorisation norm, the interpretation of which must take into account, among other things, the provisions of § 44 of the Constitution. 27.1. According to § 38(4) of the Act on the Protection of Personal Data, the head of the institution has the right to decide, which in the case of a county court means the chairman of the court (see also RKKKm 1-19-8262/17, p. 46). § 28(2) of the Rules of Procedure of the Chancellery, which allows for intra-court delegation when deciding on access to a file, is not applicable. 27.2. § 38(4) of the Act on the Protection of Personal Data provides for discretion, setting as a restriction only the condition that access may not harm the interests of the state or a local government. However, when exercising the discretion, the chairman of the court must take into account whether the requested information contains personal data. First, § 35(1)(11–15) of the Act on the Protection of Personal Data oblige to impose a restriction on access to information that significantly harms a person’s private life, although § 38(4) of the Act on the Protection of Personal Data does not exclude granting access to such data. Secondly, if the requested information contains personal data, then regardless of whether it falls under the access restriction of § 35 (1) (11)–(15) of the Code of Criminal Procedure, the holder of the information must also proceed from § 39 of the Code of Criminal Procedure, which regulates access to personal data. All procedural documents and other documents related to the matter are included in the criminal case file in chronological order (first sentence of § 1601 (2) of the Code of Criminal Procedure), including, for example, the minutes of the oral hearing, the minutes of the procedural act (e.g. search, interrogation, surveillance), and the expert report. Thus, the court file of any criminal case archived in a county court contains a large amount of personal data. 28. § 39 (1) of the Code of Criminal Procedure provides that the holder of the information shall provide access to the personal data in his or her possession in accordance with the procedure provided for in the Code of Criminal Procedure. This provision takes over Article 86 of the GDPR. In interpreting and applying it, the European Court of Justice has repeatedly stated that the right to access official documents must be reconciled with the fundamental rights to privacy and the protection of personal data – the interference with these fundamental rights must be proportionate (see further C-439/19 – Latvijas Republikas Saeima, p. 120; C-740/22 – Endemol Shine Finland, p. 52–55; C-710/23 – Ministerstvo zdravotnictví, p. 38–40). Thus, it is the legislator's task to find an appropriate balance between the conflicting rights, taking into account, among other things, the principles of personal data processing. 3-22-2263 9(12) 29. The publication of personal data and the access to and obtaining a copy of personal data (collection within the meaning of the GDPR) are acts of processing personal data. The IKÜM applies to the release of information from the archived court file after the criminal case proceedings (see Art. 2, Section 2, Point d). Pursuant to Art. 5, 6 and 9 of the IKÜM, there must be a legal basis for any processing of personal data. 30. The county court, as the holder of the information, performs a public task when deciding whether to grant access to the archived criminal case court file. Therefore, its legal basis for processing personal data is Art. 6, Section 1, Point e of the IKÜM in conjunction with the AvTS (see also C-439/19, p. 99; C-740/22, p. 46; C-710/23, p. 35). If the court file also contains special categories of personal data, the requirements of Art. 9, Section 2, Point g must also be met. 31. Since the IKÜM requires a legal basis for the processing of personal data, including collection, the requester must also have a legal basis for processing the information. This conclusion follows, among others, from the interpretation of § 39(1) of the Act on the Protection of Personal Data in conjunction with § 14(2) of the Act on the Protection of Personal Data, second sentence. 32. In the present case, the applicant had a legitimate interest in accessing personal data within the meaning of § 6(1)(f) of the Act on the Protection of Personal Data, but this does not outweigh the rights of the data subjects whose data are contained in the archived court file. 32.1. The second sentence of § 14(2) of the Act on the Protection of Personal Data provides that if a person requests restricted access to personal data about third parties, he shall inform the holder of the information of the basis and purpose of access to the information. 32.2. The applicant justified his request for access to the court file, including the personal data contained therein, by stating that he wished to verify whether the law was followed in criminal case No. 1-15-11024 and whether the proceedings were fair. This explanation refers to the applicant's legitimate interest within the meaning of Article 6(1)(f) of the GDPR (cf. also C-37/20 and C-601/20 – WM and Sovim SA v. Luxembourg Business Registers, p. 74). A legitimate interest is considered to be any legitimate, actual and specific interest (see the Data Protection Inspectorate's Guide “Legitimate interest”, p. 7). 32.3. The mere assertion of a legitimate interest is not sufficient to consider the processing of personal data permissible. A three-step test must be applied when assessing a legitimate interest (e.g. C-394/23 – Mousse, p. 45 and references therein). First, the controller or a third party must have a legitimate interest. Secondly, the processing of personal data must be necessary for the pursuit of that legitimate interest, which requires an assessment of whether the legitimate interest pursued by the processing cannot reasonably be achieved just as effectively by other means that are less intrusive to the fundamental rights and freedoms of data subjects (e.g., in conjunction with the principle of data minimisation in Article 5(1)(c) of the GDPR). Thirdly, the interests or fundamental rights and freedoms of the data subject must not override the legitimate interests of the controller or a third party. This requires a balancing of the competing rights and interests, which depends on the circumstances of the specific case. (E.g., C-252/21 – Meta Platforms et al., paragraphs 106, 108 and 110.) 32.4. When assessing the legitimate interest, it should be borne in mind that the European Court of Justice considers, for example, criminal records (which of course also contain other personal data in the court file) to be sensitive, which is why their processing constitutes a particularly serious interference with the fundamental right to privacy and the fundamental right to the protection of personal data. This is because the criminal records concern activities that are condemned by society. Therefore, making these records available may stigmatize the individual and thus constitute a serious interference with his or her private or professional life. (C-740/22, p. 54; ibid. C-439/19, p. 112.) Thus, the European Court of Justice has considered it a disproportionate interference with the rights of the data subject if, without the person requesting the information having to prove a specific interest in obtaining the data, the public is allowed to inspect the penalty points imposed for traffic offences (C-439/19, p. 122) or if information concerning the conviction of a natural person in criminal cases is published orally (see C-740/22, p. 55 and 58). 3-22-2263 10(12) 32.5. Personal data contained in a court file may, unlike what is discussed orally at a court hearing, provide a more detailed and precise overview of the private lives of various data subjects. This may include persons who are not parties to the proceedings but whose personal data are included for some reason, e.g. in evidence. The intensity of the infringement of the rights of data subjects is influenced, among other things, by the way in which the county court allows the applicant to inspect the file (whether only reading or also the right to make transcripts or copies) (see also RKHKm 3-17-62/57, p. 19). The infringement of privacy and the publication of personal data in some form that accompany the public nature of the court proceedings must inevitably be tolerated by other persons, in addition to the accused, whose data is processed during the court proceedings (e.g. at a court hearing). It is in their interests that such an infringement of privacy be limited to what is strictly necessary and that they should not have to endure (equivalent) publicity through inspection of the file even after the end of the court proceedings. Therefore, access to the court file of a criminal case archived in the court should generally be more limited in the situation described above than the publicity of the proceedings during the court proceedings, and the legitimate interest of the applicant should be weighty. 32.6. Considering the above, the fact that the disputed court file contains a large amount of personal data, including special categories, the applicant's opportunity to participate in court hearings that were public, and the control that took place within the judicial system in the appeal proceedings, the information requester must have a compelling right or interest to inspect the criminal case file archived in the county court. The interest described by the applicant may be legitimate (see paragraphs 2.3 and 32.2 of the previous decision), but not compelling. It must be borne in mind that in order to process special categories of personal data, the information requester must have one of the legal grounds provided for in Article 9(2) of the Data Protection Act in addition to that provided for in Article 6(1) of the Data Protection Act. There is no legitimate interest among the list in Article 9(2). The Chamber does not see from the applicant's explanations that any other of the grounds specified in Article 9(2) would be met. 33. In summary, the legislator believes that access restrictions should be imposed on all criminal case files archived in the county court (§ 35(1)(1) of the Estonian Code of Civil Procedure). Granting access to a file is an exception made at the discretion of the president of the court (§ 38(4) of the Estonian Code of Civil Procedure), which in turn is limited by the interests of the state and local government and the rights of the data subject (§ 39 of the Estonian Code of Civil Procedure). Each court file contains a large amount of personal data of both the participants in the proceedings and other persons. Depending on the case, it may be more or less sensitive. The latter may also be affected by the time that has passed since the events that gave rise to the case or the resolution of the case. If, taking into account the content of the case and the justification put forward by the requester regarding the legal basis and purpose of the access, it is obvious that access should be refused, it is sufficient for the president of the county court to refuse by referring to the legal basis together with a brief justification. However, declaring a criminal case hearing closed does not in itself exclude that a request by a person not involved in the proceedings to inspect the court file may be partially granted (see also RKKKm 1-19-8262/17, paragraphs 36–38). It should also be borne in mind that § 4 of the IKS has provided for special rules for the processing of personal data for journalistic purposes (cf. also RKHKm 3-17-62/57, paragraphs 15.1–15.4; EIKo Studio Monitori et al. v. Georgia, joined cases 44920/09 and 8942/10). 34. The first sentence of § 40(1) of the AvTS provides that access restrictions shall be imposed on information from the time the document was prepared or received and until the need ceases or the event occurs, but not for longer than five years. The second sentence adds that the head of the institution may extend this period by up to five years if the reason for imposing the access restriction remains. Paragraph 3 provides that information containing personal data declared for internal use shall be subject to access restriction for 75 years from the date of its receipt or documentation or 30 years from the date of the person's death, or if death cannot be established, then 110 years from the date of the person's birth. 35. The Chamber is of the opinion that § 40 of the Civil Procedure Code must be interpreted in such a way that access restriction shall apply to the court file of a criminal case for up to five years on the basis of § 35(1)(1) of the Civil Procedure Code (which may be extended by the presiding judge for up to five years) and to personal data in the file that significantly harms private life for up to 75 years (or 30 years from the date of the person's death). 3-22-2263 11(12) The period of limitation of access shall commence from the entry into force of the judgment concluding the case, not from the moment when the court prepared or received a specific document in the course of resolving the case. The above interpretation is based on the fact that with the termination of the court proceedings, the purpose of maintaining the court file and processing the data contained in it, serving the interests of the administration of justice, ceases (see also paragraph 16.4 of the previous decision). After the judgment enters into force, the purpose of maintaining the file and thus processing the data contained in it changes. 36. Criminal case No. 1-15-11024 ended with a decision that entered into force on 11 November 2017. The applicant submitted a request for information on 17 August 2022 and the chairman of the county court responded on 9 September 2022, thus at a time when the five-year access restriction covering the entire criminal case file arising from § 40(1) of the Administrative Procedure Code was in force. Pursuant to the second sentence of § 158(3) of the Administrative Procedure Code, the court assesses the legality of an administrative act and action as of the time of its making. Therefore, the chairman of the Harju County Court correctly dismissed the request for information. 37. The Chamber adds that it has no information as to whether the chairman of the county court has by now extended the initial five-year term by up to five years on the basis of the second sentence of § 40(1) of the Administrative Procedure Code. However, the disputed court file is very voluminous (six volumes, 1082 pages). If it also contains, among other things, personal data that significantly harms privacy according to § 35 (1) (11)–(15) of the Estonian Civil Procedure Code, the access restriction of which is generally 75 years (§ 40 (3) of the Estonian Civil Procedure Code), then issuing the court file without the referred personal data may entail unreasonably high costs and would impede the performance of the duties of the county court within the meaning of § 23 (2) (3) of the Estonian Civil Procedure Code. The District Court is correct in its finding that processing the court file of a criminal case in such a way as to remove all information with restricted access from it may significantly disrupt the main activities of the court. V Access to other types of public information 38. The Harju County Court must adjudicate again on the applicant's request for information in which he wished to examine the applications of all persons outside the proceedings who have requested access to the court file of criminal case no. 1-19-8262. 38.1. Section 12(31) of the Act on the Protection of Personal Data provides that if the sender of documents received by an institution or the recipient of documents issued by an institution is a natural person, no information shall be indicated in the public view of the document register that would enable the identification of the natural person. The provision is based on the fact that data identifying a natural person are personal data, and is based on the idea that the state will not actively publish the fact of contacting an institution. This does not preclude the issuance of information in the event of a request for information. 38.2. Two groups of persons outside the proceedings who may inspect the criminal case file can be distinguished: firstly, natural persons acting in private interests, and secondly, those acting in the performance of official or professional duties. 38.3. The chairman of the Harju County Court refused to satisfy the applicant's request for information on the basis of § 23 (1) (1) of the Code of Civil Procedure, in the part that concerned the applications of persons outside the proceedings in criminal case No. 1-19-8262. The respondent explained that if a person outside the proceedings submits an application for inspection of the file, it is registered in the court's public document register and is generally designated for internal use on the basis of § 35 (1) (12) of the Code of Civil Procedure. 38.4. According to § 35 (1) (12) of the Code of Civil Procedure, the inclusion of personal data in the requested information is not an automatic basis for refusing to provide information. The provision assumes that granting access would significantly harm the privacy of the data subject. Since the courts have not requested the relevant applications from Harju County Court (see Part I above), it has not been established whether the information in question exists and whether the conditions for refusal have been met. 38.5. Persons engaged in professional activities also have the right to the protection of personal data (see e.g. C-345/17 – Buivids; RKHKo 3-17-842/44, p. 14). If the request for access to the file has been submitted by a person engaged in professional activities (e.g. an advisor to the Chancellor of Justice, a police officer, a representative of a press publication), the condition of § 35(1)(12) of the Act on Access to Personal Data – significantly harms the privacy of the data subject – is generally not met and the holder of the information cannot refuse to release the information. 39. The Harju County Court must also adjudicate the applicant's request for information in the part concerning the employment contract of the Harju County Court's press representative. 39.1. The fact that the state has entered into a private law relationship by concluding the employment contract does not affect the concept of public information. An employment contract concluded by the state is public information within the meaning of § 3(1) of the Act on Access to Information (see also RKHKo 3-15-3228/37). 39.2. The chairman of the County Court refused to satisfy the request for information regarding the employment contract of the press representative on the grounds that it contains information with restricted access, but did not specify on which basis specified in § 35 of the Act on Access to Information the access restriction has been established. Apparently, this is the aforementioned § 35(1)(12) of the Act on Access to Information. The applicant specified at the appeal stage that he wishes to familiarize himself with the substance of the employment contract and that he is not interested in personal information, such as his place of residence or telephone number. 39.3. The courts did not examine the employment contract of the county court press representative (see Part I above). Even if the employment contract contains personal data, access to which would significantly harm the privacy of the data subject, the employment contract can generally be issued in part – in the part in which it does not contain restricted data (AvTS § 38 (2)). 39.4. When adjudicating the applicant’s request for information, the county court must specify whether the applicant wishes to examine the employment contract with personal data or a version without personal data, and make a decision based on this. VI Procedural costs 40. Pursuant to § 108 (2) of the Code of Civil Procedure, if the complaint is partially satisfied, the procedural costs are divided in proportion to the satisfaction of the complaint. 41. The respondent has not requested an award of procedural costs. The applicant’s procedural costs have been the paid state fee, a total of 90 euros (20 + 20 + 50 euros). Considering the contested information requests as a whole, the complaint is only partially successful. Therefore, the complainant will bear the procedural costs. (digitally signed)
