TR (Estonia) - 3-24-2146/23
From GDPRhub
| TR (Estonia) - 3-24-2146/23 | |
|---|---|
 | |
| Court: | TR (Estonia) (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 2(2) GDPR Article 6(1)(a) GDPR Article 6(3) GDPR |
| Decided: | 18.03.2026 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 3-24-2146/23 |
| European Case Law Identifier: | |
| Appeal from: | TH (Estonia) [1] |
| Appeal to: | |
| Original Language(s): | Estonian |
| Original Source: | Riigi Teataja (in Estonian) |
| Initial Contributor: | bms |
A court held that a member of Parliament unlawfully published a recording of a telephone conversation with a government official on Facebook. According to the court, the publishing fell in the scope of the GDPR but still lacked a necessary legal basis.
English Summary
Facts
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health.
The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted.
The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings.
The controller then brought an action before the Tallinn Administrative court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by Article 6(1)(e) GDPR. The Administrative court dismissed the action.
The controller subsequently appealed the Administrative court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter.
Holding
The court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment.
The court rejected the argument that the processing fell outside EU law or within the EU common foreign and security policy exception under Article 2(2) GDPR. A parliamentarian’s Facebook publication of a call with a ministry official could not be characterised as an activity outside the GDPR merely because the underlying topic concerned international or EU policy.
The court further held that there was no consent under Article 6(1)(a) GDPR, as the data subject had expressly objected to publication of the recording. Also, under Article 6(3) GDPR, processing based on a public-interest task or official authority must be grounded in EU or Member State law. The court found no Estonian or EU provision allowing a parliamentarian to publish an official’s personal data on a personal Facebook account. The right to request information from public authorities did not automatically include the right to disclose the personal data contained in that information.
The court also held that parliamentary immunity of the controller did not prevent DPA supervision. Immunity does not give members of parliament broader rights to infringe the rights of others, and the DPA’s order did not prevent the controller from carrying out parliamentary duties. He remained free to communicate the substance of the issue without disclosing the data subject’s personal data. The court also found that Article 2(2)(a) GDPR does not apply in the case since this Article cannot be automatically applied to a specific activity merely because it involves the activities of the state or a public authority itself.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.
JUDGMENT IN THE NAME OF THE REPUBLIC OF ESTONIA The Court Tallinn Circuit Court The Court Villem Lapimaa, Maret Altnurme, and Virgo Saarmets Date and place of the decision March 18, 2026, Tallinn Administrative case number 3-24-2146 Administrative case F.K Appeal against the decision of the Data Protection Inspectorate June 21, 2024 regarding a warning and penalty warning in personal data protection case no. 2.1.-1/23/1212-2967-10 Parties to the proceedings Appellant F.K., represented by attorney Heldur Otti Respondent: Data Protection Inspectorate, represented by Irina Meldjuk Third party C.L Contested court decision Decision of the Tallinn Administrative Court dated January 9, 2025 Basis for proceedings in the circuit court Appeal by F.K. Review of the case Written proceedings DECISION 1. To dismiss F.K.’s appeal and uphold the decision of the Tallinn Administrative Court dated January 9, 2025. 2. The parties to the proceedings shall bear their own costs in the appellate proceedings. 3. Publish the final judgment online in such a way that the names of the appellant and the third party are replaced with asterisks. Explanations An appeal to the Supreme Court may be filed within 30 days of the judgment being publicly announced, i.e., no later than April 17, 2026 (HKMS § 212(1)). In response to the appeal, the other party to the proceedings may file a counter-appeal within 14 days of the delivery of the appeal to the party filing the counter-appeal, or within the remaining appeal period if it is longer than 14 days (HKMS § 215(3)). If a party to the proceedings wishes to obtain legal aid to file an appeal, they must submit an application to the Supreme Court for this purpose. The submission of an application for legal aid does not suspend the running of the procedural deadline (HKMS § 116(5)), and in order to comply with the appeal deadline, the applicant for legal aid 3-24-2146 2(13 ) also perform the procedural act for which they are seeking legal aid within the time limit, specifically filing the cassation appeal (HKMS § 116(6)) FACTS AND COURSE OF PROCEEDINGS 1. F.K. posted a video on his Facebook account of a phone call with C.L., an official at the Ministry of Social Affairs. The video was viewed by over 33,000 people, received 205 comments, and was shared 944 times. 2. C.L. sent F.K. a request to delete the recording of the call and immediately remove it from all publication channels. C.L. filed a complaint with the Data Protection Inspectorate (AKI), requesting that the publication of the video recording be ceased and that the recording be deleted. 3. The AKI initiated a supervisory proceeding pursuant to § 56(3)(8) of the Personal Data Protection Act (IKS) and issued a recommendation and inquiry to F.K. on November 30, 2023, regarding personal data case no. 2.1.-1/23/1212-2967-3. Accordingly, he was required to cease the disclosure of C.L.’s personal data on his Facebook page , i.e., the disclosure of the recorded conversation, either by deleting the post (including comments) or by removing C.L.’s personal data from the post—specifically, the video clip of the recorded conversation and the personal data in the comments. The proposal was to be complied with by December 15, 2023, at the latest, by sending confirmation thereof to the AKI. Alternatively, in the event of disagreement with the proposal, the AKI provided the opportunity to explain, by December 15, 2023, at the latest, on what legal basis, for what purpose, and for what reasons F.K. is disclosing C.L.’s personal data. In such a case, the disclosure of the video in question had to be restricted until the lawfulness of the video’s disclosure and retention had been proven to the AKI and the AKI had issued a confirmation to that effect. 4. F.K responded to AKI’s proposal on December 13, 2023, explaining the necessity of continuing to publish the video and justifying why the publication of C.L.’s personal data is justified and what its legal basis is. 5. On February 23, 2024, the AKI issued a warning to F.K. ( ) in personal data protection case No. 2.1.-1/23/1212-2967-7, requiring him to remove the video featuring C.L.’s voice—i.e., the disclosure of a person’s voice in a recorded conversation—from his personal Facebook account by March 8, 2024, at the latest. Since the video was no longer available on the Facebook account thereafter, the AKI terminated the supervisory proceedings and sent F.K. a reprimand and a notice of termination of proceedings in personal data protection case No. 2.1.-1/23/1212-2967-8 on March 13, 2024. 6. On April 11, 2024, F.K. filed a complaint with the Tallinn Administrative Court seeking to have the AKI’s March 13, 2024, reprimand and notice of termination of proceedings revoked, and to have the unlawfulness of the AKI’s November 30, 2023, inquiry and February 23, 2024, precept(Administrative Case 3-24-1073). 7. On June 21, 2024, the Data Protection Inspectorate issued a decision in personal data protection case No. 2.1.-1/23/1212-2967-10, whereby: – Declared invalid the warning issued to F.K. on February 23, 2024, in personal data protection case No. 2.1.-1/23/1212-2967-7 and the reprimand and notice of termination of proceedings issued on March 13, 2024, in personal data protection case No. 2.1.-1/23/1212-2967-8; – pursuant to IKS § 56(1), (2)(8), § 58(1), and the General Data Protection Regulation 1 (GDPR) Article 58(1)(d) and (2)(c), (f), and (g), and taking into account IKS § 4 and GDPR Article 6, issued a precept to F.K. in personal data protection case No. 2.1.-1/23/1212-2967-10: 1) Refrain from posting on social media (including on a Facebook account) a video containing C.L.’s personal data (i.e., voice and health data) that reflects a telephone conversation recorded with C.L.; or 2) alternatively, when republishing the video, distort the person’s voice in the video or replace 1 Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. 3-24-2146 3(13 ) Transcribe the verbal responses given by C.L. in the video and omit the section in which the individual discloses health data. In both cases, it was necessary to ensure that C.L.’s personal data was not disclosed, including in the comments on the post. The order-The warning included a notice that failure to comply with the injunction by the specified deadline would result in a penalty payment of 1,000 euros for each unfulfilled provision of the injunction, imposed on F.K. pursuant to § 7(1) of the Act on Substitute Performance and Penalty Payments (ATSS) and § 60 of the Administrative Procedure Act (IKS). The grounds for the order were, in summary, as follows: The AKI hereby revokes the administrative order No. 2.1.-1/23/1212-2967-7 and No. 2.1.-1/23/1212- 2967-8 on the grounds that the AKI did not substantiate the legal basis cited by F.K. – Article 6(1)(e) of the IKÜM – regarding the unsuitability of processing personal data. F.K. has disclosed C.L.’s personal data within the meaning of IKÜM Art. 4(1) and (2). There must be a legal basis for any data processing (IKÜM Art. 6). The data controller must be able to demonstrate the lawfulness of the data processing (GDPR Article 5(2)). F.K. has not done so. The video shows that the individual did not initially object to the recording of the conversation, but clearly stated in the video that he does not consent to the disclosure of his personal data. Therefore, the disclosure of personal data in the video is not based on the individual’s consent as required by Article 6(1)(a) of the IKÜM. In F.K.’s view, the legal basis for the disclosure of personal data is Article 6(1)(e) of the General Data Protection Regulation (GDPR). The processing of personal data for the performance of a task carried out in the public interest or in the exercise of official authority requires an additional national basis (Article 6(3)(b) of the GDPR). F.K. has not cited any specific national or European Union provision that would provide a basis for such data processing. Estonian and EU legislation lacks a legal basis established under Article 6(3) of the GDPR for the disclosure of personal data on social media for the performance of a task carried out in the public interest or for the exercise of official authority. By posting content related to the pandemic agreement on his social media account, F.K. is not fulfilling the primary duties of the Riigikogu (Public Service Act (ATS) § 7(3)(7)) nor exercising public authority. A member of the Riigikogu posting on social media and disclosing the personal data of officials in the course of such activity is not related to the performance of constitutional duties (IKS § 2(2)). Pursuant to § 18(3) of the Status of Members of the Riigikogu Act (RKLS), a member of the Riigikogu may not use their immunity for activities unrelated to the exercise of their free mandate or to evade legal liability. The disclosure of third parties’ personal data on social media cannot be considered an activity related to the exercise of a free mandate. A Member of the Riigikogu’s immunity does not extend to the disclosure of personal data in the video. Neither the AKI’s proposal nor its directive prevents F.K. from performing the duties of a member of the Riigikogu or from disseminating messages, as he can convey the same message on social media without disclosing personal data (including the official’s voice). Even if the publication of the video could be considered part of a Member of the Riigikogu’s official duties, a representative of the people cannot disregard the Constitution and the laws. A Member of the Riigikogu can fulfill their duties without excessively disclosing personal data on social media and without unduly infringing on individuals’ right to privacy. In the present case, the journalistic purpose arising from § 4 of the Personal Data Protection Act does not constitute a legal basis for the disclosure of personal data on social media, as not all the prerequisites for the application of § 4 of the Personal Data Protection Act have been met. For the disclosure of personal data for journalistic purposes, there must be a public interest not only in the disclosed case or topic, but also in the person involved in the case. The official did not place himself in the public spotlight through his actions—by answering questions before the committee and to F.K. over the phone, he was performing his job duties, and he framed his responses in accordance with the actions of his employer, i.e., the Ministry of Social Affairs. Certainly, the actions of a single official from the Ministry of Social Affairs in the decision-making process do not carry such weight that the disclosure of his personal data in social media coverage of the pandemic agreement would be unavoidably necessary. The disclosure of personal data in the disputed post resulted in C.L., as a private individual, being placed in a so-called “public pillory.” Furthermore, 3-24-2146 4(13 ) During the conversation, C.L. expressed a desire to end the call due to his health condition. This constitutes personal health data (Article 4(15) of the Personal Data Protection Act), the processing of which is permitted primarily on the basis of the individual’s consent (Article 9 of the Personal Data Protection Act). 8. On July 22, 2024, F.K. filed a complaint with the Tallinn Administrative Court to revoke the AKI’s June 21, 2024, warning notice and to order the AKI to terminate the supervisory proceedings in personal data protection case No. 2.1.-1/23/1212-2967-10. The publication of the phone call between the complainant and C.L. on a Facebook account was a lawful act to which the provisions of the IKÜM and IKS requiring the data subject’s consent or imposing other prohibitions and restrictions do not apply. The phone call was an inquiry by the complainant, as a representative of the people, to official C.L. It concerned C.L.’s promise to disclose, at the meeting of the European Union Affairs Committee (ELAK) to disclose the negotiation documents between the World Health Organization (WHO) and member states, as well as summaries of all discussions regarding the WHO’s decision to initiate talks on an agreement to combat new global health crises. C.L. is an official of an executive authority who exercises public authority in the performance of his official duties. The complainant is of the opinion that the ELAK had no right to authorize the European Commission to formulate Estonia’s positions regarding the WHO Pandemic Agreement. There was heightened public interest in the amendments to the WHO International Health Regulations and the content of the Pandemic Agreement, which is why the WHO Pandemic Agreement could not be merely a topic of discussion within ELAK. Resolving this issue required obtaining relevant, accurate, and timely information from all information holders. As a public official, C.L. failed to fulfill his official duty, i.e., the promise made at the ELAK meeting held on February 28, 2022. While the scope of addressees is limited for invoking § 74 of the PS (interpellation by a member of the Riigikogu), this fact does not preclude a member of the Riigikogu from demanding information necessary for their activities from all information holders known to them, including C.L., who held a public office. Pursuant to the purpose and spirit of IKS § 2(2) and RKLS §§ 17 and 18, it is inconceivable that the AKIhas the authority to decide in which matters of overriding public interest and with respect to which public official a member of the Riigikogu has the right to inform the public while performing the duties of exercising public authority. The contested administrative act unlawfully prevents the appellant from performing the duties of a representative of the people. 9. The Data Protection Inspectorate requested that the appeal be dismissed. 10. In its decision of January 9, 2025, the Tallinn Administrative Court dismissed the complaint and ordered the parties to bear their own costs. The complainant posted a video recording of a telephone conversation between himself and C.L. on his Facebook account. The recording was made in the complainant’s office, and C.L.’s voice can be heard in the video. The publication of such a recording constitutes the processing of personal data within the meaning of the IKÜM and IKS; in this context, the complainant, as the publisher of the video, is the (responsible) processor of personal data, while C.L. is the data subject. In a situation where C.L.’s voice is audible on the recording and it is clearly stated at the beginning of the phone call who the complainant is speaking with, this constitutes the processing of C.L.’s personal data. This is not altered by the fact that the call is a so-called official call, rather than a private telephone conversation between individuals on personal matters. At the same time, public officials are also natural persons entitled to the protection of personal data, and the assessments and opinions of officials participating in a performance review, for example, qualify as personal data (see Supreme Court Decision No. 3-17-842 of June 6, 2019, pp. 14–15). Furthermore, at the end of the call, C.L. stated that he felt bad, which cannot in any way be considered part of an official conversation. We cannot agree with the complainant that, since C.L. unilaterally ended the phone call, it is irrelevant whether C.L. gave the complainant consent to disclose the disputed phone call. The data subject’s own behavior—even if it could be considered inappropriate or impolite—does not legitimize the processing of personal data or substitute for the lack of consent. Since C.L. explicitly prohibited the disclosure of the recording, even though he did not initially object to the recording of the call, this constitutes 3-24-2146 5(13 ) a situation where there is no consent to the processing of personal data within the meaning of Article 4(11) of the General Data Protection Regulation. The publication of the recording constitutes a significant infringement of C.L.’s right to privacy, considering, among other things, that the recording was viewed by over 33,000 people, the published video received 205 comments, and was shared 944 times. The publication of the disputed post resulted in C.L. being personally insulted and mocked in the comments under the post (see paragraph 13 of the order). Neither the fact of the processing of personal data nor its lawfulness is affected by whether C.L. was performing public duties at the ELAK session or whether he breached his official duties by allegedly failing to comply with the complainant’s request for information. The legal basis for a specific instance of data processing cannot derive from anyone’s failure to fulfill official duties, nor from the complainant’s status as a member of the Riigikogu. Members of the Riigikogu are also obligated to comply with the Constitution and laws, including the principles of personal data protection. The appellant claims that it processed data in the course of activities related to the EU’s common foreign policy and that, therefore, the legal basis was Article 2(2)(a) of the General Data Protection Regulation (GDPR) and the exception set forth in Recital 16. The Court does not agree with this. The EU’s common foreign policy is not carried out by entities such as the appellant (the appellant is not a “Member State” and did not act on behalf of or in the name of a “Member State”) nor in such a manner (the publication of a telephone conversation on Facebook). The fact that the requested information might indirectly relate to that area does not mean that the relevant basis for data processing is satisfied. As is evident from the complaint and various procedural documents, the purpose of disclosing the telephone conversation was rather to prove that the official had failed to fulfill his official duties, not to implement the EU’s common foreign policy. The appellant has also cited Article 6(1)(e) of the General Data Protection Regulation (GDPR) as a legal basis, i.e., that the processing of personal data was necessary for the performance of a task carried out in the public interest or for the exercise of official authority vested in the controller. The appellant’s argument regarding whether C.L. (in the performance of official duties) exercised public authority or not is irrelevant. The legal basis for the processing of personal data must be based on the data controller’s position and activities, not on the data subject’s person and activities. Some individuals may have a greater obligation to tolerate public scrutiny, but this is on the condition that the data processing is carried out on a legal basis, e.g., for journalistic purposes in accordance with § 4 of the Personal Data Protection Act. This is not the case here. The fact of being a public official or the performance of official duties does not constitute an independent legal basis for processing personal data; otherwise, one would have to conclude that public officials have no right to privacy. Therefore, the complainant’s actions must be assessed in light of the specific data processing incident, i.e., whether the processing of C.L.’s personal data on the complainant’s Facebook account is necessary for the performance of a task carried out in the public interest or for the exercise of official authority by the controller. The processing of personal data for the performance of a task carried out in the public interest or for the exercise of official authority requires an additional basis under national law (Article 6(3)(b) of the GDPR). Pursuant to § 2(2) of the IKS, the activities of the Riigikogu as a constitutional institution do not fall within the scope of application of the IKÜM and the IKS when the Riigikogu is performing its constitutional duties and to the extent that such activities are regulated by special laws—such as the Riigikoguand Rules of Procedure Act (RKKTS). It must be borne in mind that these must be the constitutional duties of the Riigikogu as a collegial body. The provision does not extend to activities of individual members of the Riigikogu not covered by the RKKTS that are claimed to be related to the performance of official duties. Uploading a recording to a personal Facebook account cannot be considered the performance of the (constitutional) duties of the Riigikogu or a member of the Riigikogu. According to the RKKTS, Riigikogu sessions are generally public, as is the transcript of the session (RKKTS § 59(1), § 61(2)), whereas standing committee sessions are generally closed (RKKTS § 36(3)). With regard to closed committee meetings, the Supreme Court has held that it is important for an individual to know whether their statements and positions given before the committee are subject to disclosure or not; and in the Supreme Court’s view, the non-disclosure of information gathered during closed sessions of Riigikogu committees does not conflict with Article 44 of the Constitution (see Decision No. 3-3-1-90-14 of May 11, 2015, para. 11). Sections 59 and 36 of the Rules of Procedure of the Riigikogu establish a general framework for the activities of the Riigikogu, including the processing of personal data 3-24-2146 6(13 ) In the performance of the Riigikogu’s constitutional duties. The AKI has rightly pointed out that the Court of Justice has not automatically excluded the activities of parliamentary bodies from the scope of the IKÜM and has held that, for example, parliamentary committees of inquiry are generally required to comply with the IKÜM (see judgment of January 16, 2024, Case C-33/22, para. 40). The complainant has referred to the exercise of parliamentary oversight as the fulfillment of the Riigikogu’s constitutional duty. The instruments of parliamentary oversight are set forth in the Constitution (interpellations, oversight of the execution of the state budget, and the possibility of expressing no confidence) and in law (the most important of which are question periods and written questions, as well as investigative and special committees; see the annotated edition of the Constitution2, 2020, § 59, commentary no. 12). Parliamentary oversight is exercised over officials bearing political responsibility—primarily ministers. Parliamentary oversight is also exercised by standing committees, but here too, the RKKTS emphasizes the special role of ministers (cf., e.g., the wording of RKKTS § 22(1)(1)–(3) and see RKKTS Commentary3 , 2023, § 22, commentary no. 4). Parliamentary oversight may result in a vote of no confidence against a political leader—a minister. In a situation where a member of parliament, in their assessment, seeks to “sanction” an official who has failed to fulfill their duties by publishing a telephone conversation between them on their Facebook account and allowing the account’s numerous followers to personally attack the official, this does not constitute the exercise of parliamentary oversight. It constitutes the processing of personal data, in which all data protection principles must be observed. The complainant’s right to process personal data (without consent) does not arise from § 20 of the RKLS, as cited by the complainant. This does not constitute the establishment of a legal basis for the processing of personal data within the meaning of the Personal Data Protection Act, but rather the creation of a legal basis for members of the Riigikogu to contact state and local government agencies and their officials and receive responses from them within a relatively short period of time (see Explanatory Memorandum to the RKLS, 11th Riigikogu, Draft 54 SE, p. 8). Even if the complainant’s communication with C.L. were to be considered a letter of notice or a statement within the meaning of § 20 of the RKLS, as the complainant has argued in the court proceedings, this does not create a legal basis for the disclosure of personal data on the complainant’s Facebook account. The information regarding the communication could have been disclosed without the natural person’s personal data, thereby avoiding an infringement of C.L.’s fundamental rights. In conclusion, the respondent correctly found that there is no legal basis in Estonian or EU law, as established under Article 6(3) of the GDPR, for the disclosure of personal data on social media for the purpose of performing a task carried out in the public interest or exercising official authority. Consequently, the complainant lacked a legal basis to disclose C.L.’s personal data without the data subject’s consent. Since the court found that there was no legal basis for the processing of personal data, the processing of personal data did not comply with the principle of lawfulness (see Article 5(1)(a) and Article 6 of the IKÜM). There is no need to analyze whether the processing of personal data may have been in conflict with other requirements and principles of the IKÜM (e.g., the principle of proportionality), as this would not affect the legality of the contested order. Nor is it necessary to assess whether the data subject’s statement “I feel bad” constitutes special category personal data. The appellant has argued that the AKI lacks the authority to supervise a member of the Riigikogu in the performance of his or her constitutional duties. The AKI has correctly pointed out that, according to the explanatory memorandum to the RKLS, immunity cannot be used as a shield for unlawful conduct, and the immunity of a member of the Riigikogu does not extend to the disclosure of personal data in a video (see RKLS § 18(3)). The AKI has not prevented the complainant from performing the duties of a representative of the people, insofar as the AKI has issued an order to cease the unlawful processing of personal data. Issuing an order to comply with a legal act does not violate the immunity of a member of the Riigikogu. The RKLS sets forth exceptions to the application of immunity in misdemeanor proceedings (RKLS § 182), as well as in public order proceedings involving the application of special state supervisory measures (RKLS § 183), but the present case does not involve such situations. The supervisory authority of the AKI is also confirmed by the case law of the European Court of Justice. 2https://pohiseadus.ee/ 3https://www.riigikogu.ee/infoallikad/riigikogu-valjaanded/ 3-24-2146 7(13 ) In Case C-33/22, the issue at hand was whether the Austrian Data Protection Authority (a supervisory authority within the executive branch) had the power to exercise oversight over the parliament under the GDPR in a situation where the law of that particular Member State expressly excluded such authority. The Court of Justice held that where a Member State has, within the scope of its discretion, decided to establish a single supervisory authority (as is the case in Estonia), it cannot rely on domestic legal provisions, even if they are constitutional provisions, to exclude the processing of personal data falling within the scope of the GDPR from the supervision of that authority (para. 71), and added that “Article 77(1) and Article 55(1) of the General Data Protection Regulation must be interpreted as meaning that where a Member State has decided, in accordance with Article 51(1) of that Regulation, to establish a single supervisory authority, without, however, conferring on that authority the power to supervise the application of the General Data Protection Regulation by a committee of inquiry which has been established by the Member State’s parliament in the exercise of its power to oversee the executive, then those provisions directly confer on that authority the power to resolve complaints relating to the processing of personal data by that committee of inquiry” (para. 72). In Estonia, the activities of members of the Riigikogu, including those outside the performance of their official duties, are not excluded from the supervision of the AKI. Therefore, the AKI had the authority to issue a precept. POSITIONS OF THE PARTIES IN THE APPEAL PROCEEDINGS 11. In its appeal, F.K. requests that the Administrative Court’s decision of January 9, 2025, be set aside and that a new decision be issued granting the appeal. The a p p e l l a n t maintains that the telephone conversation in question was an official conversation between members of the legislative and executive branches of government, during which the appellant, as a member of the Riigikogu, requested information and clarifications in accordance with § 20(1) of the Riigikogu Rules of Procedure. In conjunction with § 50, § 51(1), § 51(2), and § 51(4) of the ATS, C.L. was obligated to answer the appellant’s questions. The appellant was entitled to disclose the official response provided orally by the official in response to his request for information. The official activities of a member of the Riigikogu and a public servant are, as a rule, public. There was heightened public interest in the amendments to the WHO International Health Regulations and the content of the Pandemic Agreement, as this issue concerned every person living in Estonia. The complainant was approached and concerns were expressed that there had been no public debate in Estonia regarding the WHO Pandemic Agreement in the context of national health policy. The complainant did not have sufficient time or relevant information to respond to these inquiries, which is why he needed additional information from the Ministry of Social Affairs. Under § 20(1) of the Riigikogu Act, a member of the Riigikogu has the right to request information necessary for their work, including from state agencies and their officials. The complainant cannot be blamed for what other Estonian citizens thought of the content of the video posted on his Facebook account. It is evident that if a Member of the Riigikogu’s request for information is not fulfilled, this hinders his work and violates the principle of the free exercise of his mandate guaranteed by Article 62 of the Constitution. The disclosure of a response provided pursuant to a request for information by a member of the Riigikogu cannot be subject to stricter requirements than the disclosure of a response provided by a public authority to an individual pursuant to a request for information. Paragraphs 5 and 6 of Section 36(1) of the Public Information Act (AvTS) stipulate that a public authority holding information may not classify as information intended for internal use reports on the work or performance of the information holder, data on the quality of task performance and management errors, or information that damages the reputation of an official working in a public authority. Therefore, as a member of the Riigikogu, the complainant had the right to disclose the oral response received from an official of the Ministry of Social Affairs to his request for information, even if it contained information damaging to C.L, because that response contained explanations regarding issues of heightened public interest and the quality of his performance of duties. If an official fails to fulfill his or her official duties, he or she must bear the consequences thereof, including public criticism and any resulting damage to reputation. The disputed telephone conversation did not contain any special categories of personal data regarding C.L., including health data. In his complaint to the AKI, C.L. did not rely on the health issues that affected him during the disputed telephone call 3-24-2146 8(13 ) , but the sole purpose of the complaint was to prevent potential damage to his professional reputation. It has also not been proven that C.L. suffered any health issues at all during the disputed phone call. During the disputed telephone conversation, C.L. responded cheerfully and helpfully to all of the complainant’s questions, and only when the complainant asked him an uncomfortable question did he use the expression “I feel unwell.” Current law does not provide a data controller with protection to arbitrarily and without justification refuse to disclose a response to a request for information. In Estonian cultural context, the intentional interruption of a one-sided phone call is considered a sign of rudeness. Disclosure of an official who has behaved rudely is permitted under § 36(1)(5) and (6) of the Public Information Act. The IKÜM does not apply in the present case, as neither the IKÜM nor the data protection rules in force in Estonia were established for the purpose of protecting officials of a Member State’s public authority from potential public criticism expected in the event of inadequate performance of their official duties, nor to hinder the work of a member of parliament. EU law does not and cannot regulate the conditions or procedure for disclosing a response to a request for information submitted by a member of the Estonian Parliament to an official working in an Estonian public authority, except with regard to the disclosure of specific categories of personal data concerning that official. The complainant maintains that his request for information concerned activities related to the EU’s common foreign policy, as the purpose of concluding the pandemic agreement discussed in the disputed telephone call was to shape a common EU foreign policy on pandemic issues in all EU Member States in the future and to establish a position within the WHO. If the Circuit Court finds that the IKÜM applies in this case, the appellant maintains that his right to disclose the disputed video recording derives from Article 6(1)(e) of the IKÜM. Pursuant to § 44 of the PS, upon receiving a petition from citizens, a member of the Riigikogu must be informed and must also have the right, on their own initiative, to inform the public about significant issues concerning Estonia, which include information related to the WHO Pandemic Agreement. A member of the Riigikogu does not have the right to withhold information that the public has a right to know, as the activities of public authorities (including C.L.’s activities as a public official) must be transparent. If the Circuit Court finds, in line with the AKI and the Administrative Court, that the legal provision under Article 6(3) of the IKÜM has not been enacted in Estonian law, the appellant is of the opinion that this fact unreasonably restricts his work as a member of the Riigikogu and the parliament’s right to self-organization. As an independent member of Parliament who previously belonged to an opposition party, the appellant lacks sole decision-making authority and any realistic possibility of establishing such a legal provision. The right of a member of the Riigikogu to disclose an official’s response to a request for information is also supported by the principle of immunity set forth in § 18(5) of the Riigikogu Act, according to which a member of the Riigikogu may not be compelled to participate in administrative, civil, or misdemeanor proceedings, nor may compulsory attendance be enforced against them, without their prior written consent in a form that allows for reproduction, if such participation or enforcement would impede the performance of the member’s duties. In the present case, the AKI’s June 21, 2024, order and warnings have effectively compelled the appellant, as a member of the Riigikogu, to participate in administrative proceedings in a manner that hinders the performance of the member’s duties. 12. The Data Protection Inspectorate requests that the appeal be dismissed, maintaining its previous positions and concurring with the reasoning of the administrative court’s decision. A person’s personal data (especially special categories of personal data) is generally not subject to disclosure, even in the case of a public official. A public official is also a natural person who has the right to the protection of personal data. There is no dispute that the topic discussed during the telephone conversation may be of public interest and that the issues discussed do not constitute classified information. The AKI did not prohibit the complainant from disclosing the content of the telephone conversation without C.L.’s personal data. However, to report on the topic, the complainant had to choose a different method, thereby respecting C.L.’s rights, including the right to privacy under § 26 of the Constitution, as the AKI suggested in its June 21, 2024, warning letter. The AKI agrees with the Administrative Court’s position that in this case, the issue at hand is the complainant’s actions as a data controller, not, for example, the actions of ELAK, and therefore, when processing personal data, 3-24-2146 9(13 ) Article 2(2)(a) of the IKÜM or the exception set forth in recital 16 may apply. Consequently, when disclosing the appellant’s personal data, the appellant must comply with the requirements set forth in the GDPR; specifically, the processing of personal data must be based on one of the legal grounds listed in Article 6(1) of the GDPR, which is not present in this case. Article 6(1)(e) of the GDPR, cited by the complainant, is not applicable, as there is no legal basis established under Article 6(3) of the GDPR in Estonian or EU law for the disclosure of personal data on social media for the performance of a task carried out in the public interest or in the exercise of official authority. Therefore, the complainant lacked a legal basis to publish C.L.’s personal data without the data subject’s consent. Since C.L. explicitly prohibited the disclosure of the recording, even though he did not initially object to the recording of the conversation, this constitutes a situation where consent to the processing of personal data within the meaning of Article 4(11) of the IKÜM is lacking. 13. C.L. requests that the appeal be dismissed. The processing of personal data concerning a public official constitutes the processing of personal data even if it takes place in a work-related context. No legal act, including the Personal Data Protection Act, provides that a public official loses the right to privacy upon taking office. The Personal Data Protection Act also applies to the activities of members of the Riigikogu. A distinction must be made between everyone’s right to receive information and the right to disclose personal data. Information obtained during a telephone conversation could have been disclosed without personal data. Regardless of how a person identifies themselves, a legal basis is required for the public disclosure of personal data. The right to receive information does not in itself constitute such a basis. Furthermore, information is provided orally only in very limited cases (AvTS § 17(5)). It is also stipulated in which cases a request for information may be refused (AvTS § 17(2)). If the information must be sought out, investigated separately, or systematized, the request is reclassified as a request for clarification (AvTS § 2(2)(3); § 23(2)(5)). This is also consistent with the practical reality that the official to whom the request for information is made orally may not possess, manage, or be aware of all the information. In the present case, the recording and public sharing of the voice call was clearly disproportionate. The purpose of the processing, i.e., the publication, also remains unclear. The complainant notes that his purpose was not to share the information, but to provide an assessment “Regarding the quality of C.L.’s performance of his duties.” Consequently, the processing of personal data was not related to the content of the information, but rather to a personal attack against the official concerning his private life. If the aim was to ensure the proper performance of the official’s duties, this could have been achieved in other ways, such as by submitting a formal notice to the agency or proposing the initiation of an official investigation. If desired, given the heightened public interest, the information could have been shared in a different manner—that is, without personal data. In any case, neither the Public Information Act nor the Act on Responding to Letters of Notice and Requests for Explanation and on Submitting Collective Appeals (MSVS) requires that every official who is contacted by phone be able to explain everything fluently and without hesitation on the spot. Therefore, given the objective of sharing information of public importance, the measure was also not proportionate, as the official would have had sufficient time and, upon investigation, could have provided the complainant with the requested information in writing. If a request for clarification is made in an aggressive manner and the goal itself is a disparaging and rude attitude, being an official does not entail an unlimited duty of tolerance. Moreover, a person’s voice carries various types of information and, from the perspective of privacy, is more intrusive than, for example, written information containing personal data. Furthermore, a voice shared online may subsequently be exploited as personal data in the commission of unwanted cyberattacks or crimes, a risk that must be taken into account when sharing personal data with a wider audience (see European Court of Justice judgment C-184/20, para. 113). A situation where personal data is made more widely available on the internet constitutes a serious infringement of the fundamental rights to privacy and the protection of personal data (ibid., paras. 102 and 105). The disclosure of such information may lead to public condemnation and result in the stigmatization of the person concerned (e.g., European Court of Justice judgment C-439/19, para. 92). REASONS OF THE CIRCUIT COURT 3-24-2146 10(13 ) 14. The Circuit Court finds that there are no grounds for granting the appeal. The Administrative Court’s decision is lawful and well-reasoned. The Circuit Court concurs with the Administrative Court’s reasoning without repeating it in full (HKMS § 201(4)). 15. According to Article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Case law has clarified that the right to the protection of personal data also applies to persons performing public functions (e.g., European Court of Justice judgment of July 16, 2015, Case C-615/13 P, para. 30; Judgment of February 14, 2019, Case C- 345/17, paras. 44–47), and assessments and opinions of officials, for example, may qualify as personal data (Supreme Court Judgment No. 3-17-842 of June 6, 2019, para. 14). Pursuant to Article 4(2) of the Personal Data Protection Act, the processing of personal data includes, inter alia, the disclosure of personal data through dissemination or making it available in any other manner. The video in question clearly states that the complainant is communicating with C.L. over the phone , and C.L.’s voice and responses to the complainant’s questions are clearly audible. Thus, C.L. was identifiable from the recording of the conversation. In light of the foregoing, the Administrative Court correctly found that the publication of the telephone conversation in question on the complainant’s Facebook account constituted the processing of C.L.’s personal data, and it is irrelevant that C.L. was performing his official duties when answering the phone. The Circuit Court agrees with the respondent that, in addition, health data was disclosed in this telephone conversation. According to Article 4(15) of the IKÜM, health data is personal data related to a natural person’s physical and mental health that provides information about their health status. Recital 35 of the GDPR explains that health-related personal data should include all data concerning the data subject’s health status that provides information about the data subject’s past, present, or future physical or mental health. Even the expression “I feel unwell” provides some information about a person’s state of health at a specific point in time, regardless of whether a diagnosis confirming that condition exists. 16. Article 2(2) of the GDPR provides for exceptions where the GDPR does not apply to the processing of personal data. Pursuant to Article 2(2)(a) of the GDPR, the GDPR does not apply where personal data are processed in the course of an activity that falls outside the scope of Union law; According to point (b), the GDPR does not apply where Member States process personal data in the course of activities falling within the scope of Chapter 2 of Title V of the Treaty on the Functioning of the European Union (i.e., concerning the common foreign and security policy). Recital 16 of the GDPR clarifies that the GDPR does not address issues concerning the protection of fundamental rights and freedoms or the free movement of data in connection with activities falling outside the scope of Union law, such as activities concerning national security, nor the processing of personal data by Member States in the course of activities related to the Union’s common foreign and security policy. The Circuit Court agrees with the Administrative Court that, in the present case, the processing of personal data did not fall under the aforementioned exceptions. The Court of Justice has clarified that the exceptions in Article 2(2) of the GDPR must be interpreted narrowly, and, for example, the exception in Article 2(2)(a) of the GDPR cannot be automatically applied to a specific activity merely because it involves the activities of the state or a public authority itself (see the Court of Justice’s judgment of January 16, 2024, in Case C-33/22, para. 37 and the case law cited therein). According to the Court of Justice’s position, for example, “activities relating to national security that fall outside the scope of Union law within the meaning of that provision, the activities of an investigative committee established by the parliament of a Member State in the exercise of its power to oversee the executive branch, and whose purpose is to investigate the activities of the State Security Police due to suspicions of political influence being exerted on that agency” (ibid., para. 57). The Circuit Court finds that, by analogy, the appellant’s request for information—as a member of the Riigikogu—regarding whether the ministry has published materials concerning the WHO pandemic agreement cannot be considered the implementation of the EU’s common foreign policy. 3-24-2146 11(13 ) 17. Section 2(2) of the Public Information Act provides that the Public Information Act and the Public Information Management Act apply to constitutional institutions to the extent that this does not interfere with the performance of their constitutional duties and is not regulated by specific laws applicable to them. The Circuit Court agrees with the Administrative Court that the publication of a telephone conversation with a ministry official, along with the official’s personal data, on a Member of the Riigikogu’s personal Facebook account cannot be considered the performance of a constitutional duty by the Riigikogu or its member. The Administrative Court has correctly explained that this cannot be considered part of parliamentary oversight, as parliamentary oversight is exercised over officials bearing political responsibility and may result in a vote of no confidence against a minister, but not in the supervision of the performance of official duties by any officials of the ministry. Although it follows from the European Court of Justice’s judgment in Case C-33/22 that parliamentary activity is not of a nature that would automatically fall outside the scope of the IKÜM, there is no need in the present case to examine the compatibility of IKS § 2(2) with EU law, as this is not necessary for the proper resolution of the case (the disputed activity cannot be regarded as the performance of the constitutional duties of the Riigikogu or its members). 18. Consequently, the Personal Data Protection Act (PDPA) and the Information System Act (ISA) apply to the disputed case of personal data processing. According to Article 5(1)(a) of the PDPA, the primary condition for the permissibility of personal data processing is its lawfulness; that is, there must be a legal basis for the processing. Pursuant to Article 6(1) of the IKÜM, the processing of personal data is lawful only if at least one of the conditions set forth in subparagraphs (a) through (f) of the same provision is met. 19. According to Article 6(1)(a) of the GDPR, the legal basis for the processing of personal data may be the data subject’s consent. This is a voluntary, specific, informed, and unambiguous expression of will by which the data subject, either in the form of a statement or through an action clearly indicating consent, agrees to the processing of personal data concerning him or her (Article 4(11) of the General Data Protection Regulation). At the end of the disputed phone call, C.L. clearly stated that he did not consent to the publication of the recorded call. Thus, the Administrative Court correctly concluded that, in the present case, the processing of personal data could not be based on the data subject’s consent as provided for in Article 6(1)(a) of the GDPR. The appellant’s argument that, since C.L. ended the phone call herself and, in the appellant’s view, behaved rudely, her consent is irrelevant, is unfounded. The GDPR does not in any way make the necessity of the data subject’s consent dependent on their behavior or actions at the time of giving consent. In and of itself, the processing of personal data may be permissible without the data subject’s consent, e.g., for journalistic purposes, if there is a public interest and it is in accordance with the principles of journalistic ethics (see IKÜM Art. 85(1) and IKS § 4). However, the Administrative Court correctly found that this is not the case here. Nor has the appellant claimed that C.L.’s personal data was processed for journalistic purposes. 20. The appellant argues that, where the GDPR applies, the legal basis for processing personal data is derived from Article 6(1)(e) of the GDPR. According to this provision, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It follows from Article 6(3) of the GDPR and Recital 45 that if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the legal basis for the processing must be laid down in Union or Member State law. The Administrative Court correctly noted that, therefore, Article 6(1)(e) of the GDPR does not constitute an independent legal basis for the processing of personal data without a supplementary relevant provision of EU or Estonian law. The Circuit Court agrees with the Administrative Court that the RKKTS and the RKLS do not provide the appellant with a legal basis for processing the personal data of a ministry official. As the Administrative Court noted, the RKKTS provides that, as a rule, only Riigikogu sessions and transcripts are public (RKKTS § 59(1), § 61(2)), but not, for example, the sessions of standing committees (RKKTS § 36(3)). Thus, it does not follow from the provisions of the RKKTS that officials’ responses to any inquiry from a member of the Riigikogu are automatically subject to disclosure. Nor does the basis for processing personal data arise from § 20 of the RKLS, as cited by the complainant. As the Administrative Court explained, this provision provides a member of the Riigikogu with a legal basis to address state and local government agencies and their officials and to receive from them, within a relatively short 3-24-2146 12(13 ) responses within the deadline. However, the right to obtain information does not automatically confer the right to process the personal data contained therein. The provisions of § 36(1)(5) and (6) of the Public Information Act cited by the complainant are also irrelevant, as they primarily concern the right to obtain certain information. In the present case, the information has not been designated for internal use; rather, the question is whether the information provided to the complainant may be processed together with the personal data of the official. The Circuit Court notes, however, that pursuant to § 36(1)(6) of the Public Information Act, the prohibition on designating information for internal use does not extend to special categories of personal data or to personal data whose disclosure would infringe upon the data subject’s right to privacy. The Circuit Court does not agree with the appellant that the lack of a legal basis for processing personal data under Article 6(3) of the IKÜM unreasonably restricts the appellant’s work as a member of the Riigikogu. As the Administrative Court and the Data Protection Inspectorate have explained, the appellant is not, in and of itself, prohibited from disclosing the content of a telephone conversation and thereby obtaining and sharing information on topics of public interest, but this must be done without disclosing the personal data of the official. 21. T h e Administrative Court correctly held that the AKI also has supervisory authority over the activities of members of the Riigikogu (see European Court of Justice judgment of January 16, 2024, Case C-33/22, paras. 71–72), and the issuance of a precept by the AKI does not violate the appellant’s immunity as a member of the Riigikogu nor prevent the appellant from performing his duties as a representative of the people. The Supreme Court has clarified that “the immunity of a member of the Riigikogu generally consists in the prohibition on applying certain coercive state measures against a member of the Riigikogu or on doing so without prior or subsequent review by a decision-maker independent of the authority applying the measure,” but at the same time, “the principles of a democratic state governed by the rule of law and the legality of state power, as well as fundamental rights, do not permit the institution of immunity to render members of the Riigikogu immune from punishment or to grant them rights that disproportionately harm public order or the rights and interests of other persons” (Decision No. 3-4-1-54-13 of the Constitutional Review Chamber of the Supreme Court, February 17, 2014, para. 39). Thus, the immunity of a member of the Riigikogu does not mean that a member of the Riigikogu should, by virtue of their position, have broader rights than other people. In the appeal, the appellant has referred to § 18(5) of the Riigikogu Act, pursuant to which a member of the Riigikogu may not be compelled to participate in administrativeand civil court proceedings or in misdemeanor proceedings, nor may they be subject to compulsory attendance, if this hinders the performance of the duties of a member of the Riigikogu. The explanatory memorandum to draft Act 396 SE amending the Riigikogu Members’ Status Act and other acts4 states the following: “A member of the Riigikogu requires immunity protection for the free and constitutional exercise of their mandate not in all cases, but only against procedural actions that infringe upon the rights necessary for the unimpeded exercise of their mandate. The latter may include, for example, a prohibition on leaving one’s place of residence, detention (arrest), arrest, search, and covert monitoring of electronic communications.” Legal literature has held that, regarding participation in administrative, civil court, or misdemeanor proceedings and the subjection to procedural actions, the term “work of the Riigikogu” should be interpreted narrowly, based primarily on § 47 of the RKKTS (see the annotated edition of the Constitution5, 2020, § 76, commentary no. 8). § 47 of the RKKTS sets forth the Riigikogu’s work schedule. In the Circuit Court’s view, the term “performance of the duties of a member of the Riigikogu” within the meaning of § 18(5) of the RKLS, i.e., it is primarily intended that participation in the proceedings should not prevent a member of the Riigikogu from participating in the work of the Riigikogu and performing the acts necessary for the performance of their duties. The Circuit Court does not find that such a situation exists in the present case. The AKI has not imposed any obligations on the appellant that would force him to be physically absent from the work of the Riigikogu. 22. The party against whom the judgment is rendered shall bear the costs of the proceedings (HKMS § 108(1)). A third party’s litigation costs shall be reimbursed by the opposing party in accordance with the same rules as apply to a party (HKMS § 108(8)). The prerequisite for awarding litigation costs against the opposing party is the submission of a list of litigation costs and supporting documents (HKMS § 109(1)). Since 4https://www.riigikogu.ee/tegevus/eelnoud/eelnou/5e1129a1-28ed-42f4-831c-4e24816813d8/ 5https://pohiseadus.ee/ 3-24-2146 13(13 ) the appeal is dismissed and the respondent and the third party have not filed a claim for reimbursement of litigation costs, the parties to the proceedings shall bear their own potential litigation costs. 23. In the decision to be published, the names of the appellant and C.L. shall be replaced with an asterisk (HKMS § 175(3)). (digitally signed)
