Estonia / Estonian Supreme Court / 3-22-1148

X. v Estonian Financial Intelligence Unit (Rahapesu andmebüroo)
Deciding body type
National Court/Tribunal
Deciding body
Estonian Supreme Court
Type
Decision
Decision date
21/03/2025
  • Estonia / Estonian Supreme Court / 3-22-1148

    key facts of the case:

    An individual submitted a request to the Estonian Financial Intelligence Unit for access to their personal data held by the Unit. The data pertained to suspicions of money laundering or terrorist financing. The Unit denied the access request, citing the need to protect the confidentiality of ongoing or potential investigations. The individual challenged this refusal through the Estonian court system. The case ultimately reached the Supreme Court, which identified a fundamental conflict between two competing legal principles rooted in EU law. The fundamental rights dimension of the case lies in the direct tension between an individual's right to access their personal data, a cornerstone of data protection under Charter Article 8, and the state's obligation to effectively combat serious crime and protect public security. The denial of access also implicates the right to an effective remedy under Charter Article 47, as without access to the data, the individual cannot effectively challenge its lawfulness or accuracy.  

    Key legal question raised by the court:

    The Supreme Court referred several questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling. The key legal questions were: 1. Does a Financial Intelligence Unit's processing of data for anti-money laundering (AML) purposes fall under the scope of the GDPR or the Law Enforcement Directive? 2. To what extent can national law restrict a data subject's right of access under Article 23 of the GDPR and Article 15 of the LED, and specifically, can access be lawfully denied until the data is statutorily destroyed? 3. Does a data subject have the right to a judicial remedy to challenge a decision by a supervisory authority that denies them access to their data? 

    Outcome of the case:

    The factual outcome at the national level is that the proceedings in the Supreme Court are stayed pending the preliminary ruling from the CJEU. The Supreme Court has not resolved the legal question itself but has instead determined that the issue requires an authoritative interpretation of EU law to ensure its uniform application. By referring the case, the Court acknowledges an ambiguity in how to balance the fundamental rights of data subjects with the operational needs of law enforcement and financial intelligence agencies under the EU's legal framework.

  • Paragraphs referring to EU Charter

    8. … Article 15 of the Charter of Fundamental Rights of the European Union (EU Charter) grants data subjects the right to obtain confirmation from the data processor as to whether their personal data is being processed, and to access such personal data. The same right is guaranteed to data subjects under Article 8(2) of the EU Charter.

    9.1. … The European Court of Justice explained in points 52-57 of the judgment in case C-175/20 - State Revenue Service that paragraph 41 of the clarification of the General Data Protection Regulation (GDPR) indicates that the reference to a "legislative measure" in that regulation does not necessarily mean that the adoption of a legislative act by the parliament is required. At the same time, according to Article 52(1) of the EU Charter, the exercise of rights and freedoms recognized by the Charter (including the right to respect for private and family life under Article 7 and the right to data protection under Article 8) can only be limited by law. The legal basis that authorizes such limitations must specify the extent to which they may be made. Consequently, all measures taken under GDPR Article 23 must be clear and precise, and their application must be foreseeable for legal subjects. Based on this, the European Court of Justice concluded in the specific dispute that the member state's tax authority cannot make exceptions to GDPR Article 5 where there is no clear and precise legal basis in EU or member state law, which is predictable for legal subjects and which delineates the circumstances and conditions under which the scope of obligations and rights under Article 5 may be limited.

    ...

    11.3. The EU Charter of Fundamental Rights (EU Charter) Article 8(1) and the Treaty on the Functioning of the European Union (TFEU) Article 16(1) stipulate that everyone has the right to the protection of their personal data. The recitals of Directive 2015/849 cite data protection principles. It also references Directive 95/46/EC, which is essentially the predecessor of GDPR. In Directive 2015/849, there cannot be a reference to the Law Enforcement Directive, as it was adopted later. Directive 95/46/EC Article 13 provided for proportionality restrictions. Therefore, member states already had an obligation to develop legal norms that limit data subject access, and such limitations must be proportionate.

    ...

    11.5. GDPR does not establish a lower obligation of justification for the restriction of data subject rights compared to the Law Enforcement Directive. On the contrary, GDPR Article 15 provides for an even broader right for data subjects to access their data. The European Court of Justice clarified in case C-175/20 (paragraphs 51-56) the requirements applicable when imposing restrictions under GDPR Article 23. The rights guaranteed by the EU Charter (Article 8) cannot be limited by individual acts under Article 52(1). The provisions of the Code of Criminal Procedure (CCP) § 60(1) do not meet the conditions set out in GDPR Article 23.

    ...

    22. … Article 41(2)(c) of the EU Charter obliges EU institutions to justify their decisions. Article 47(2) provides the right to a fair and public hearing. Concealing the reasoning of a judgment violates this fundamental right.

    ...

    29. The right to the protection of personal data is established as a fundamental right in the EU Charter Article 8. According to Article 52(1) of the EU Charter, the exercise of rights and freedoms recognized by the Charter can only be limited by law. The European Court of Justice explained in case C-175/20 (point 54) that the legal basis permitting restrictions of rights and freedoms guaranteed by the EU Charter must itself determine the extent to which such rights may be limited.

    ...

    30. Likewise, the restriction of access is objectively limited to all data held by the RAB. The European Court of Justice has found that the Law Enforcement Agencies Directive does not contradict the limitation of the retention period of biometric data and data of a person who has been finally convicted in criminal proceedings to his or her death (C-118/22 – Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia, paragraphs 67-69). In this case, the fundamental right provided for in Articles 7 and 8 of the ECHR is infringed on the basis of Article 4(1)(c) and (e), Article 5 and Article 10 of the Data Protection Directive. It is not clear to the Board what the same conclusion is if the said fundamental right is infringed on the basis of Article 15 of the Data Protection Directive.

  • Paragraphs referring to EU Charter (original language)

    8. … IKÜM art 15 annab andmesubjektile õiguse saada vastutavalt töötlejalt kinnitus, kas tema isikuandmeid töödeldakse, ning sellisel juhul tutvuda isikuandmetega. Samasugune õigus on andmesubjektile tagatud Euroopa Liidu põhiõiguste harta (ELPH) art 8 lg-s 2….

    9.1. … Euroopa Kohus on asjas C-175/20 - Valsts ieņēmumu dienests tehtud otsuse p-des 52-57 selgitanud, et IKÜM-i põhjendusest 41 tuleneb, et selles määruses sisalduv viide „seadusandlikule meetmele“ ei tähenda tingimata, et nõutav on seadusandliku akti vastuvõtmine parlamendis. Samas tuleneb ELPH art 52 lg-st 1, et hartaga tunnustatud õiguste ja vabaduste (sh art-ga 7 tagatud õigus eraelu puutumatusele ja art-ga 8 tagatud õigus isikuandmete kaitsele) teostamist võib piirata ainult seadusega. Õiguslik alus, mis võimaldab neid õigusi riivata, peab määrama, kui ulatuslikult seda tohib teha. Järelikult peavad kõik IKÜM art 23 alusel võetud meetmed olema selged ja täpsed ning nende kohaldamine peab olema õigussubjektidele ettenähtav. Sellest tulenevalt järeldas Euroopa Kohus konkreetses vaidluses, et liikmesriigi maksuhaldur ei või teha erandeid IKÜM art-s 5 sätestatust, kui liidu või liikmesriigi õiguses puudub selge ja täpne õiguslik alus, mille kohaldamine on õigussubjektidele ettenähtav ning milles on ette nähtud asjaolud ja tingimused, mille korral võib art-s 5 ette nähtud kohustuste ja õiguste ulatust piirata.

    ...

    11.3. ELPH art 8 lg-s 1 ja Euroopa Liidu toimimise lepingu art 16 lg-s 1 on sätestatud, et igaühel on õigus oma isikuandmete kaitsele. Direktiivi 2015/849 põhjenduses 46 on toodud andmekaitse põhimõtted. Seal on viidatud direktiivi 95/46/EÜ art-le 13. Direktiiv 95/46/EÜ on sisuliselt IKÜM-i eelkäija. Direktiivis 2015/849 ei saagi olla viidet õiguskaitseasutuste direktiivile, sest see on vastu võetud hiljem. Direktiivi 95/46/EÜ art 13 nägi ette piirangu proportsionaalsuse nõude. Niisiis oli liikmesriigil juba varem kohustus töötada välja andmesubjekti juurdepääsu piirav õigusnormistik, millest tulenev piirang peab olema proportsionaalne.

    ...

    11.5.  IKÜM-is pole sätestatud andmesubjekti õiguste piiramisel madalamat põhjendamiskohustust võrreldes õiguskaitseasutuste direktiiviga. Vastupidi, IKÜM art 15 näeb ette veelgi laiema andmesubjekti õiguse tutvuda andmetega. Euroopa Kohus on asjas C-175/20 (p-d 51-56) täpsustanud IKÜM art 23 alusel piirangute kehtestamisele kohalduvaid nõudeid. ELPH art-s 8 sätestatud õigust ei luba harta art 52 lg 1 piirata üksikaktiga. RahaPTS § 60 lg 1 ei vasta IKÜM art-s 23 sätestatud tingimustele.

    ...

    22. … ELPH art 41 lg 2 p c kohustab liidu enda asutusi oma otsuseid põhjendama. ELPH art 47 lg 2 näeb ette õiguse õiglasele ja avalikule kohtulikule arutamisele. Kohtuotsuse põhjenduste varjamine riivab seda põhiõigust.

    ...

    29. Õigus isikuandmete kaitsele on ELPH art-s 8 sätestatud põhiõigus. ELPH art 52 lg 1 kohaselt tohib hartaga tunnustatud õiguste ja vabaduste teostamist piirata ainult seadusega. Euroopa Kohus on asjas C-175/20 - Valsts ieņēmumu dienests tehtud otsuse p-s 54 selgitanud, et sellest tulenevalt peab õiguslik alus, mis võimaldab ELPH-iga tagatud õigusi ja vabadusi riivata, ise määrama selle, kui ulatuslikult tohib asjaomast õigust piirata. …

    30.  Niisamuti on juurdepääsupiirang esemeliselt piiratud kõigi RAB-il olemasolevate andmetega. Euroopa Kohus on leidnud, et õiguskaitseasutuste direktiiviga ei ole üldjuhul kooskõlas kriminaalkorras lõplikult süüdi mõistetud isiku biomeetriliste ja geneetiliste andmete säilitamise tähtaja piiritlemine üksnes tema surmaga (C-118/22 - Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia, p-d 67-69). Sellisel juhul riivatakse ELPH art-tes 7 ja 8 sätestatud põhiõigusi isikuandmete säilitamisega direktiivi art 4 lg 1 p-de c ja e, art 5 ja art 10 alusel. Kolleegiumi jaoks ei ole üheselt selge, kas järeldus on samasugune, kui nimetatud põhiõigusi riivatakse isikuandmetega tutvumisest keeldumisega direktiivi art 15 alusel.