Article 8 - Protection of personal data
Key facts of the case:
The police conducted a criminal procedure that concerned the applicant. This prosecution applied for a surveillance order and according to the order, the applicant's mobile phone was wiretapped from 27 October 2010 until 26 November 2010. In July 2012, the criminal procedure was suspended as it was found that there were no grounds for it. In January 2014, the applicant was informed of the wiretapping and the collected information was presented to the applicant. The applicant requested access to the whole file of the criminal procedure on the basis of Article 19 of the Personal Data Protection Act (PDPA); he was denied access to it by both the Police and Border Guard Board (PBGB) and the Public Prosecutors Office. The file had been archived, access to the file had been restricted, and it had been classified as internal in accordance with the Article 34 and Article 35 para 1 p. 1 of the Public Information Act (PIA). The applicant claimed that the PDPA allowed restrictions to the personal data only based on Article 20. According to this Article, access to the data can be restricted to any applicant if this may: “1) damage rights and freedoms of other persons; 2) endanger the protection of the confidentiality of filiation of a child; 3) hinder the prevention of a criminal offence or apprehension of a criminal offender; 4) complicate the ascertainment of the truth in a criminal proceeding.”
Two lower levels of the court came to differing views on how to interpret the right to access private data and which are the permissible grounds for limiting this right and which law to apply in such a case. They used different legal grounds (PDPA or PIA) as the basis of their arguments.
The claimant appealed the decisions of the Police and Border Guard Board (PBGB) and the lower instance courts in the Supreme Court and relied on Article 19 of the PDPA; he requested to have access to the criminal file including his personal information. The applicant was not a suspect or accused person in the criminal proceedings, however, there is no doubt that the criminal file included personal information about the applicant.
Outcome of the case:
The Supreme Court decided that access to the personal information is regulated by the Personal Data Protection Act. The fact that the data has been restricted as internal does not influence the right of the person to get access to the personal information collected about him. The Supreme Court admitted that the legal regulation on access to the data collected during the criminal procedure could be more extensive and clear, also taking into account the Directive (EU) 2016/680.
Protection of the personal information is covered by Article 8 para 1 of the Charter of Fundamental Rights. This right includes at its core the right to access to personal information. Only law can limit the right to access to information on the grounds enumerated in Article 44 para 3 of the Constitution. These grounds cannot be interpreted widely.
As the PBGB had not analysed all the grounds for limiting access to the file as required by the Article 20 of the PDPA, the Supreme Court ordered that the application is reviewed and re-decided by the PBGB in light of the interpretation to the law as provided by the Supreme Court.
21. Protection of natural persons when processing personal data is a fundamental right. Article 8 of the Charter of Fundamental Rights of the European Union, paragraph 1 stipulates that everyone has the right to protection of personal data. This fundamental right is an integral part of the data subject's right of access to personal data. Under Article 44 para 3 of the Constitution, an Estonian citizen has a legal right of access to the private data collected by the state agencies and local governments, and the data kept in state and local government archives. The data subject's right of access to personal data may be restricted only by law and on the basis of Article 44 para 3 of the Constitution, i.e., this right “may be circumscribed pursuant to law to protect the rights and freedoms of others, to protect the confidentiality of a child’s filiation, and in the interests of preventing a criminal offence, apprehending the offender, or of ascertaining the truth in a criminal case.” Restrictions embedded in the law must be based on the aforementioned constitutional objectives and be proportionate and necessary in a democratic society. The limits to the data subject's right of access to personal data are contained in the Article 20 of the Data Protection Act.
21. Füüsiliste isikute kaitse isikuandmete töötlemisel on käsitatav põhiõigusena. Euroopa Liidu põhiõiguste harta artikli 8 lõikes 1 on sätestatud, et igaühel on õigus oma isikuandmete kaitsele. Selle põhiõiguse lahutamatuks osaks on andmesubjekti õigus tutvuda isikuandmetega. Põhiseaduse § 44 kolmanda lõike kohaselt on Eesti kodanikul õigus seaduses sätestatud korras tutvuda tema kohta riigiasutustes ja kohalikes omavalitsustes ning riigi ja kohalike omavalitsuste arhiivides hoitavate andmetega. Andmesubjekti õigust tutvuda isikuandmetega saab piirata üksnes seadusega ning PS § 44 lg‑s 3 sätestatud alustel, s.o teiste inimeste õiguste ja vabaduste ning lapse põlvnemise saladuse kaitseks, samuti kuriteo tõkestamise, kurjategija tabamise või kriminaalmenetluses tõe väljaselgitamise huvides. Seaduses sätestatavad piirangud peavad tuginema eelnimetatud põhiseaduslikele eesmärkidele ning olema demokraatlikus ühiskonnas proportsionaalsed. Andmesubjekti isikuandmetega tutvumise õiguse piirangud sisalduvad isikuandmete kaitse seaduse §‑s 20.
