Vastus teabenõudele

22.02.2019 Euroopa Komisjon 11.03.2019 Our ref. 7-2/1429 JUST-GDPR-ART93- [email protected]> General Data Protection Regulation Notification Letter Allow me to give an overview of the state of play on the implementation of the reform in Estonia. The Personal Data Protection Act came into force on the 15.01.2019 and The Personal Data Protection Acts Implementation Act came into force on 20.02.2019. Concerning the obligation to notify the Commission on the provisions:  on data protection authorities (Article 51(4) GDPR) – article 32 of The Personal Data Protection Act states, that data protection authority is the Supervisory Authority (Data Protection Inspectorate);  on penalties (Article 84(2) GDPR) – it is regulated in the chapter 6 of The Personal Data Protection Act;  on reconciling the right to data protection with the right to freedom of expression and information (Article 85(3) GDPR) – article 5 of The Personal Data Protection Act states, that personal data may be processed without the consent of the data subject for the purpose of academic, artistic and literary expression, in particular disclosed if this does not cause excessive damage to the rights of the data subject. I would also like to notify you in accordance with the obligations provided for in the GDPR. 1) The processing of personal data in the employment context (Article 88 (3) GDPR) Personal Data Protection Act does not provide separate rules in this regard. The current Employment contracts Act (article 41 (2)) states, that an employer shall ensure the processing of personal data of an employee in accordance with the Personal Data Protection Act. 2) The obligation of secrecy (Article 90 (2) GDPR) Personal Data Protection Act does not provide separate rules in this regard. The current Penal Code article 157 states, that disclosure of information obtained in the course of professional activities by a person who is required by law not to disclose such information, if this does not contain the necessary elements of an offence provided for in § 1571 of this Code, is punishable by a fine of up to 300 fine units. 2) Limitations to the transfer of specific categories of data for important reasons of public interests (Article 49 (5) GDPR) The Personal Data Protection Act article 48 provides limits to the transfer of specific categories of personal data to a third country or an international organization. Ministry of Justice/ Suur-Ameerika 1/ 10122 Tallinn / ESTONIA/ +372 620 8100 /fax +372 620 8109/ [email protected] / www.just.ee Reg.no 70000898 3) Other legal remedies instead of administrative fines under Article 83(9) (concerns DK and EE in accordance with recital 151) In Estonia, fines are imposed by the Supervisory Authority (Data Protection Inspectorate). The regulations on fines can be applied in such way, that fines are imposed by the supervisory authority in the context of misdemeanor proceedings, provided that the application of the regulations in those Member States has the same effect as fines imposed by the supervisory authority. The fines are stated in articles 62-72 of the Personal Data Protection Act. Kind Regards Marii-Liisi Makara Adviser Marii-Liisi Makara 620 8182 [email protected]  Urmas Kukk Teie 26.10.2022 Advokaadibüroo KPMG Law OÜ Meie 01.11.2022 nr 2-6/22-7499-3 [email protected] Vastus teabenõudele Edastame soovitud dokumendid. Lugupidamisega (allkirjastatud digitaalselt) Kristel Niidas nõunik Lisad: 1. General Data Protection Regulation Notification Letter 01.08.2018 nr 7-2/3820 2. General Data Protection Regulation Notification Letter 11.03.2019 nr 7-2/1429 [email protected] Suur-Ameerika 1 / 10122 Tallinn / +372 620 8100 / [email protected] / www.just.ee Registrikood 70000898