To: Dr. Priya E. Abraham
[email protected] Your: 29.11.2018 Our : 1 8 . 12 .201 8 , n o 3 . 1 . - 3 /1 8 / 3 2 07 Please find our answers to your questions: 01 Required regulations and directives Which regulations other than the GDPR are nomads and entrepreneurs incorporated in Estonia required to following? E.g. PECR, e-Directive, the California Privacy Act? Please list all necessary regulations and guidelines, which Estonian entrepreneurs must comply with. General Data Protection Act is implemented with Estonian Personal Data Protection Act and with its implementing act ( a set of sector specific acts – around 127 acts are changed ). The Personal Data Protection Act was enacted by the Parliament on December 12th this year and it shall come into force on 15.01.2019 . The implementing act are still in the Parliament. Unsolicited e lectronic marketing (spams) is regulated by the Electronic Communications Act . 02 Regulation vs. directive in Estonia By when do you expect to have the Estonia Directive in place? Until the installation of the document should Estonians enterprises, including digital nomads who, in their role of Estonian e-citizens, have incorporated a business in Estonia follow the Regulation? If so, how would you inform them about the installation of the Directive? What additional information will be made available for them? Please see the previous answer. 03 Data breach Digital nomads, founders, and entrepreneurs, incorporated in Estonia would need to inform people affected by a potential data breach and report the data breach to the AKI. What process have you got in place, if any? What actions should business holders take to inform you appropriately? What format do you require? Which communication channel do you prefer? We have issued guidance about data breaches: https://www.aki.ee/et/juhised/isikuandmete-tootleja-uldjuhend . Th e electronic form for notification is available at our webpage: https://www.aki.ee/et/poordu-inspektsiooni-poole/rikkumisteate-edastamine 04 Records for processing activities What does the AKI accept as appropriate format for the records for processing activities; e.g. Github or Gitlab exports, Excel or Word document, or other? An appropriate electronic format is for data controllers to decide. 05 Physical devices In case of a lost or stolen device that holds personal data, in what format should Estonian business holders report the incident to the AKI? It is a data breach notification, see the answer no 3 . 06 Unsolicited marketing emails In case of receipt of unsolicited marketing emails where and how can Estonian business holders report these nuisance mails? E.g. the ICO (UK) offers a registration portal for nuisance messages. Unsolicited marketing emails (spam) is regulated by the Electronic Communications Act. A person has a right to make a complaint to the Data Protection Inspectorate. 07 Registration duty/option Do organisations incorporated in Estonia have to register at the AKI? Is there a membership fee? What service do you offer in return? The organisations (data controllers) have to notify about the appointment of a data protection officer . The notification is free of charge. 08 DPIA Can entrepreneurs submit their DPIA and have the residual risk and suggested measures evaluated by the AKI? Inspectorate has provided guidance on data protection impact assessment and prior consultation: https://www.aki.ee/et/juhised/isikuandmete-tootleja-uldjuhend . If the controller has a residual risks (after making the DPIA), then it has a right to contact with the inspectorate for prior consultation. If you have any additional questions, please do not hesitate to contact. Yours sincerely, Maarja Kirss Co-operation Director authorized by Director General