Andmekaitsespetsialisti määramine

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST Pauline Pasquer Yours: 20.02.2025 Lawways [email protected] Ours: 05.03.2025 nr 2.2-9/25/601-2 Answer to request The Data Protection Inspectorate (EDPI) received your questions about registering data protection officer (DPO) in Estonia. Firstly, does the notice of appointment of a DPO in EDPI have to be in Estonian or can it be done in English as well. You also ask that if the notification cannot be made through the e-Business Register, then do you have to contact EDPI, and if so, what is the notification procedure. The General Regulation on the Protection of Personal Data (GDPR) stipulates a number of rules to which a data protection officer (DPO) must comply. Whether the company's data protection officer meets these conditions, including being able to provide Estonian-speaking data subjects with the necessary information and service, must be known by each company responsible (controller). In some cases, the notification to EDPI can also be done in English. However, we emphasize that DPO must be able to communicate with both, data subjects and EDPI, in Estonian. Companies must prepare appropriate data protection documentation (including privacy policy) in Estonian for Estonian data subjects before data processing if the service is aimed at Estonian residents. However, if the company is able to fulfill all relevant requirements (including communication in Estonian) with a group-wide data protection officer, for example, then the inspectorate sees no reason why companies should not be assign a group-wide (non-Estonian- speaking) data protection officer. Company must be able to comply with the GDPR. In any case, the controller i.e. the company, is responsible for violations related to data processing, not the DPO. Which is why it is always worth considering the decisions more thoroughly (including whether the appointed DPO provides the service required at the local level) and choose a DPO who will really help the company. We also note that the Data Protection Inspectorate accepts DPO appointment notices if: 1) the notice has been signed digitally or by hand by an authorized person, a company´s manager etc., or a person entered in the business register as a representative of the company/institution, or 2) if the signer acts on the basis of authorization, the notification is accompanied by a power of attorney signed by the person entitled to represent. At the same time, a person entitled to represent one company/institution cannot submit a report about another company/institution without authorization - even if he is the linked company or a higher- ranking institution. Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235 As a result of the above, if necessary, a (signed) notification about the appointment of a data protection officer can be forwarded to the inspectorate. The data protection officer becomes the contact person of his employer in communication with inspectorate. To identify DPO, we need his personal identification number or date of birth and citizenship (in addition to the date of appointment, the name of the data protection officer and contact details). If there is no deadline, we assume that the data protection officer position is without the term. Although you have already referred to it, we note that the easiest way to report a DPO in Estonia is to do it through the entrepreneur portal. In this case, it is no longer necessary to send a separate notification to the EDPI. The notice can be entered by a person registered as a representative in the e-business register. If it is not possible to make a notification in the e-business register, it can be forwarded to EDPI by e-mail to a address [email protected]. The inspectorate will send a separate reply, either to clarify the data or to notify that the notice of DPO has been noted by EDPI. You have the opportunity to read relevant information on the website of the EDPI (however, it is mostly in Estonian): - Andmekaitsespetsialisti määramisest; - Andmekaitsespetsialisti ülesanded, teadmised ja oskused. - Isikuandmete töötleja üldjuhendi 3. peatükk. Explanations in English are published here: https://www.aki.ee/en/inspectorate-news- information-dpo-s/information-dpo-s. Hope my explanations are helpful. Best regards Liina Kroonberg lawyer authorized by Director General 2 (2) Data Protection Inspectorate Tatari Tn, 39 10134 Tallinn Estonia Paris, May 19th, 2025, Subject: Notification of Appointment of Data Protection Officer Dear Sir/Madam, We have been duly appointed as the official point of contact for all data protection matters related to the designating company and are authorized to communicate directly with the Estonian Data Protection Inspectorate and with data subjects, in compliance with applicable EU data protection law. We hereby notify the Estonian Data Protection Inspectorate of our appointment as external Data Protection Officer (DPO) on behalf of our Client, AdaCore OÜ, in accordance with Article 37 of the General Data Protection Regulation (EU) 2016/679 (GDPR). The following information is provided in support of this notification: 1. Entity Designating the Data Protection Officer (DPO) - Registration Number: 14485372; - Corporate Name: AdaCore Estonia OÜ ; - Address: Abara tn 19, Haabersti linnaosa, 13516 Tallinn, Harju Maakond, Estonia ; - Country: ESTONIA ; - Number of Employees : 50-99 ; - Legal Representative of the Designating Entity: Mr. Tõnu Näks ; - Position: Managing Director of AdaCore Estonia; - Email Address: [email protected] - EDPI Contact Person: Mr. Tõnu Näks; 2. Information Concerning the Data Protection Officer (DPO) - Registration Number: 489534479 ; - Corporate Name (legal entity): LAWWAYS ; - Address: 5, Rue La Boétie, 75008 PARIS ; - Country : FRANCE ; - Field of Activity: Law firm; - Contact : +330143181650 ; www.lawways.com 5, rue La Boétie, 75008 Paris – +33 (0) 1 43 18 16 50 – [email protected] SELARL au capital de 12.000 euros – RCS Paris 489 534 479 – Toque G0076  Contact Details of the Legal Representative of the Appointed DPO Entity - Last Name: ROUVIER ; - First Name: Gilles ; - Email Address: [email protected] ; - Telephone Number: +33(0)660947953 3. Contact Information - Address: 5, Rue La Boétie, 75008 PARIS (France) - Email Address: [email protected]. Yours sincerely, Gilles Rouvier Attorney at law – Paris Bar Encl. Copy of the Power of Attorney signed by the undersigned M. Tonu Naks www.lawways.com 5, rue La Boétie, 75008 Paris – +33 (0) 1 43 18 16 50 – [email protected] SELARL au capital de 12.000 euros – RCS Paris 489 534 479 – Toque G0076 Docusign Envelope ID: E26F9534-A3DA-45D3-810E-3C205B33C865 Mäealuse 2/1 12618 Tallinn ESTONIA +372 600 3400 [email protected] www.adacore.com Power of Attorney Subject: For the Appointment Notification of a Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate I, the undersigned, Mr. Tonu Naks, acting in my capacity as Director of AdaCore Estonia OÜ, a company incorporated under the laws of Estonia, with its registered office at Mäealuse 2/1, 12618 Tallinn, Estonia and registered under number 14485372, hereby grant full power and authority to: Gilles Rouvier, Attorney, Lawways Avocats, 5 rue La Boétie, 75008 Paris, FRANCE Email: [email protected] to act on behalf of the Company solely for the purpose of notifying the appointment of the Company’s Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate (EDPI), and to carry out all necessary steps in relation thereto, including, without limitation, the provision of any required information and documentation, and to communicate with the EDPI as may be required in the context of such notification. This Power of Attorney shall remain in force until the notification has been duly submitted and acknowledged, or until expressly revoked in writing. Executed in Tallinn, on April 24th, 2025 Mr. Tonu Naks Director Saatja: "Pauline Pasquer" <[email protected]> Saaja: "info - AKI" <[email protected]> Teema: RE: Information on DPO designation Kuupäev: 2025-05-20 13:33 Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga. Tundmatu saatja korral palume linke ja faile mitte avada. Dear Sir or Madam, I am contacting you to inform you that the company AdaCore Estonia OU, as appointed the law firm LAWWAYS, managed by M. Gilles Rouvier, attorney at law (Paris Bar), as DPO in Estonia. Please kindly find attached a letter containing the information requested to proceed to this appointment before the Estonian Data Protection Inspectorate (as per the information you provided us in your letter dated 05.03.2025, attached for reference), and the POA signed by our client. Please kindly confirm reception of our email. Best regards, Pauline PASQUER / Gilles ROUVIER Pauline Pasquer - Avocate au Barreau de Paris <mailto:[email protected]> [email protected] 5, rue La Boétie, 75008 Paris - France <https://urlsand.esvalabs.com/?u=http%3A%2F%2Fwww.lawways.com%2F&e=4f1cb2e8&h=d364627d&f=n&p=y> www.lawways.com +33 (0)1 43 18 16 50 Recommended by: Legal 500 EMEA - Who’sWhoLegal - Leaders League - Best lawyers - Chambers - GDR 100 CONFIDENTIEL - PRIVILEGED & CONFIDENTIAL | This message contains privileged & confidential information. If you have received it although you were not the intended recipient, you must destroy it immediately, without keeping any copy, nor disclosing or transmitting it to any other person. - Message confidentiel protégé par le secret professionnel des avocats. De : Pauline Pasquer <[email protected] <mailto:[email protected]> > Envoyé : jeudi 20 février 2025 12:20 À : '[email protected] <mailto:[email protected]> ' <[email protected] <mailto:[email protected]> > Cc : Gilles Rouvier <[email protected] <mailto:[email protected]> >; Mathilde Lécaillon <[email protected] <mailto:[email protected]> > Objet : Information on DPO designation Dear Sir or Madam, I am contacting you regarding the designation of a Data Protection Officer (DPO) with your authority. Please find attached a letter outlining our inquiries in detail. We remain available for any further information you may require and thank you in advance for your attention to our request. We look forward to your response and remain at your disposal. Best regards, Pauline PASQUER / Gilles ROUVIER Pauline Pasquer - Avocate au Barreau de Paris <mailto:[email protected]> [email protected] 5, rue La Boétie, 75008 Paris - France <https://urlsand.esvalabs.com/?u=http%3A%2F%2Fwww.lawways.com%2F&e=4f1cb2e8&h=d364627d&f=n&p=y> www.lawways.com +33 (0)1 43 18 16 50 Recommended by: Legal 500 EMEA - Who’sWhoLegal - Leaders League - Best lawyers - Chambers - GDR 100 CONFIDENTIEL - PRIVILEGED & CONFIDENTIAL | This message contains privileged & confidential information. If you have received it although you were not the intended recipient, you must destroy it immediately, without keeping any copy, nor disclosing or transmitting it to any other person. - Message confidentiel protégé par le secret professionnel des avocats.