Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST [email protected] Yours: 07.02.2025 Ours: 28.02.2025 nr 2.2-9/25/453-2 Answer to request Estonian Data Protection Inspectorate (EDPI) received Your letter. EDPI explains that Estonian Electronic Communications Act do not apply to calls1, so we can´t talk about previous consent and legal basis has to come from another act. We can assume, not knowing all the facts and without any official documents about the data processing, that the legal basis for making such calls and storage referred data can be legitimate interest arising from GDPR2. As legitimate interest is almost always debatable, its use must be understandable to all the subjects and documented. It should be noted that if the data processing results from some specific law (for example, the accounting act), then it is not appropriate to refer to it on the basis of legitimate interest. The data subject must know that he has, in any case, the right to object to the processor3 to the processing of his data and to prohibit further calls. As I said, data processing on legitimate interest 4 can be one of the legal basis. Legitimate interest requires for the controller to properly assess and conduct the balancing test (legitimate interest analysis). Controller in this case needs to have real and present interests. Interests that are too vague or speculative will not be sufficient. EDPI cannot confirm whether, at this case, the business interests overweigh the data subjects rights by default due to the fact the decision to process personal data on the basis of legitimate interest requires an in-depth analysis in every specific case. All things considered, it is necessary that data processor knows on what basis is personal data processed (collected, storaged etc). Also, regarding your request for confirmation of the application of this provision in the given cases, we explain that the EDPI has the obligation to provide legal explanations about the legislation and the competence of the institution that is the basis of the inspectorate's activities. Providing legal explanations does not mean providing legal assistance. Providing legal explanations is when the content and meaning of a specific law, a specific section, a specific paragraph, a specific point is explained. Legal aid is when a legal assessment is given regarding 1 EECA §-s 1031 paragraph 1 2 GDPR art. 6 paragraph 1 p f 3 GDPR art 21 4 GDPR art 6 paragraph 1 p f Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235 some specific vital circumstances. The Inspectorate does not provide legal assistance. Since your letter is not only a request for clarification, we cannot give you full requested answer (confirmation regarding specific cases) aswell. I hope my explanations are helpful. Best regards Liina Kroonberg Lawyer authorized by Director General 2 (2)