Answer to request

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / registrikood 70004235

[email protected]

Yours: 07.02.2025 Ours: 28.02.2025 nr 2.2-9/25/453-2

Answer to request Estonian Data Protection Inspectorate (EDPI) received Your letter.

EDPI explains that Estonian Electronic Communications Act do not apply to calls1, so we can´t

talk about previous consent and legal basis has to come from another act.

We can assume, not knowing all the facts and without any official documents about the data

processing, that the legal basis for making such calls and storage referred data can be legitimate

interest arising from GDPR2. As legitimate interest is almost always debatable, its use must be

understandable to all the subjects and documented. It should be noted that if the data processing

results from some specific law (for example, the accounting act), then it is not appropriate to refer

to it on the basis of legitimate interest.

The data subject must know that he has, in any case, the right to object to the processor3 to the

processing of his data and to prohibit further calls.

As I said, data processing on legitimate interest4 can be one of the legal basis. Legitimate interest

requires for the controller to properly assess and conduct the balancing test (legitimate interest

analysis). Controller in this case needs to have real and present interests. Interests that are too

vague or speculative will not be sufficient. EDPI cannot confirm whether, at this case, the

business interests overweigh the data subjects rights by default due to the fact the decision

to process personal data on the basis of legitimate interest requires an in-depth analysis in

every specific case.

All things considered, it is necessary that data processor knows on what basis is personal data

processed (collected, storaged etc). Also, regarding your request for confirmation of the

application of this provision in the given cases, we explain that the EDPI has the obligation to

provide legal explanations about the legislation and the competence of the institution that is the

basis of the inspectorate's activities.

Providing legal explanations does not mean providing legal assistance. Providing legal

explanations is when the content and meaning of a specific law, a specific section, a specific

paragraph, a specific point is explained. Legal aid is when a legal assessment is given regarding

1 EECA §-s 1031 paragraph 1 2 GDPR art. 6 paragraph 1 p f 3 GDPR art 21 4 GDPR art 6 paragraph 1 p f

2 (2)

some specific vital circumstances. The Inspectorate does not provide legal assistance. Since your

letter is not only a request for clarification, we cannot give you full requested answer (confirmation

regarding specific cases) aswell.

I hope my explanations are helpful. Best regards

Liina Kroonberg

Lawyer

authorized by Director General