Answer to request

Dear Line Fensten Jørgensen

As I implied, Estonian DPI conducts oversight in cases of electronic communications mostly in combination of General Data Protection Regulation (GDPR). When processing personal data, the controller shall ensure that the data processing is lawful, fair and transparent to the data subject (GDPR article 5 (1) a). It is also important that persons are not provided misleading information concerning the processing of data. 

The Data Protection Inspectorate has the right to issue a proposal on electronic communications with the imposition of a penalty payment each time if the submitted proposal is not responded to (for example cases about cookies etc). I can’t describe the exact procedure, cause every case is different and unique. It is important to know that the procedure is carried out in accordance with the legislation. Proposals are directed to data processors who are responsible for the data being processed (companies who use cookies etc).

As I said, until we have better legal framework about acceptable penalties, the Estonian DPI has taken an approach that seeks to strongly advise and guide companies and institutions in the event of violations of data protection requirements, rather than to apply immediate punishment. Punishment is not a main goal. Rather, it is a good and necessary tool for maintaining order when a legitimate need arises and nothing but financial punishment help.

Kind regards

Dear Liina Kroonberg,

Thank you for your response, it is much appreciated.

Regarding the Data Protection Inspectorates right to issue a proposal with the imposition of a penalty payment, can you please elaborate on the procedure when these are issued and to whom the proposals are directed.

Kind regards,

Line Fensten Jørgensen
Office for Digital Regulation and Supervision

M  +45 21 67 30 14
E   [email protected]

www.digst.dk - fordi hverdagen er digital

Please be aware that the Agency of Digital Government, upon receiving your message, processes the personal data about you that is included in the message. This is done as part of the Agency of Digital Government's exercise of authority. You can read more about how the Agency of Digital Government processes your personal data, and what rights you have as a data subject, in the agency's privacy policy at https://en.digst.dk/about-us/about-endigstdk/privacy-policy/