Answer to request

1

Geili Keppi - AKI

Teema: RE: Kind request for information

From: Geili Keppi - AKI Sent: Wednesday, December 10, 2025 5:24 PM To: 'Direcția relații externe' <[email protected]> Subject: RE: Kind request for information Dear Zoia, Thank you for your request and patience, the response has taken longer than usual. I will answer the questions in the order which they were submitted:

1. Retention of log files Estonia does not have a universally regulated period for retaining log files. The duration of the retention of logs depends on the law or statute governing the specific information system, the applicable security requirements, as well as the General Data Protection Regulation (GDPR). If important circumstances concerning a database are not regulated by law, then the management of the database must be regulated by statute.

The general principle is that logs must be kept for as long as necessary to detect, investigate and ensure the rights of the data subjects, but not longer than required for that purpose. The retention period must be justified by the need to detect and investigate security incidents. In its guidelines on databases (available only in estonian: andmekogude_juhend.pdf), the Data Protection Inspectorate (DPI) lists important aspects that should be regulated by statute if not already covered by law. Among other things, the statute must include an exhaustive list of data collected in the database, data sources, recipients of data from the database and the conditions for obtaining data, logging of operations performed with database data (in particular, insertion, modification, deletion, viewing, transmission) and retention periods for logs. For example, § 8 of the Population Register Act, which regulates the Estonian Population Register, states that data entered in the Register are preserved permanently, except data on access to data which are preserved for five years. Reference to the web-link to this Act (English version): Population Register Act–Riigi Teataja.

2. Access to criminal case files In Estonia, the DPI does not have a general right to access criminal case files independently. The Prosecutor’s Office and the courts supervise criminal proceedings. Section 16 of the Code of Criminal Procedure provides that the proceedings authorities are the court, the Prosecutor’s Office and the relevant investigative authority. Sections 214 and following strictly regulate the disclosure of criminal files and access rights: files are accessible to the parties to the proceedings, the Prosecutor Office and the court. The DPI is not among the authorities referred to in

2

the Code of Criminal Procedure and The DPI has no right to interfere with the activities of the court in the administration of justice. Reference to the web-link to this Act (English version): Code of Criminal Procedure–Riigi Teataja

3. Video-surveillance inspections If a video-surveillance system operator claims that a camera did not function or refuses to cooperate, the DPI has the right and competence to carry out an on-site inspection to verify the presence and functioning of the devices.To this end, we can involve technical experts, if necessary. However, due to the inspectorate’s high workload, resources and activities must be carefully planned. The need for on-site inspections is decided case by case, depending on the circumstances. In the case of cameras, the complexity of supervision must be considered, as it is always possible to change a camera’s field of view or remove it before on-site inspection. I hope that you will find this answer helpful. If you have any further questions, do not hesitate to contact again. Best wishes, Geili Keppi Lawyer [email protected] 627 4141 FOR DATA PRIVACY AND FREEDOM OF INFORMATION Tatari 39 | 10134 Tallinn | Estonia LinkedIn | YouTube

Republica Moldova