ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
ASUTUSESISESEKS KASUTAMISEKS
Teabevaldaja: Andmekaitse Inspektsioon
Märge tehtud: 03.11.2022
Juurdepääsupiirang kehtib kuni: 03.11.2097
{accessRestrictionEndDesc}
Alus: AvTS § 35 lg 1 p 2, AvTS § 35 lg 1 p 12
Yours: 27.10.2022 nr
FINAL DECISION {senderRegNumber}
SA Poland Our: {regDateTime} nr
{regNumber}
Notice of termination of the proceedings concerning the protection of personal data
Estonian Data Protection Inspectorate received a complaint via IMI system against an
Estonian company, regarding complainant accessing and processing their
personal data.
We have explained several times that this is a known problem with the company. In addition
to personal data processing errors, this is also a case of possible investment fraud, which is
being processed under criminal law.
The first problem with this case is that from the information gathered, it was made certain that
during 03.07.2018-19.03.2019, the member of the board was Latvian citizen
and form 21.02.2018- 23.12.2019 Estonian citizen Since 23.12.2019, the board
member has been (until bankruptcy proceedings).
Members and have both been active in decision making for the
company. The criminal proceedings are taking place in Estonia, as the company is registered
here. However, from the information the prosecutor’s office has, it is impossible to say, which
country (either Estonia or Latvia) was responsible for processing personal data and in which
country this took place. Thus, during the complaint being submitted, it can be argued if LSA
should be Estonia or Latvia.
The second issue is, that currently in this situation, the one responsible for the company is
bankruptcy trustee ( ). Even though factually the
member of the board is also the legal representative is considered to be the
trustee. Nevertheless, the trustee is mostly in charge of the financial matters and may not have
all the documentation and necessary data the company has collected.
Estonian Data Inspectorate could legally force a company to fulfill the obligation to delete
complainant’s data, although if the bankruptcy trustee would not do what is mentioned, there
are no possible sanctions Estonian Data Inspectorate could use in this case. We cannot impose
any financial sanctions to the company in bankruptcy due to the Estonian Bankruptcy Act and
its deadlines to send any claims. Also, it is possible that after the proceedings are completed
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
and criminal procedure finished, the company will be ceased to exist. If this happens, there is
no data processor left and our proceedings would be concluded.
We have come to the conclusion that the complainant themselves could make a request in the
bankruptcy proceedings and forward their request to the bankruptcy trustee. However, it is
still highly unlikely they have the necessary information or possibility to fulfill the request.
Considering that also in criminal proceedings, the possible measures to clarify the
circumstances are significantly more extensive than in the state supervision or misdemeanor
proceedings of the Estonian SA, it is not reasonable for us to proceed against the company.
Please also note that the intervention of the Estonian SA would not ensure better protection of
people’s rights, taking into consideration the volume of the case and the amount of victims.
There are several crime reports submitted against the company, making the investigation even
more elaborate and fall out of the scope of Estonian Data Protection Inspectorate.
In addition, it is unreasonable for several government institutions to hold proceedings over
one company at the same time as well. As is undergoing criminal process and
bankruptcy, we would have to see what is the outcome before enforcing anything becomes
possible. We do not know currently (nor does the prosecutor’s office) how long this may take.
However, it appears that there has been distribution proposal, meaning it is possible the data
processor ceases to exist in due time, making our proceedings concluded as well.
We gave SA Poland a deadline for providing their feedback on the draft decision and have the
confirmation regarding the substance of the draft decision provided. However, they noted that
it should be adopted under article 60 of GDPR, points 3 and 6-7. SA Estonia agrees with this
outcome.
Considering all of the above, we will discontinue and terminate the supervision
proceedings under GDPR article 60 (3, 6 and 7) and consideration of practical
expediency, as this case is being handled under criminal and bankruptcy proceedings.
For further questions regarding (bankrupt) in the future, bankruptcy trustee
(contact above) or Prosecutor’s Office ([email protected]) can be contacted.
With this, the current case will be closed.
Best regards,
lawyer
authorized by Director General
2 (2)