15. February 07
The personal data protection act adopted by the Riigikogu, which enters into force as of 2007, will considerably improve the protection of personal data and regulate the processing of personal data lawfully granted for public use.
One of the main changes is that according to the act, a person has the right to demand termination of the publication and other use of the data lawfully granted for public use. Thus, after publication of their data a citizen retains the control over their further use. The present act does not offer any such option.
According to Justice Minister Rein Lang, there is currently a lot of personal information in circulation, which has been light-heartedly given by people and which is processed and used afterwards by third persons. “We do not need such a ‘Big Brother’ society,” said Lang.
Urmas Volens, the Deputy Secretary-General of the Ministry of Justice, explained that after the act enters into force a person can at any time prohibit the disclosure of the telephone number of given to a public telephone book or information hotline. Those participating in any loyal customer or consumer lotteries have the right to demand that the company delete their personal public telephone number from their databases even if the entrepreneur has got it from a telephone book.
The law regulates the collection of personal data for the purpose of evaluation of solvency in greater detail as well. According to the former regulation there were no time limits to collection of such data, but according to the new act the information about payment difficulties may be processed and given to a third person only for a period of three years as of the violation of the obligation.
According to Volens, credit information must thus not be older than 3 years. “This means that if 3 years or more has passed from the violation of a contract, the respective data must be removed,” explained Volens.
According to the act, a person’s biometrical data, such as fingerprints and DNA is considered sensitive personal data. Thus, everybody's protection against threats relating to processing such data will increase as well.
The law stipulates one exception regarding publication of personal data without the person’s consent. This is permitted for journalistic purposes and provided that it takes place in compliance with good practice and the principles of journalist ethics, and there is dominant public interest therein.
Thus the media publication must in each case evaluate separately whether the public interest is so important that it outweighs the need for protection of the person’s rights. For instance, there could be a public interest in the disclosure of the real property transactions of a minister, but there is not any with regard to the academic results of the minister’s child.
The work group who drafted the act comprised representatives of the Tallinn University of Technology, the State Gazette Publishing House, the Chancellor of Justice, the Data Protection Inspectorate and the <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />E-state Academy.
