AKI (Estonia) - 2.1-1/25/724-1566-19
Estonian DPA orders bailiff to disclose data in response to GDPR access request.
The Estonian Data Protection Inspectorate (AKI) has ordered a bailiff to comply with a data subject's access request under Article 15 of the GDPR. The bailiff had initially refused to disclose information regarding the processing of personal data in enforcement proceedings, citing professional secrecy. However, the AKI ruled that this duty of confidentiality is not absolute and that bailiffs must disclose information to parties involved in proceedings, especially when it concerns data subject rights under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AKI?
Get an email when a new story names AKI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA bailiff in Estonia incorrectly used professional secrecy obligations as a blanket justification to deny a data subject's Article 15 GDPR access request, which the AKI ruled was unlawful. This case highlights a common misunderstanding where organizations conflate internal confidentiality duties with the right to withhold personal data from the individuals that data concerns. GDPR data subject rights are not automatically overridden by professional secrecy — controllers must carefully assess each exemption on a case-by-case basis. Failing to honor valid access requests exposes organizations to regulatory enforcement, reputational damage, and erosion of individual trust. This ruling reinforces that all data controllers, regardless of sector, must embed GDPR compliance into their operational procedures.