AKI (Estonia) - 2.1.-4/26/1106-2333-4
Estonian DPA orders website to implement safeguards for republished public register documents.
The Estonian Data Protection Inspectorate (AKI) has ordered a website operator to implement safeguards for personal data republished from public registers. The website continued to display documents even after original authorities imposed access restrictions, and failed to adequately address data subject requests. The AKI found the operator lacked sufficient technical and organizational measures to comply with GDPR, particularly regarding the ongoing legal basis for processing and handling special categories of data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AKI?
Get an email when a new story names AKI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA website operator continued to display personal data sourced from public registers even after the originating authorities restricted access to that data, creating an ongoing GDPR violation. The operator failed to establish a lawful legal basis for continued processing and did not respond adequately to data subject requests, compounding the breach. This case highlights that republishing publicly available data does not exempt an operator from GDPR obligations, and that access restrictions imposed by source authorities must be honoured downstream. Special category data carries heightened obligations, meaning the absence of technical and organisational controls exposes operators to significant regulatory risk.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.