Justice chancellor: State agencies can access banking secrets without rules

The Office of the Chancellor of Justice Ülle Madise has found that government agencies have been accessing account holders' banking information through the enforcement register without a proper legal basis. State institutions have made tens of thousands of inquiries to banks over the past year.
The chancellor of justice investigated concerns that several government agencies have been accessing banking information through the enforcement register without the account holder's knowledge, consent or a proper legal basis. The chancellor requested information from the Center of Registers and Information Systems (RIK), as well as from the Ministry of Justice and Digital Affairs.
It turned out that the enforcement register (formerly known as e-arest) is currently in use, providing several agencies with access to various types of banking data. This includes, among other things, access to bank account statements — that is, full transaction histories.
Since the establishment of the enforcement register, between January 1, 2024 and February 28, 2025, government agencies have submitted tens of thousands of banking inquiries.
Officials from the ministries confirmed to the chancellor of justice that a system with similar functionality, e-arest, had been in use for some time before being replaced by the enforcement register. When the new register was introduced on January 1, 2024, access was automatically granted to all agencies that had previously been authorized to use the earlier enforcement procedure register and the electronic freezing system.
"The state has made tens of thousands of inquiries to banks since the enforcement register was established," the chancellor noted. She concluded that the current oversight of the justifiability of these inquiries is merely formal and that no external control exists.
She also found that the enforcement register lacks a foundational statute, meaning there are no formal rules governing its use.
According to the chancellor, the enforcement register currently includes the following services and queries: transmission of a freeze order, cancellation of a freeze, modification of a freeze, account existence, account authorizations, account balance, account statement, beneficial owner, deposit account existence and expanded account existence.
"Freeze-related queries — transmission, changes and cancellations — are primarily made by bailiffs and the Tax and Customs Board, with hundreds of thousands of such inquiries on record. Both bailiffs and state agencies are interested in account balances, but as of now, only certain government institutions can access full account statements through the enforcement register," she said.
Based on information received from the Center of Registers and Information Systems, the agencies that have requested account statements via the enforcement register during the stated period include the Tax and Customs Board, the Internal Security Service (ISS), the Foreign Intelligence Service, the Police and Border Guard Board and the Financial Intelligence Unit.
The justice chancellor stressed that given how sensitive account statements can be, the creation of access to such data should have been preceded by public discussion and parliamentary debate.
"It would also be reasonable to expect that such a data-sharing arrangement be clearly addressed in the draft legislation's explanatory memorandum, including an analysis of its constitutionality and proportionality," she added.
The chancellor emphasized that data systems should not be used until the legal basis for their operation and rules governing their use have been properly established.
She recommended that the Minister of Justice and Digital Affairs urgently adopt a foundational statute for the enforcement register. This statute should include oversight mechanisms that allow monitoring both the number of inquiries made and the specific justification for each one, including its connection to a particular legal proceeding.
She also called on the Riigikogu Finance Committee and Legal Affairs Committee to review the relevant legal provisions. "If the Riigikogu believes that access to bank account statements should be extended to cases not currently covered by law, then the right of a government agency to view such data must be written into the law clearly and unambiguously, accompanied by a thorough proportionality analysis," the chancellor wrote.
--
Follow ERR News on Facebook, Bluesky and X and never miss an update!
Editor: Mari Peegel, Marcus Turovski