Justice ministry changes data privacy law after misuse scandals

Minister of Justice and Digital Affairs Liisa Pakosta has sent a draft bill for interagency review that would require institutions connected to the enforcement register to use a data tracker. According to the ministry, this is the first step in a plan to make the use of data trackers mandatory for all state databases.
Under the draft, institutions would be required to make the necessary information available through the data tracker service on the state portal eesti.ee. This would allow people to see at any time who has made inquiries about them through the enforcement register to credit and payment institutions.
Individuals would be able to review all inquiries made about them via the enforcement register, except those restricted by law — for example, activities regulated under the Security Authorities Act, which governs the Foreign Intelligence Service and the Internal Security Service (ISS).
Currently, inquiries through the enforcement register regarding financial institution data, for the purpose of fulfilling statutory duties, are made by the Police and Border Guard Board, the ISS, the Foreign Intelligence Service and bailiffs.
The amendments, which would establish the new procedure in the Code of Enforcement Procedure as well as the implementing act of the Code of Civil Procedure and the Code of Enforcement Procedure, are expected to reach the government in the coming weeks. The changes are scheduled to take effect on February 23, 2026.
Ministry: Major changes ahead
Pakosta said the changes are intended to increase transparency in inquiries made through the enforcement register. "People will gain a clearer and faster overview of who has requested information about them, why and when," she said.
The information would also allow individuals to detect and challenge unlawful inquiries. According to the ministry, the amendment would reduce the risk of data misuse and make oversight of data use simpler and more convenient, since the necessary information would be centralized in one place and accessible electronically.
"Making information about inquiries available to people through the data tracker will become mandatory for all state institutions. The development plan will be presented to the public in October," Pakosta said.
Currently, 16 databases are connected to the data tracker, but preliminary estimates suggest that within a year the number could exceed 300. Exact figures on which databases will join are expected to become clear by the end of the year, following joint work among ministries.
Until now, the use of the data tracker by Estonian state institutions has been voluntary.
ERR reported this week that, at present, individuals can only see information about inquiries concerning them from 16 databases through the data tracker.
The ministry wants to change the rules following reports from the Office of the Chancellor of Justice that state agencies, such as the PPA and the Financial Intelligence Unit, have had more access to private data than allowed under the current law.
--
Editor: Marko Tooming, Marcus Turovski










