Ülle Madise: Things aren't great when it comes to the principle of legality

The principle of legality is in poor and possibly worsening shape and state oversight increasingly toothless across various sectors, Chancellor of Justice Ülle Madise said in her annual address to the Riigikogu.
As always, there is reason to thank the Riigikogu for the good cooperation over the past year in the interests of the Estonian people. A number of constitutional review proposals were implemented and other errors were quietly corrected as well. Thank you for that. It has helped many people, and believe me, we see that this is more important than it sometimes appears at first glance.
I also want to thank all members of the government and officials who have likewise helped to address people's concerns. Sometimes these efforts never even make it into the public eye — just like good news often doesn't. Thank you all. And special recognition goes to those decision-makers who, upon realizing that something has gone wrong, do not try to hide the mistake or shift the blame, but instead start looking for a solution. We all know that even the most knowledgeable expert with the best intentions can make mistakes. That is inevitable.
People's concerns
I believe that the fruit of our joint efforts can also be seen in the growing public empathy and substantive understanding of inspection visits to nursing homes, hospital psychiatric wards, closed child care institutions and prisons.
And the institutions tasked with helping people in those difficult circumstances — the staff who work in them, the officials involved — are genuinely trying. But it's no secret that care homes are chronically understaffed. The situation is not much better in prisons or other closed institutions, and I'm sure you're all aware of how challenging child protection work is, for example.
By its very nature, the Office of the Chancellor of Justice tends to receive people's grievances. In the last reporting year — from September 1, 2024, to August 31, 2025 — we received just over 5,500 letters. More than 2,500 of those required a substantive and resource-intensive resolution.
When we investigate the root causes of these concerns, we often uncover flaws in legislation and even more frequently in its implementation. And let me stress once again: this should not be taken to mean that everything is bad or that officials are deliberately being obstructive. That's simply not true.
There is a great deal that is working well and much continues to improve through our collective efforts. Many officials, even under the growing burden of meaningless tasks, still manage to do their work effectively. Unfortunately, with each passing year, that gets harder. The large-scale, flawed management methods adopted from major powers — performance metrics and the like — tend to hit hardest at those on the front lines: the most diligent and effective officials who have the closest contact with people.
We increasingly see that the solution exists, yet for some reason, it's not being pursued. Estonia is small and it's entirely possible here to take a closer look at the actual content of each institution and role — what is being done, why it's being done, how it's being done and how it could be done better. That is within reach. The management approaches of large countries simply do not suit Estonia, especially when they come from the Anglo-American legal system, which is fundamentally incompatible with our constitutional framework.
Over the past year, we've seen far too often that people are told: yes, it's unfortunate, the decision made about you was unjust, foolish and illogical, but there's nothing to be done — some machine, method or procedure determined your fate. Sorry. And so we've repeatedly had to explain that under the principles of good governance, a machine must only assist a person — even an official. A lack of internet connection or a system crash must not deprive anyone of their rights. If necessary, a document must be accepted on paper.
We carried out our first inspection of an institution using artificial intelligence. I'll say upfront: no major problems were found. But it gave us the opportunity to reiterate what the EU AI Regulation and the corresponding Council of Europe convention both say — namely, that AI-based solutions must remain under human oversight.
If an error occurs or if the person affected by a decision requests it, there must be a wise and conscientious official available to review the case from the beginning and issue a lawful decision. We must not allow ourselves to become dependent on machines.
We are facing serious, perhaps even deepening issues with the principle of legality. If a law is constitutional and in force, it must be followed — or else it must be changed. As you'll see in the annual report, the importance of adhering to the law is increasingly being dismissed. Or worse, vague and symbolic additions are made to laws, just to avoid having to change a current practice that violates fundamental rights — because that practice is convenient. I ask the Riigikogu to take a stand and help put an end to this approach.
Unfortunately, we are seeing across the country and in various fields that state supervision is also becoming toothless. That is, the law exists, but it is not being enforced.
You've probably noticed that our office has had to take a public stance on educational issues quite frequently. And I agree — this is supposed to be the responsibility of the Ministry of Education and Research. But what are we supposed to do when we see that this responsibility is not being fulfilled?
I know how difficult this is. I can imagine the pushback from school principals, the expectations of parents, the wishes of young people and students — all of them often conflicting. But the fact remains: we receive letters from children, teenagers, parents, teachers and principals, and we see that, yes, the law has not been followed. So what are we supposed to say?
It seems that the laws governing education are, in some cases, contradictory — pulling in two completely different directions.
On the one hand, we're told that each child's individual needs must be taken into account; that they should be supported in becoming the best version of themselves, recognizing both their strengths and the areas where they need help. On the other hand, we're told that knowledge assessments must be strictly objective to the last.
A teenage boy who stutters, perhaps with a pimple or two on his face, must not be spared from reciting in front of the girls — if everyone is reciting, then he must too, and so on. You know this from your own family experience, from your work as a teacher or in the ministry. Everything must be measured down to the last cent, objective, verified, uniform. But these two approaches cannot coexist.
It's exactly the same with the demand that every school be unique, that we trust teachers as trained professionals, with support from school boards and student councils. And yet at the same time, there is a demand for central regulation of every minute detail of school life — from where to put your smartphone to how tests should be administered. These two paths cannot be followed simultaneously.
I ask that, where possible, the laws be clarified and a decision made about which path to take. And yes, it remains close to our hearts that the fierce competition for first-grade and high school places is not in the interest of children — nor in Estonia's interest. This has been scientifically proven.
Super-databases are mostly unnecessary
It appears that, in some cases, institutions have forgotten a fundamental principle: major investments that restrict fundamental rights, such as the acquisition of certain technological tools, may only be made after the Riigikogu has authorized such restrictions through legislation, the president has promulgated the law and possibly even after constitutional review has taken place.
We have repeatedly seen millions of euros being spent. And we can't find a single provision in the law that would permit such detailed surveillance of individuals. Nor is there any explanation of what the purpose is. Technologically feasible? Very nice. But why? No answers have been provided, and yet millions are being spent. It is entirely possible that these tools can't even be legally deployed. I urge the Riigikogu not to retroactively approve the legalization of such measures lightly.
I also want to stress — just as we have had to do throughout the entire reporting year — that when the Riigikogu debates and passes legislation that allows for the collection and use of individuals' data under coercion, this is not just some legal formality. It is vitally important for preserving a free society. This is not just nitpicking over norms.
I've often emphasized that we should not condemn police officers or others on the front lines, who are constantly facing budget cuts and have been actively searching for technological solutions to replace human labor. These norms must originate in the ministries and be submitted to the Riigikogu.
It should go without saying: explicit legal authorization from the Riigikogu, written in clear Estonian, is always absolutely necessary before any personal data can be collected. The law must state what the data is being collected for, where and how it will be stored, for how long, who may use it and for what purposes and what internal and external oversight mechanisms are in place.
Most of this is usually missing — because it's convenient that way and maybe people won't notice. But the fragility of banking secrecy protections shows how far we still are from a legal environment where such clear, well-considered and straightforward provisions are written into law. I sincerely ask for your help and understanding in resolving this issue. And always with the goal of making sensible decisions — so that the pendulum doesn't swing wildly from one extreme to the other.
Estonia follows the principle of decentralized data registries, and in my view, we should continue adhering to this approach, especially given the increasing cyber and security threats. This means each database contains only the information relevant to it, plus a few key data points that allow — when absolutely necessary — cross-referencing with other datasets, for instance, to determine whether someone qualifies for support payments.
There is no need for an agency to build its own personal data warehouse, which could be used for all sorts of "interesting" purposes — especially if artificial intelligence is added into the mix. Instead, it is possible to temporarily merge the necessary data through the X-Road system, make the decision and then delete the data after a set period.
In general, we do not need super-databases or data warehouses. If there is an exceptional case where one is truly needed, then it must be thoroughly debated in the Riigikogu: Do the potential risks of abuse — which we hear about from around the world and even here in Estonia on a daily basis — really outweigh the intended goals of data collection? And is there funding in the state budget to ensure the data warehouse is properly secured year after year?
Preventative vs proactive state
In some ways, it's encouraging that there has been considerable public debate over banking secrecy and privacy protection. Two major questions lie at the heart of this. Should Estonia take the path of a so-called preventative state, where mass data processing is used to eliminate even the possibility of risk arising — what Leelo Tungal might describe as a Christmas tree without needles, a bare, harmless pole — and do we, in fact, want a proactive state?
As a society, we have not had a thorough debate on these questions. The Riigikogu has not made these decisions, and I doubt whether such decisions would even be constitutional. Of course, the Constitution can be amended.
At times, it seems there is a desire to bring every aspect of a person's life — every action and inaction — under the state's microscope simply because it is now technically possible. Truly, over the past year we've seen a strong belief in the idea of total safety, in a society where every risk is preemptively neutralized. And we have tried to explain that the Republic of Estonia is founded on freedom and responsibility, on justice — and only then on legal norms and control. Indeed, we've never agreed that the state should analyze every expression of a person's life just to rush in and help them without even being asked.

There's a broader philosophical issue at play here, and I believe it is worth engaging in this debate and fighting this fight together. It is your responsibility, members of the Riigikogu, to make a thoughtful, future-focused decision that will truly benefit Estonia.
It is true that modern technology enables an unprecedented level of control over individuals — more powerful surveillance and more constraining oversight than what existed during the occupation or under the Stasi in East Germany.
Many of us understand that this does not build trust or strengthen society — it breaks it. And we also know that human nature hasn't changed fundamentally and no country is free of those who would prefer to see the peaceful transfer of power disappear, replaced by a monopoly on power. Nor is there a shortage of people who yearn for a "strong hand," hoping that such authority would force others to live the way they see fit. Of course, that's not how it works — but by then, it's too late. And if you add to that the total control enabled by modern technology, you can clearly see how any form of resistance could be suffocated under state-sponsored lies and coercion.
The saying "if you have nothing to hide, you have nothing to fear," which we've heard more than once this past year, may hold some truth — but only as long as we remain a democratic state governed by the rule of law, where individual freedom and responsibility are protected, where the principle of decentralized data registries remains in place and where the law truly and substantively limits those who wield power — and where compliance with that law is genuinely enforced.
Another issue that often landed on our desk was the presumption of innocence and legal clarity. When reading the Penal Code, it's not always clear what is forbidden and what is allowed. And so we have continued to ask: is it really acceptable for someone to find out — at the cost of their honor and dignity — what an unclear criminal provision actually means only once a court has ruled? My reading of the Constitution says otherwise.
I ask, on behalf of our office and our shared values, that we not allow our society to fracture into groups that no longer recognize each other as human. All of us living in Estonia must be able to live together.
Because of how the human psyche works, nothing good can come of a situation in which too many people feel forcibly excluded, branded as bad or stupid, called Kremlin agents or deemed "wrong" — with even their elected representatives treated as though they should be permanently barred from power. If too many people feel that the authorities dictate how they should feel and think, then we are on a dangerous path. And truly, nothing — not security, not the climate crisis, not public health, not fiscal balance — automatically overrides all other values.
There must always be space for debate, for weighing options, for seeking a fair balance. And the Constitution protects freedom of expression. There is no topic on which reasonable discussion should be forbidden and replaced with official "truth." Even our recent history has taught us how much damage is done when freedom is stripped away under the weight of dictation, the suppression of dialogue and mass hysteria.
--
Editor: Marcus Turovski










