In 2021 and 2022, the Data Protection Inspectorate (AKI) launched two supervisory proceedings related to the building register, both of which concluded in 2024. In both cases, the outcome was a recommendation to improve implementation of the Public Information Act. Inspectorate Director Pille Lehis told ERR directly that the Ministry of Climate's attention was drawn to the possibility that information subject to access restrictions may have been published in the building register.

"It was not a binding order. At the time, the focus of the proceedings was somewhat different, so we pointed out that these and those aspects should also be reconsidered. To the best of my knowledge, and as we now know well, no organizational changes were made as a result," Lehis said.

The inspectorate has now launched a new supervisory proceeding concerning the building register. Although it was prompted by an episode of the investigative TV program "Pealtnägija," which mainly addressed private photographs of people's homes, Lehis said their review is much broader.

"The aim is to examine all data processing procedures in the building register, including whether and how the processing of personal data is organized. That is our sole focus, insofar as we can review that aspect, rather than other data that may be included there."

Lehis referred to data that may infringe on people's privacy but does not qualify as personal data under the law. She emphasized that personal data consists only of information that can be directly or indirectly linked to a specific individual.

"If there is a picture of my home that does not include any photo of me or my family, I understand that it is my home, but third parties may not. In the case of the building register, however, there is much additional information, which often makes it possible to link it to an individual," Lehis explained.

AKI holding off assessment

In addition, questions have been raised about whether the Ministry of Climate's decision to restrict access to much of the building register following the "Pealtnägija" episode is lawful at all. The city of Tartu argues that the law provides no basis for withholding public information as a temporary precautionary measure.

The Ministry of Climate responded that the broad access restriction currently in place is a temporary protective measure that was discussed with the Data Protection Inspectorate. "In our assessment, the measure is proportionate, as the potential risks of not restricting access were significant. At present, we are evaluating various measures to resolve the situation, including coordinating solutions in advance with the Data Protection Inspectorate," said Liisi Pajuste, head of the ministry's construction division, in a written comment.

Although this may create the impression that the inspectorate ordered access to the documents to be closed, that is not the case. Pille Lehis stressed that the inspectorate can issue legally binding positions only after supervisory proceedings have concluded.

"If, during the proceedings, an urgent need arises to intervene and issue orders — for example, to suspend a particular data processing operation — we can do so. However, that has not been done at this point. All decisions made so far regarding the building register have been taken by the controller responsible for processing — the Ministry of Climate — and in fact, that is how it should be," Lehis said.

She noted that the ministry did indeed consult the inspectorate, but it did not receive any specific authorization or prohibition.

Public Information Act at odds with GDPR

Although Lehis did not say whether the inspectorate believes the Ministry of Climate has acted properly, she pointed out that above the Public Information Act as a national law stands the European Union's General Data Protection Regulation (GDPR). Under the GDPR, the controller — in this case the Ministry of Climate — must ensure that the processing of personal data is secure.

"The Public Information Act states that only specifically listed information is subject to access restrictions, including personal data. Today, the situation is such that the controller is unable to ensure restricted access to personal data because it is mixed in with other information and they likely cannot distinguish exactly where, how much and what type of personal data is involved, nor restrict access solely to that. This is now a task they must resolve," Lehis said.

She further emphasized that at present only public access to supplementary documents attached to occupancy permits and notices of use has been restricted; the building register itself has not been completely closed. Anyone who has a legal right to obtain data from the register must still be granted access.

"I understand that access has become more difficult for users, but it is up to the owner of the building register to find solutions that ensure a balance of all rights and obligations," Lehis said.

In theory, the inspectorate's supervisory proceedings could also take into account the fact that concerns about the public nature of data in the building register had been raised previously. However, the review will primarily focus on the situation as it stands at the moment the proceedings were initiated. A legal assessment will then be issued on that basis.

--

Follow ERR News on Facebook and X and never miss an update!