Investigative authorities have at times demanded several years' worth of a person's email correspondence from email service providers, a practice that can significantly infringe on privacy rights.

"Unfortunately, we know of cases where police have asked for all email accounts belonging to all employees of a company, covering, for example, the previous three years. There are currently no limits. The situation is completely abnormal," Justice Minister Liisa Pakosta (Eesti 200) told ERR.

In such cases, other parties involved in criminal proceedings may gain access to information about a person's private life that has no connection to the case when reviewing criminal case files. Current legislation does not allow either the email account holder or the service provider to effectively challenge excessive data collection.

"Such a practice is not in line with Estonia's legal principles or understanding of the law," the Ministry of Justice states in its draft legislative proposal.

According to Pakosta, laws governing the protection of communication secrecy in criminal proceedings have remained largely unchanged since the era when people still sent postcards, even though communication has long since shifted to email.

"The contents of people's phones, computers or email accounts hosted on Estonian servers are full of sensitive personal data. In a democratic state, we generally believe that access to such sensitive private information should require prior oversight, and that oversight is provided by the courts. Such actions should only be permitted with a court order," Pakosta said.

Another issue is that other European Union member states updated their legislation some time ago, while Estonian police can download emails only from servers located in Estonia. As a result, many businesses use foreign hosting services, placing companies that provide server hosting in Estonia at a competitive disadvantage.

Pakosta said the purpose of the draft proposal is to gather views from stakeholders on the best solution. However, any solution must include additional oversight to ensure not only that access to the contents of email accounts and smart devices is lawful and justified, but also that the scope of access is necessary and proportionate.

The minister said Estonia's legal system is based on the principle that the state may not compel a person to provide evidence against themselves through coercive means. In such situations, the state must find other evidence or abandon the proceedings.

At present, there is no clear legal framework defining the conditions under which the contents of private email accounts may be requested during criminal proceedings, nor is it clear what objections, if any, server operators may raise in response to requests from investigative authorities.

Disputes have already arisen in court practice

The Eesti Ekspress newspaper reported last week that investigators have for years had broad discretion when collecting digital evidence, a practice that has helped uncover information in cases involving child sex offenders and drug traffickers.

Following a 2024 ruling by the Court of Justice of the European Union that access to data stored on a smart device against its owner's wishes constitutes a serious intrusion into privacy and therefore requires prior judicial authorization, Estonian police nevertheless continued collecting digital evidence as before. Current Estonian law does not even provide investigators with a mechanism to seek court approval to unlock a smart device.

At the same time, the Supreme Court may choose to rely on the EU court's ruling, meaning carefully gathered evidence could potentially be ruled inadmissible, although this has not happened so far.

Through the proposed amendment, the Ministry of Justice aims to ensure both that personal data is protected from disproportionate interference by law enforcement authorities and that such data can still be used as evidence in criminal proceedings when necessary.

To achieve this, the ministry's draft legislative proposal outlines two options. The first would amend the legal definition of a search so that data storage devices and smart devices could explicitly be treated as objects of a search.

"The advantage of this solution is that it would be an intuitively understandable legislative amendment. Its weakness is that, although search regulations may serve as a starting point, conducting searches within large volumes of data will likely require more specific rules and expanding the definition of a search may not fit well with the so-called professional privileges bill currently before parliament," the proposal states.

The second option would create a separate legal framework for collecting evidence from smart devices and obtaining data from servers. This approach would allow the specific characteristics of electronic evidence to be addressed more precisely and would align better with the planned data privilege regulations.

The Ministry of Justice noted in the document that these issues have already surfaced in Estonian court practice, creating confusion and disputes in several major criminal cases.

According to the Ministry of the Interior, the Central Criminal Police's digital forensics unit copied data from 1,591 smartphones, 353 laptops, 120 tablets and 118 desktop computers last year. The statistics do not distinguish between cases where data was copied without the owner's consent and cases where the device was seized under a search warrant.

The draft proposal notes that, while the planned changes would slightly increase the administrative burden, they would provide a clearer legal basis for the use of digital evidence and reduce legal disputes. More carefully targeted evidence collection could also result in fewer investigative actions that significantly intrude on privacy.

The Ministry of Justice is accepting feedback from relevant stakeholders on the proposed amendments to the Code of Criminal Procedure until mid-June. Pakosta said she hopes public discussion can take place over the summer and that a draft bill can be completed in time to be submitted to the Riigikogu in the fall.

--

Follow ERR News on Facebook and X and never miss an update!