In a ruling issued Thursday, Tallinn Administrative Court upheld a claim filed by Pruunsild and Humal against the Republic of Estonia, seeking compensation for nonpecuniary damages over the state's failure to protect their right to privacy and the confidentiality of their communications.

The court ordered the state to pay each claimant €150,000 in compensation for nonpecuniary damages. It also ordered the state to reimburse the claimants' legal costs of €25,000 and €8,302.40, respectively.

According to the claimants, the Estonian state has for years unlawfully required telecommunications service providers to collect and retain their customers' personal data. They argued that, in doing so, the state violated individuals' rights to privacy. On this basis, they sought compensation for the nonpecuniary damages they had suffered.

The court noted that Estonian law had been in conflict with European Union law since a December 21, 2016, ruling by the Court of Justice of the European Union. At the latest, following the entry into force of a June 18, 2021, ruling by Estonia's Supreme Court, the relevant state authorities should have been fully aware that the Electronic Communications Act's provisions requiring the general and indiscriminate collection and retention of significant amounts of communications data were incompatible with EU law and could not lawfully be applied in Estonia.

The court found that, following those rulings, the relevant state authorities should have immediately stopped requiring compliance with the legislation, while government agencies should have ceased requesting data collected and retained under its provisions. The authorities should also have initiated the necessary measures and procedures to repeal the provisions found to be incompatible with EU law or bring them into compliance with both EU and Estonian law.

In this case, however, neither the executive nor the legislative branch had taken steps to resolve the conflict for more than three years after the Supreme Court confirmed that the legislation was incompatible with EU law.

Moreover, the court found that, even after the Supreme Court's 2021 ruling and despite the clear legal situation, executive authorities continued submitting new requests for data collected by telecommunications companies under an invalid legal provision and using the data obtained in criminal proceedings.

The court acknowledged that collecting certain communications data may be necessary and justified to protect national security and maintain public order, as the state had argued. However, these interests do not justify the general and indiscriminate collection of the personal data in question from all telecommunications service users.

According to the court, it is clear that such a system of data collection is unacceptable in democratic countries, is seriously disproportionate and is inherently incompatible with the general principle of liberty, including, in a broader sense, the presumption of innocence.

Under the State Liability Act, compensation can be awarded only if all of the following conditions are met: the damage was directly caused by legislation or a failure to enact legislation, the individual suffered damage, the damage resulted from a serious breach of duty by a public authority, there is a causal link between that serious breach and the damage suffered, the legal provision establishing the breached obligation is directly applicable and the individual belongs to a group of people who have suffered particular harm as a result of the legislation or the failure to enact it.

The court found that all these conditions for awarding compensation for nonpecuniary damages had been met in this case. It emphasized that Section 14 of the Constitution obliges the state, through its competent authorities, to protect individuals' rights.

The court stressed that protection against violations of these rights must be effective and prompt and that the complexity of the relevant legal framework cannot justify a prolonged failure to fulfill the obligation to protect individuals' rights. It also noted that, based on past experience, the state has sufficient resources to swiftly regulate even complex matters through legislation when necessary.

The court further noted that, at a minimum, lawmakers and the relevant executive authorities, including the Ministry of Justice or the Consumer Protection and Technical Regulatory Authority, should have initiated the repeal of the statutory provisions directly conflicting with EU law.

To safeguard citizens' fundamental rights, the state should also have informed telecommunications companies through its relevant authorities that compliance with the provisions conflicting with EU law was no longer required. The companies should have been informed that, pending the possible adoption of new legislation, they could limit their collection and retention of data to what was necessary for their business operations, retain it only for as long as necessary and disclose it to state authorities only in circumstances prescribed by law.

The state took none of these steps. Instead, it knowingly continued requesting unlawfully collected data from telecommunications companies to carry out its functions.

The court also found that the claimants belonged to a group of individuals who had suffered particular harm. In both cases, unlawfully collected data had subsequently been used unlawfully in criminal proceedings brought against them.

Although the claimants had not yet been acquitted when they filed their claim, their acquittals in the criminal case in which the data had been collected had become final by the time the administrative court issued its ruling. This placed them in an entirely different category from ordinary citizens and individuals who had been convicted of crimes.

In determining the amount of compensation, the court was required to consider the general principles governing compensation for nonpecuniary damages, under which compensation must be proportionate to the severity of the violation, taking into account the nature and degree of culpability.

The court found there was no doubt that the case involved an extremely serious violation of individual rights. The volume of unlawfully disclosed data was substantial, allowing extensive intrusion into the claimants' private lives and significantly violating their right to the confidentiality of communications. The court therefore considered it justified to award compensation substantially higher than amounts typically awarded in Estonian court practice.

An appeal may be filed with Tallinn Circuit Court by December 14.

Background

The corruption case against Parvel Pruunsild and former Tartu Deputy Mayor Priit Humal (Isamaa) centered on allegations that Humal violated Estonia's Anti-Corruption Act in 2022 by participating in city decisions to forego acquiring the former Estonian National Museum exhibition building in Tartu — a move aided and abetted by Isamaa sponsor Pruunsild that allowed the property to be auctioned and bought in January 2023 for €1.22 million by the student fraternity Korp! Sakala, of which Pruunsild is a prominent member. The men were acquitted by the first two court instances, with the Prosecutor's Office deciding against bringing the case to the Supreme Court after that.

Following their acquittal and the reimbursement of their legal defense costs by the state, Pruunsild and Humal filed administrative lawsuits against the Estonian state (as well as a separate civil suit by Pruunsild against telecom provider Telia) seeking damages over what they contend was the unlawful collection and use of their personal telecommunications data during the investigation.

--

Follow ERR News on Facebook and X and never miss an update!