The Personal Data Protection Act came in force in January 2019. It establishes, in conformity with the EU’s general regulation, a few exceptions to the general principle of the processing of personal data for journalistic purposes, and also for the purpose of historical and scientific research. Personal data may also be processed without the consent of the data subject for the purpose of academic, artistic and literary expression, in particular disclosed if this does not cause excessive damage to the rights of the data subject.
The Data Protection Inspectorate makes sure that people’s personal data is sufficiently protected. The Inspectorate also ensures that information on the activity of institutions, i.e. public information, is sufficiently available. The right to the protection of personal data and the right to public information are constitutional rights in Estonia. The constitution also grants everybody the right to inquire about the data collected about their person.