Processing personal data in a business (GDPR)

When may a business process personal data?

Personal data means any information relating to an identified or identifiable natural person, for example a name, a personal identification code, location data or an online identifier (GDPR Art. 4(1)) [7]. The business that determines the purposes and means of the processing is the controller (vastutav töötleja) (GDPR Art. 4(7)) [7].

Processing is lawful only if at least one of the following conditions is met (GDPR Art. 6(1)) [1]:

• the data subject has given consent for one or more specific purposes (p a);
• processing is necessary for the performance of a contract with the data subject or for steps taken at their request before entering into a contract (p b);
• processing is necessary for compliance with a legal obligation of the controller (p c);
• processing is necessary to protect the vital interests of the data subject or of another natural person (p d);
• processing is necessary for a task carried out in the public interest or in the exercise of official authority (p e);
• processing is necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject (p f).

The processing principles also apply: data are collected for specified, explicit and legitimate purposes, limited to what is necessary for the purpose, and kept in a form that permits identification only as long as necessary for the purpose (GDPR Art. 5(1) p b, c and e) [8]. The controller must be able to demonstrate compliance with the principles (GDPR Art. 5(2)) [8].

Where processing is based on consent, the business must be able to demonstrate that the person consented (GDPR Art. 7(1)) [9]. The person may withdraw consent at any time, and withdrawing must be as easy as giving consent (GDPR Art. 7(3)) [9]. Where an information society service is offered directly to a child and processing is based on consent, processing the child's data is allowed only if the child is at least 13 years old; for a younger child, the consent of the legal representative is needed (IKS § 8 lg 1 and 2) [10].

Processing special categories of data, such as health data, biometric data used to uniquely identify a person and data on trade union membership, is prohibited (GDPR Art. 9(1)) [11], except in the cases listed in the article, for example where the person has given explicit consent or where processing is necessary to meet obligations under employment law (GDPR Art. 9(2) p a and b) [11].

What must a business tell people?

Where data are collected from the person themselves, the business must, at the time the data are obtained, tell them among other things the controller's name and contact details, the purpose and legal basis of the processing, the legitimate interest where processing relies on one, and, where applicable, the recipients or categories of recipients of the data (GDPR Art. 13(1)) [2]. It must also state the storage period or the criteria for determining it, the person's rights and the right to lodge a complaint with a supervisory authority (GDPR Art. 13(2) p a, b and d) [2].

The information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language (GDPR Art. 12(1)) [3]. Providing the information is free of charge (GDPR Art. 12(5)) [3].

What rights do people have and how quickly must a business respond?

• Access. A person has the right to confirmation of whether their data are being processed, and to access the data and information on the purpose of processing, the recipients and the storage period (GDPR Art. 15(1)) [12]. The business provides a copy of the data being processed; for further copies it may charge a reasonable fee (GDPR Art. 15(3)) [12].
• Rectification. Inaccurate data must be corrected without undue delay (GDPR Art. 16) [13].
• Erasure. Data must be erased, for example, where they are no longer needed for the purpose, where the person withdraws consent and there is no other legal ground, or where the data have been processed unlawfully (GDPR Art. 17(1) p a, b and d) [14]. The duty to erase does not apply where processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims (GDPR Art. 17(3) p b and e) [14].
• Objection to direct marketing. A person may object at any time to processing of their data for direct marketing (GDPR Art. 21(2)) [15]; after that, the data may no longer be processed for that purpose (GDPR Art. 21(3)) [15].

The business must inform the person of the action taken on a request at the latest within one month; where necessary, taking into account the complexity and number of the requests, this period may be extended by two months, informing the person of the extension and the reasons within one month (GDPR Art. 12(3)) [3]. If the business does not act on the request, it must give the reasons within one month and explain the possibility of lodging a complaint (GDPR Art. 12(4)) [3]. For a manifestly unfounded or excessive request, it may charge a reasonable fee or refuse to act; the burden of proof lies with the business (GDPR Art. 12(5)) [3].

A person may lodge a complaint with a supervisory authority (GDPR Art. 77(1)) [16], and anyone who has suffered material or non-material damage as a result of an infringement has the right to receive compensation (GDPR Art. 82(1)) [17].

What to do if data leak?

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (GDPR Art. 4(12)) [7].

• The supervisory authority must be notified without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people's rights and freedoms (GDPR Art. 33(1)) [4].
• The notification describes the nature of the breach, its likely consequences and the measures taken, and gives a contact person's details (GDPR Art. 33(3)) [4]. If not all the information can be provided at once, it may be provided in phases (GDPR Art. 33(4)) [4].
• A processor (volitatud töötleja, e.g. an IT service provider) must notify the controller without undue delay (GDPR Art. 33(2)) [4].
• All breaches must be documented, including those that are not notified (GDPR Art. 33(5)) [4].
• If the breach is likely to result in a high risk to people's rights and freedoms, the people themselves must also be informed without undue delay (GDPR Art. 34(1)) [18]. This is not required, for example, where the data were protected by measures that render them unintelligible, such as encryption (GDPR Art. 34(3) p a) [18].

How large are the fines?

The misdemeanours set out in the Personal Data Protection Act are punishable by a fine, and the Data Protection Inspectorate is the extra-judicial body conducting their proceedings (IKS § 73 lg 2) [19].

• Breach of the processing principles and the rules on consent: for a legal person up to 20 000 000 euros or up to 4 percent of its worldwide annual turnover of the previous financial year, whichever is higher (IKS § 65 lg 2) [6]; the same maximum applies to breaches of data subjects' rights (IKS § 66 lg 2) [20].
• Breach of the obligations of a controller or processor (including breach notification, security and the processor contract): for a legal person up to 10 000 000 euros or up to 2 percent of its worldwide annual turnover of the previous financial year, whichever is higher (IKS § 62 lg 2) [21].
• A person who has access to personal data through their work or official duties and unlawfully collects, views, uses or makes queries about them may be fined up to 200 fine units (trahviühik), unless the elements of an offence under § 157 or 157¹ of the Penal Code (karistusseadustik) are present (IKS § 71) [22].
• The limitation period for these misdemeanours is three years (IKS § 73 lg 1) [19].

In addition, if a precept of the Data Protection Inspectorate is not complied with, a penalty payment (sunniraha) may be imposed, each time up to 20 000 000 euros or, for an undertaking, up to 4 percent of its worldwide annual turnover of the previous financial year, whichever is higher (IKS § 60) [23].

What the law says

• „Isikuandmete töötlemine on seaduslik ainult juhul, kui on täidetud vähemalt üks järgmistest tingimustest“ [1] (translation: processing of personal data is lawful only if at least one of the following conditions is met; GDPR Art. 6(1)) – without a legal basis, data may not be processed.
• „Lõike 1 täitmise eest vastutab ja on võimeline selle täitmist tõendama vastutav töötleja“ [8] (translation: the controller is responsible for, and able to demonstrate, compliance with paragraph 1; GDPR Art. 5(2)) – the business must be able to show that its processing complies.
• „Nõusoleku tagasivõtmine on sama lihtne kui selle andmine.“ [9] (translation: it is as easy to withdraw consent as to give it; GDPR Art. 7(3)) – withdrawal may not be made difficult.
• „Kui järelevalveasutust teavitatakse hiljem kui 72 tunni jooksul, esitatakse teates selle kohta põhjendus.“ [4] (translation: where notification to the supervisory authority is made later than within 72 hours, it is accompanied by reasons; GDPR Art. 33(1)) – a late notification must be explained.
• „Kui andmesubjekt esitab vastuväiteid otseturunduse eesmärgil toimuva andmete töötlemise suhtes, ei tohi isikuandmeid sellisel eesmärgil enam töödelda.“ [15] (translation: where the data subject objects to processing for direct marketing, the personal data may no longer be processed for that purpose; GDPR Art. 21(3)).

What to do

1. Map which personal data the business processes, for what purpose and on what legal basis (GDPR Art. 6(1)) [1]. Keep a record of processing activities; its contents are listed in the Regulation (GDPR Art. 30(1)) [24]. An enterprise with fewer than 250 employees must keep the record where its processing is likely to result in a risk to people's rights and freedoms, is not only occasional, or includes special categories of data or data relating to criminal convictions and offences (GDPR Art. 30(5)) [24].
2. Draw up a privacy notice containing all the required information (GDPR Art. 13(1) and 2) [2].
3. Conclude a written contract (including in electronic form) with every processor that processes data on the business's behalf (GDPR Art. 28(3) and 9) [25].
4. Apply technical and organisational security measures appropriate to the risk, such as pseudonymisation and encryption (GDPR Art. 32(1) p a) [26].
5. Check whether you must designate a data protection officer (andmekaitseametnik), for example where the core activity of the business is large-scale processing of special categories of data (GDPR Art. 37(1) p c) [27]; the officer's contact details must be published and communicated to the supervisory authority (GDPR Art. 37(7)) [27].
6. Set up a procedure for answering people's requests within one month (GDPR Art. 12(3)) [3] and for notifying the supervisory authority of a breach without undue delay and, where feasible, within 72 hours (GDPR Art. 33(1)) [4].

Frequently asked questions

Does a business always need the person's consent?

No. Consent is one of six legal bases; processing may also rely, for example, on performing a contract, a legal obligation or a legitimate interest (GDPR Art. 6(1) p b, c and f) [1].

How quickly must a request for access be answered?

Without undue delay and at the latest within one month of receiving the request; where necessary, taking into account the complexity and number of the requests, the period may be extended by two months (GDPR Art. 12(3)) [3].

May a business charge for answering a request?

As a rule, no: informing the person and taking action are free of charge (GDPR Art. 12(5)) [3]. A fee may be charged for further copies (GDPR Art. 15(3)) [12] and for a manifestly unfounded or excessive request (GDPR Art. 12(5)) [3].

Must every data leak be reported?

The supervisory authority need not be notified if the breach is unlikely to result in a risk to people's rights and freedoms (GDPR Art. 33(1)) [4], but the breach must still be documented (GDPR Art. 33(5)) [4].

Does a small business need a data protection officer?

A data protection officer must be designated, for example, where the core activities involve large-scale regular and systematic monitoring of data subjects or large-scale processing of special categories of data (GDPR Art. 37(1) p b and c) [27].