Data inspectorate: Entertainment outlets taking personal data against law
The Data Protection Inspectorate (Andmekaitse Inspektsioon) finds that an idea presented by Ministry of Social Affairs undersecretary Maris Jesse, of registering each visitor to public spaces such as restaurants and theaters, in an effort to curb the spread of coronavirus, would intrude on people's personal lives and would be contradictory to current legislation.
Jesse told daily Eesti Päevaleht (link in Estonian) that the ministry has started looking at options to take down contact details of visitors at restaurants, cinemas, theaters and other public spaces in order to facilitate rapid contact if an individual or individuals later found to be carrying the coronavirus were present at the same time.
Maris Juha, Supervisory Director at the Data Protection Inspectorate, told ERR: "We are used to being able to consume entertainment anonymously, and the collection of personal contacts at venues would be an intense violation, leading to a likely fall in visits, because many would not go if such a requirement were set."
Juha added that there was no possibility for such data collection within the current legislative framework. "The only theoretical possibility would be at the individual's voluntary consent," she said, adding that the establishment cannot refrain from providing service if a person does not agree to divulge their contact information, as things stand.
Juha also noted that while data collection at present is carried out on a voluntary basis, it needs to be both proportional and purposeful.
She added: "But currently, the question of if and how much this data collection would fill its purpose still remains up in the air and how could it possibly be done in a specific and minimal way."
She added that the inspectorate sees no possible way to go through with this idea.
Maarika Liivamägi, CEO of the Estonian Hotel and Restaurant Association (EHRL) told ERR that the effectiveness of the measure is questionable, because people may not submit accurate information.
Liivamägi said: "If someone writes down 'Mickey Mouse' and add fake contacts, this would be no use."
She also sees a security risk, adding that it is an unknown as to where and who will manage the data. In addition, the practise would present a major responsibility for employees of entertainment establishments, who would have to mark down the visitation times and contacts of anyone and everyone present, at any time.
Download the ERR News app for Android and iOS now and never miss an update!
Editor: Kristjan Kallaste, Andrew Whyte