While the overall picture regarding information available on local government sites has improved over recent years - for example, online forms for social benefits are more easily available - then the poor situation in some areas has only gotten worse.

Before all, the audit states the problem to be in classification of documents, which are often marked as "information intended for internal use", also known as an "AK" (Asutusesiseseks kasutamiseks) marking. This means that noone aside from employees can access such documents.

The inspectorate's audit claims that in some cases, the markings are obviously necessary but in most others it has been set unjustifiably.

Communal correspondence intended for internal use

The Data Protection Inspectorate notes that marking documents with an "AK" marking is often explained with the document containing personal information potentially harmful to a person's private life.

In actuality, the documents are titled "Response letter for waste tax exemption" or "Support measure for biowaste collection", which raise the suspicion of the documents even containing personal data, according to AKI.

Elve Adamson, a lawyer involved in the audit, said: "Often when an institution reaches an agreement with a legal authority, they cleverly add their own data to the contract, forcing the local government to mark the file as 'AK'. Municipalities should be more demanding: documents must contain contacts of the institution, not a private person."

"I have heard of a legend that if you sign an agreement, you should put in some personal information so restrictions can be set just in case," the lawyer added.

Adamson notes that a document in the public document registry can not be judged by its title to contain personal information, but that data is often not involved in a ditch digging agreement.

The lawyer said: "There are many of those documents. If public authorities are writing to each other and the file is marked as 'AK', it seems like that it is used rather freely."

For example, the inspectorate found many unrestricted documents forwarded by a ministry or the justice chancellor, which have been marked as "intended for internal use" at the local municipality level. Similarly, there are many cases of regular correspondence marked as "AK" in the document registry.

It is questionable if correspondence and contracts actually contain such personal data harmful to a person as the Data Protection Inspectorate claims harmful data is certainly not work contacts. At the same time, there are plenty documents available to the public, containing the full names and contacts of private persons.

According to AKI, local municipality governments have gotten more clever in that sense, using reasonings such as "private data" or "trade secret", instead of just marking documents as "AK".

The inspectorate does not accept this either - documents can not contain trade secrets from start to finish. For example, procurement announcements should not be marked for internal use as they need to be accessible to the public.

Adamson said: "I can not go through the entire document registry but I had doubts about one or two documents in more than half the cases. Once you make an inquiry for the files, it turns out they were marked unjustifiably."

But due to the increased work load, all documents can not be taken out for checking.

There were also mistakes with limitation periods and dates. For example, some files were marked restricted for ten years immediately, while the law only permits them to be restricted for five.

Classified public salary data

Since spring of 2019, access restrictions can not be set for employee salary data if they are working in local government, meaning that information should be available in the document registry.

The audit however unveiled that many local governments have classified information such as bonuses and surcharges as "intended for internal use" on the basis of a section in the Employment Contracts Act that claims that salary data should not be publicized without the employees' consent.

This type of data concealment was among the most common violations, present in the case of more than half of all local municipality governments. Many local governments concealed all of their employees' bonus and vacation data.

The audit claims that some cases were indeed justifiable as having personal data, such as maternity leave agreements and funeral allowances, but all documents being marked as containing sensitive personal data is just not plausible.

Adamson said: "Some years ago, I was told that if you publish vacation information, burglars can come because they will know that noone is home. But everyone might not travel for vacation and be away from home. I don't think any burglars are scanning the document registry, looking for when someone is travelling."

She added that people need to know when someone is away from work, especially if they do not have a replacement set for people to turn to.

Social benefit recipients data all out in the open

If documents containing employee salary data were often classified as "intended for internal use", then people turning to the local municipality government for social benefits were in turn often published with their full names and contacts available.

Elve Adamson said: "If we have a document called 'Establishment of guardianship for Mari Maasikas', then we do not have access to the document itself, but the person's name is in the title, therefore revealing the contents of the file itself. This information is then already available."

This action was forbidden in 2016 with legislation not allowing for a person's information to be revealed in public, if the information allows them to be identified.

The aforemention case is especially unfortunate, as the names of those who are most vulnerable and can not defend their rights are often the victims of this. For example, in case of a guardianship, a bystander can conclude that a person can not handle themselves.

Adamson said there were no violations calling for criminal proceedings. But those at fault will be notified to correct their data.

"Awareness can be different," Adamson concludes the data hygiene of local municipality governments' document management.

--

Follow ERR News on Facebook and Twitter and never miss an update!