While the Personal Data Protection Act provides that persons need to grant permission for their personal data to be shared and processed, the situation is just the opposite when it comes to the Population Register from which people's data can be pulled for research or advertising if there is legitimate interest.

"It is not a case of inaccessible data the use of which the person must explicitly allow," said Mairis Kungla, adviser at the population operations department of the Ministry of Internal Affairs.

If a person does not want their data to be shared, they must untick a corresponding box. This can be done for a period of time or indefinitely. However, it does not apply everywhere and in full.

"Usually, data from the Population Register is pulled for the performance of public tasks, while access is also granted to legal persons if there is legitimate interest. A person can restrict access to their data. The same goes for place of residence and whereabouts information concerning for the purposes of advertising and surveys.

Therefore, even if a person has restricted access to their information in the Population Register, it can still be used for the purposes of performing public tasks. For instance, scientific research or debt collection.

That is how the personal identification codes, email addresses and phone numbers of childless women were made available to a pollster that produced an illegitimate contract with the University of Tartu, whereas the personal information of women who had prohibited access to their data may also have been included.

The registrar said that legal grounds are weighed for every case in terms of whether there is legitimate interest.

"It is not a case of ask and you shall receive. It is considered whether there is legitimate interest, whether we can give out the data that is being sought and whether we should. There is an element of assessment involved," Kungla said.

Pollster RAIT Faktum & Ariko, the firm that handled the controversial survey for Pere Sihtkapital, said as much.

"We knew from prior experience that is usually extremely difficult to obtain data from the Population Register in this manner, if only talking about email addresses. /.../ Data is only surrendered in very exceptional cases," said Lisa-Christelle Ester, head of RAIT Faktum & Ariko.

Population Register data was made available to pollsters until last year, while starting from 2023, personal data of people is only available to those performing public functions and if there is legitimate interest.

--

Follow ERR News on Facebook and Twitter and never miss an update!