"Population register information is rarely requested for advertising purposes. Only a few times a year for direct mailing; for example, in 2022, data was issued in this way twice and this year just once," Pungas told ERR.

Last year's two queries provided information on 89,637 addresses, where the sampled persons lived, and this year's query provided information on 70,000 home addresses.

According to the department head, it could be legitimate to obtain information from the population register when the residential addresses of a specific target group are needed.

"If a company wants to send a mailing to a specific target group related to its business, it will request the residential addresses of a specific region and age range. For instance, a publisher might want to market its products to a specific age group and this is how the sample then will be derived from the population register," he explained.

Pungas said that personal information is not shared for advertising purposes, only the addresses of people who are willing to share it. For example, the sample consist of Estonian residents aged 18 to 80. In this case, only addresses with at least one resident between the ages of 18 and 80 will be issued. The number of other residents at an address, their identities, etc., are not shared.

Pungas emphasized that population registry data cannot be used for advertising at all: solely on the basis of a legitimate interest, additional addresses and contact information of individuals, such as telephone numbers and e-mail addresses cannot be released to advertisers. Moreover, even home addresses can only be disclosed if the individual has not restricted this access.

"In the case of advertising that ends up in the mailbox, it usually means that there is an agreement between the postal service provider and the advertiser or the recipient's consent to receive mailings from a service provider," Pungas said. 

Data can be requested by anyone

Pungas went on to explain that, in principle, anyone can request data from the population register, but for each request it is decided whether the data can be shared. The decision is made in accordance with the Population Register Act.

"If the law permits the release of data, it could be shared, and if there is no basis for it, the request would be rejected," he said.

Section 47 of the Population Register Act permits the dissemination of information from the population register that does not directly or indirectly identify an individual, such as a list of the home addresses of sampled individuals based on certain characteristics.

"The data is shared anonymously, i.e., in an unidentifiable format, only addresses, without the names of the residents are released. The identifiers usually given are sex, age, residence, mother tongue, education and marital status. Generally speaking, a combination of such characteristics would be necessary," Pungas went on to say.

Thus, the purpose, method and timeframe of the data's use must be specified when requesting it and the Ministry of the Interior has to verify that the applicant has a valid interest.

"Only if it does not violate privacy or constitute a threat to national security is data access authorized," he said.

The register can be accessed in many other ways

In addition to one-time data requests, permanent access to the population register can be also justified if necessary. "It depends on whether the data are required for a one-time event or whether the need is ongoing," Pungas said.

According to Pungas, the rules and regulations of the numerous databases specify which registers (including the population register) and data are used. "For example, if a user logs into a self-service environment, his or her right to use the service is checked as soon as he or she logs in, and if necessary, the environment is already pre-filled with the data."

Pungas explained that many of the services/subsidies provided by local governments are linked to a person's place of residence, which means that the need to use the data is permanent. So the majority of public authorities have permanent access to the population register.

"Many of them have multiple purposes. The Police and Border Guard Board (PPA) has many different responsibilities; for example, they have to check data when applying for an identity document. The Social Insurance Board (SKA) has to check data from the population register when paying benefits and providing services."

The register is also used by private companies

Pungas went on to say that legal entities also use data from the population register on the premise of a legitimate interest. "Banks and credit institutions must verify data to establish a customer relationship under the Prevention of Money Laundering and Terrorist Financing Act or to send a notice to the person, etc., wherever it is necessary to check name, capacity, identity documents, death details, etc.; debt collection agencies to fulfill their contractual obligations, both to send a notice to the person and to file a claim in court; communications service providers, and the list goes on."

Data release decision-maker depends on data volume

One-time data releases are handled by different authorities based on the amount of people requested. The local authorities decide on the release of data for up to 20 people, the authorized processor of the population register at the Ministry of the Interior decides for 20-100 people and the Ministry of the Interior decides for 100+ people.

"For example, design firms would request data from public authorities in order to notify property owners of works and coordinate projects, law firms will have the right to request data from public authorities in order to perform legal services, and even private persons will request data for a variety of reasons," he said.

Most applications from private individuals are rejected

"Many refusals involve requests from private people, where it usually turns out that the requester lacks a legitimate interest or that the release of the data would compromise the privacy of a person," Pungas said.

"Moreover, in some cases, a request for a person's data may be motivated by a personal interest, which is certainly not a valid reason to release a person's data," he added.

The Ministry of the Interior has refused to release data once this year and twice last year.

During the process, the applicant is contacted and the conditions are discussed and the applicant often withdraws the request. "What is important for us is to clarify, not to end the procedure with a refusal," Pungas said.

The collection and dissemination of data from the population register has come under public scrutiny in connection with a study commissioned by the Pere Sihtkapital foundation, which many saw as a breach of privacy rights.

--

Follow ERR News on Facebook and Twitter and never miss an update!