It is quite telling that the Prosecutor's Office has finally decided to stop relying on communications data as evidence in criminal proceedings. Carri Ginter, you and your colleagues published a thorough analysis titled "Mass collection of communications data being done for inadmissible purposes in Estonia" already back in 2017. What motivated you to analyze the situation seven years ago?

The roots of this matter go back to 2014, which is when the European Court of Justice (ECJ) first said, in no uncertain terms, that the handling of communications data cannot treat every citizen as a potential criminal. That relevant data can only be used and collected to investigate serious crime. And then there's the dissonance with what's really happening, where this data was used by fishing inspectors, to catch people smuggling cigarettes etc. That is when we started looking for answers in terms of jurisprudence.

Then-university student Piret Schasmin, who is a sworn attorney today, agreed to dive into this matter and we dug up a pretty horrifying bundle of problems. It turned out that there were regular, largely tolerated and at times even approved breaches of human rights in Estonia.

Now-sworn attorney, then-university student Kätlin Sehver did another foray into the matter some years later and we concluded that the Estonian police and prosecution were in for a world of trouble, as the courts would throw out this kind of evidence sooner or later. Now, they seem to be lamenting their situation.

It seems to me, as a lawyer, that we've had at least a decade in which to sort out this matter. While there have been several amendments, we haven't changed the system and have rather buried our head in the sand.

Why wasn't the system fixed for a decade?

We've had a public debate. This is not the first time the topic has been raised. Sworn attorney Silver Rainsaar even took it to the ECJ. And the European court said that our system was in breach of human rights. What followed was a campaign of collective denial by the justice minister, the Ministry of Justice and the Prosecutor's Office. There is no other way to describe it – it was denial, and it was in the hopes that the problem will just go away. But it didn't.

Let's recall that telecommunications service providers are obligated, by section 111 of the Electronic Communications Act, to collect and store data in a way to make it possible for law enforcement to identify the source and target of communications, the date, length of session and time of day. In other words, is there a valid law in Estonia that clashes with EU law?

It is in breach of not just EU law, but human rights. Human rights as provided at the EU level, in the fundamental rights charter, in the European Convention on Human Rights. And we've known for years that it is also in breach of our own Constitution.

All of these aspects have been warranted in court. They are not legal fantasies. In other words, Estonian law has a section in a valid act which the Supreme Court has found to be such a garish breach of human rights that it should be excluded from the law. It has been unconstitutional from the moment of its creation. Whereas different compositions of the Riigikogu have remained silent on this matter.

The Riigikogu, Ministry of Justice, Ministry of the Interior and the Office of the Prosecutor General have all been silent?

Fixing this thing falls mainly to the Riigikogu. The fact that the parliament is tolerating ministries riding roughshod is a criticism of the Riigikogu and its compositions over the last decade. This omission does not belong to the current composition. which has been in office for a relatively short time.

It is very difficult for me to sugarcoat – a state that fails to comply with its own court decisions... how can we describe it as democratic and based on the rule of law? We've read European Court of Human Rights (ECHR) decisions about Russia or Belarus ignoring things, while we're ignoring what our own Supreme Court has found, what the ECJ, ECHR and plenty of others have found.

A few years ago, when Andres Sutt was still minister of enterprise and information technology, he said loud and clear that people's privacy matters and that the Electronic Communications Act needs to be amended. What he proposed changing where provisions dealing with the use of Huawei technology in communication networks. But the provision that has to do with human rights violations was not amended, neither by the minister nor the Riigikogu, even though the matter was paid plenty of attention by others.

In whose interests?

I couldn't tell you, but I think it boils down to administrative laziness. I mean it's easy to catch bike thieves and petty crooks by using cellphone metadata. It's difficult to understand why I shouldn't do something like that. It's much more difficult to make sense of human dignity and how cell positioning clashes with it. The latter task might be too much for some or fall below the threshold of what interests a person.

Henry Timberg from the Ministry of the Interior describes it as a case of putting different fundamental rights in contrast, as both the inviolability of private life and the right to security are important. How to strike a balance between the two?

I'm saddened to have to listen to this kind of argumentation, as the weighing of rights already took place in the European Court of Justice in 2014 and 2016. The ECJ has been through it and found that using communications data this way is such a glaring violation of human rights as to not be offset by the security argument.

Coming out with the same argumentation a decade later amounts to suggesting the ECJ are fools. They deliberated and found that the case to be made for security does not outweigh the existing reform, while our officials are once again suggesting it should be considered.

Lawyers distinguish between infringement and violation of basic rights. Yes, there is an infringement on the right to security, while there is violation of the principles of human dignity. Rights violation is inadmissible, while infringement can be admissible in certain cases.

Perhaps the reason is that the world has gotten a lot crueler and there is more terrorism in it?

So they say, and we're not contesting this point. But you can use the data to combat terrorism, which is where this particular argument ends. But if we look at when such rights were first born – the right to the inviolability of one's home and privacy – it was before Billy the Kid was born. /.../ And we cannot claim that it was somehow very safe to live in America at the time. I feel much safer today than when Billy the Kid was running around.

Where do we draw the line? Let's say a bomb threat is made against Sorainen's offices in the heart of Tallinn. I'm sure you'd want to know who called and from where?

That's a great question in that it demonstrates how the narrative has gotten out of hand. There is an entirely normal amount of data that Elisa or Telia or others are collecting. For example, that I used my phone and the area my phone was in at the time. They collect such data, retain it for a sensible period of time, bill me for the service, and once I've paid my bill, the data should be deleted.

Now, the state tells us that because telecoms are collecting this data anyway, everything is just fine. The reality of the situation is that the telecoms store this data long enough for cases of cybercrime, fraudulent calls or emails to be discovered. The problem is created when the prosecution or police are too slow to access the data before it is deleted, following business considerations. That is when they say that telecoms should keep collecting data and store it for longer.

Data pertaining to terror attacks, bomb threats or something else is there for between three and six months anyway. The question we need to be asking is why does it take so long, during these critical moments, to request the data from the telecoms on entirely legal grounds. It is not a question of whether the telecoms should have the data, it's a question of how many years it must be preserved under the threat of state enforcement.

And what would be a sensible time?

There are business considerations involved, but I think that when dealing with a bomb threat or a case of an old lady getting swindled out of her savings, accessing the data inside three months without violating anyone's basic rights should be entirely realistic.

The Ministry of the Interior has suggested an amendment where storing and accessing communications data would be admissible when dealing with national security or severe crime, including anti-terrorist efforts. But who should judge the severity of crimes? Where should the access threshold be set?

We live in an imperfect world. There is no such thing as a perfect system. But one of the times we lost, the Office of the Prosecutor General lost in the ECJ – the dogfood case (the European court ruled, based on the case of a woman who stole dogfood, that Estonia is using inadmissible communications data as evidence – ed.) – it was decided that whether to allow access [to communications data] needs to be decided by a judge, as the prosecution is not a neutral party to proceedings.

It took years to find that out in the European Court of Justice, even though it would have been easier to just ask me.

If the task falls to judges, the next question is how serious are judges about their duties. I think it's feasible if we explain to judges that it is a crucial matter and subject to supervision. We would have at least some kind of checks and balances. But right now, all we're told is that there is a mystical log being kept somewhere that protects our rights. It buys me no security whatsoever.

I made inquiries a while back. I believe there were six agencies with access to the data. I asked about my phone and those of my colleagues Allar Jõks and Kaupo Lepasepp – who's had access and whether the data has been used. We learned nothing at all from the replies. Based on what, then, should I trust the state to exercise its own supervision?

I recently took a similar journey with one of my students when we dove into the police's POLIS database. It stated publicly that any images taken by cameras will be deleted or blurred. I found a picture of my brother and his girlfriend there, and a speed camera picture of my underage child. Why would the police have a picture of a law-abiding 14-year-old girl in their database? On what legal grounds, in a situation where the ECJ says that even images of criminals cannot be stored beyond a certain period of time.

I have little faith in that our data is well protected by the state. While there is no massive misuse right now, the system should be structured in a way to minimize the possibility of misuse or for there to be effective supervision.

/.../

In early October, the Tallinn Circuit Court overturned a Pärnu County Court ruling that had allowed law enforcement to monitor the calls of a family living in Suure-Lähtru with the aim of collecting information and case materials against a member of the family arrested in Morocco. The circuit court found that the surveillance permit had no legal basis. But the damage was already done.

Yes, let us be glad that the court finally arrived at this conclusion. On the flip side, this also means that such permits were freely issued until 2024. That the authorities checked data they had no right to check, which amounted to a human rights violation. Now, one court has decided to put an end to the communications data mess that has gone unresolved for ten years. I find ironic the prosecution's reply, according to which they haven't been using such data for three years. If you haven't been using the data for the past three years, talk of it being crucially important sounds kind of hollow.

Does the Suure-Lähtru family have a claim for moral damages? How many others in Estonia could have such claims?

We have been considering trying our luck in court with this thing for years. But going to court is an extremely exhausting ordeal, which requires money and good cardiovascular health. I also have a family, children to take care of and other obligations.

However, in principle, every Estonian can say that their fundamental rights have been violated by this blanket collection of metadata. It is the right of everyone who carries a mobile phone. The question we need to ask is what will the court do with those claims. There are two options, broadly speaking. You would either get judges like the ones in the Suure-Lähtru case, who would pull themselves together and say that we're dealing with an unacceptable and long-term violation of human rights, or you could just have the state apologize, the court deem it sufficient and everyone cover their own expenses.

Let us talk about the case of Bigbank owner Parvel Pruunsild whose defense counsel has said he plans to sue the state over the preservation of communications data and seek fair compensation. What are the possible outcomes, should the administrative court accept the case?

I believe it's good what he's doing. He is not my client, nor is this my case, but the people who understand have a kind of obligation to act. If he understands and has access to quality legal assistance, he should at least try to clear the air a little and say that such pragmatism clashes with our values.

I have kept up with the case. I believe there are thousands of violations against him, thousands of pieces of information on him throughout the years. Every time someone collects data on me and puts it in a database for the purposes of storing it, my human rights have already been violated beyond the obligation to retain data.

Let us take the example of cases against journalists where false information has been published. Claims one, two and three. Every false claim counts toward the compensation sum. If you get it wrong once and issue an apology, we could be talking about a modest sum. But if there are thousands, the court could take this into account.

The other thing the court should consider is whether the state could have been aware it was breaking the law. And it most certainly could have. Urmas Reinsalu was justice minister at the time and said, in no uncertain terms, that the practice will continue.

I looked up a piece from ERR from July 3, when the previous government was still in office, reporting that the Ministry of Justice had no intention of putting an end to the blanket data collection. On July 3, the Estonian state said, in the person of the [previous] justice minister, that we aim to continue human rights violations. /.../ The court should consider that it is conscious action, they should consider whether it's possible to claim we made a mistake in a situation where the ECHR took a stand in 2015, the ECJ took one in 2014 and our court has taken one as well. What would the state counter with? That we did violate basic rights but only a little?

/.../

Is it possible that this case will move from the Estonian administrative court to the ECHR?

There are several ways it could go. It's possible to go with the European Convention on Human Rights, which even allows Supreme Court rulings to be appealed. It is possible to write to Strasbourg based on article six of the convention, or fair proceedings, honor, dignity or whatever, for four months after the top court rules. Secondly, an administrative court judge could seek a European preliminary ruling themselves. For example, as concerns the extent of compensation or relevant conditions. The third path would be to appeal the matter in the Supreme Court on grounds of constitutionality. However, that would be superfluous, since the Supreme Court already found the practice unconstitutional several years ago. There are two paths to Europe here, and it is a very interesting case.

The Estonian Constitution was praised because it prescribed, back in the early 1990s, a very thorough human rights catalogue and a rare provision, in section 10, according to which new fundamental rights could be added, which do not have to be written down [in the Constitution]. That life and social development might just give rise to new rights. The European Union didn't have a binding fundamental right charter until the 2009 Treaty of Nice. In this sense, Estonia even served as an example for the EU, at least when it came to written law.

Would any decision from Luxembourg constitute an obligation for the Estonian justice system?

Yes, any instructions from the ECJ on how to interpret law are mandatory for our courts. It has happened before. Some people may still remember EU sugar fines, which were considerable around the time of enlargement. The Supreme Court found at the time that one of our laws was in breech of EU law. Next time the matter came up, a judge from a first tier court wrote to Luxembourg and the court in Luxembourg said the Estonian law was brilliant and a great fit with EU law. The judge had to proceed based on the instruction from Luxembourg, not our own top court.

Returning to the matter of communications data, sworn attorneys have said that no one has told the Estonian state that it cannot collect or use communications data, simply that this use needs to be proportional. Who decides what is proportional and what isn't?

This is a bit of a generalization. The ECJ has said that obligating telecoms to indiscriminately collect data is illegal in this form. What's the minimum threshold, what's permissible and what isn't comes down to a hundred tiny details in the end.

But if we want to understand the problem, we need to divide it in three parts. First, how data is collected and what kind of data is collected. Second, how it is stored and who can access it. Finally, how to make sure it ends up getting destroyed.

There needs to be a system of sufficient guarantees at those three levels before data can be collected and used. Right now, those guarantees... when I talked about the police database before. Why do they have a picture of my daughter? Where is trust created that the data is not being misused?

Could it be done with legislation?

Of course. That is also where an obligation to delete or destroy the data is crucial. If the law obligates someone to keep tabs, you end up with a kind of local "Facebook" where you can go back in time 10, 15 or 20 years and see what interesting things people got up to. But people have the right, based on the principle of human dignity, to grow, change where they stand on things and in some ways live a new life ever day, compared to where they were 20 years ago. I hope that I have grown from the me 20 years ago. But if you were to bring up phone calls or messages or stupid things I've said in my early 20s, how would that help improve society?

It's like a stick.

Yes, it is repressive apparatus in some ways. It could be a case of the Estonian state being built on values, us having such a [social] contract. We come from the Soviet Union, we know what it means when the state takes away your freedoms. We have put freedoms front and center in our Constitution. They are not fourth-rate, in the seventh chapter or added after the fact in 2009. We have agreed that our society is based on liberties.

Suddenly we want to do things "faster and more efficiently" in law enforcement. These two arguments do not even exist on the same scale for me, because we have no such social contract as a people. The people have not come together to write a constitution where you have cameras everywhere, everyone is constantly under surveillance and a person can forever be punished for anything they've said or done. Where you have to become the kind of person the order of the day requires.

A few years ago, it was considered entirely normal for everyone to sit at home, effectively detained for the purposes of combating the coronavirus. Were we to restart the debate today, even governments would no longer deem it a sensible approach. The mood has changed. And the only thing that protects us from stuff like this is a society based on liberties. We will continue to demand the protection of our fundamental rights even if it clashes with the "faster and more efficient" cast of mind.

Of course, the fastest and most efficient way to monitor your movements or issue you a traffic fine is through your phone. I'm reminded of the Hollywood movie "Demolition Man" where a machine on the wall issued you a fine for using foul language. Today's decision-makers are not prepared to be held responsible for the kind of people that such a society raises.

Let us move on to the part of protection of personal information you've spoken out on before. Namely the plan to start measuring speeds with average speed traps. You've said that you perceive the risk of mass screening of motorists?

Let's say things aren't as bad in traffic. When I'm at a church AA meeting, my idea of privacy is different from what it would be in the city's central square. There is a difference.

However, in the big picture, the foundation of the cameras theory is that a person who knows they are being watched behaves differently. There is an endless array of studies on this. The things I've looked up included social isolation, stigmatization, surveillance fatigue, the impact on behavior and compliance, effects on mental health, the normalization of surveillance – all phenomena associated with CCTV. The psychological aspect of it is underestimated, how it affects people living in such an environment.

Instead, we are asked whether we're proponents of speeding or whether we believe speeding kills. But it's a slogan to say that speed kills. There is truth to it, it is scientifically proven. But – and I've said this before – we made inquiries, and the Estonian state does not have data to suggest that exceeding the speed limit by less than 20 kilometers per hour affects the number of serious collisions to any notable degree. There is no such data.

I was just in Dubai where speed traps are activated when a driver exceeds the speed limit by at least 20 kilometers per hour. There is logic to it if we think about the moment when the speed trap stops being a ticket machine and starts acting like a traffic moderating tool to when it starts protecting people's rights. The right to life and health etc.

Now, on the one hand, we have people's behavior when they know they're constantly being monitored. Whereas this aspect is chronically underestimated and brushed aside by suggesting that those who have nothing to hide have nothing to fear. They have something to fear.

After a meeting with high school students, a teacher came up to me and told me of a father and daughter who started swapping school stories one evening. The father described how he had clambered up a waterspout to be with his girlfriend and how they used to sneak past the guard lady. Listening to these tales, you have a father who has turned out to be a great person with stories to tell. But the "faster and more efficient" people would now tell you that climbing up waterspouts is bad or that the rules are there to be obeyed. But the scariest aspect of it all was how the daughter was flabbergasted and said that their situation is completely different, as such things simply cannot happen because of cameras everywhere.

It is a very confusing story. How do we know the effect this kind of environment is having on who the daughter will become as a person? What would she have become had there been no cameras? So it seems to be, based on studies, that it does affect matters. The person acts differently along the lines of what they think the one watching the camera feed wants to see or would deem suitable.

I'll now give the example that is always given in such debates. The first thing people who have had expensive machinery stolen from farms in Southern Estonia are told to do is install security cameras.

Yes, and I'm well within my rights to install security cameras where I live. The problem is created when I start monitoring others.

Let's say we run an Airbnb and install cameras without telling our guests who will just go about their business totally oblivious. Does it seem fair to them or a nice thing to do, something we should be encouraging? I mean they could steal a book or do something else that's not nice. It boils down to where it becomes snooping after people.

If you want to monitor yourself, be my guest. But I do not, for example, monitor my children with cameras because I don't think it is good for them. I believe it would be a bad influence.

We were meeting with high school students and a really smart girl told me that she doesn't care about surveillance. I was a bit startled in terms of what she meant. And she said that her parents had been monitoring her from the first. That they read her messages and pinpoint her location and that she doesn't care one bit. I was trying to decide whether she was just stupid, but then I asked whether she thinks it has affected her in any way. She gave it some thought and said, very sincerely, that she had become a great liar as a result.

In other words, the parents' wish to ensure their daughter's safety – just as society wants to ensure everyone's safety by putting cameras everywhere – has resulted in that person now being adept at fooling them. I don't know whether she uses burner phones, leaves them at a friend's house or writes fake messages to distract her mother. Had the parents known that they were developing their kid's ability to be deceitful, some may have opted out and concentrated instead of developing trust and sensible oversight.

Basic use of security cameras is necessary and tolerable, but the endless desire to keep adding more will usher in a deceitful society full of secretive people. And it will be extremely difficult to reverse such developments.

/.../

Apartment associations are a perfect example. We recently had a major discussion where a person whose car got scratched in the parking lot was lamenting the absence of security cameras. As a lawyer, you've lost before it even starts. Because a person whose car has been scratched couldn't care less about human dignity, the future of society and how people turn out. Their car is damaged and they want to know who's responsible. They ended up claiming that an apartment building's hallway is not public space. That the cameras should start in the hallway.

I laughed and told them to imagine a situation where they'd want to sneak over to the lady next door, which has been part of the human experience from the first, but instead they'll have the apartment association keep tabs on them and on whether the lady next door is a proper lady or not. And how it would affect their lives weighed against security in the hallway. They gave it some thought and admitted that they might not like cameras in the hallway after all.

Meanwhile Russia has such a system in place. They can link apartment associations' intercoms directly to the police database, which the latter used to catch people violating Covid isolation rules. Now imagine trying to build a political opposition in Russia. They know who sleeps with whom, where people meet, whereas you have no oversight over any of it.

But if I took it to my apartment association and said that the police are offering us a direct link between our intercom and their perpetrator database, I believe it would be voted in. I believe a lot of apartment associations would take that deal because they don't know to think about it in the key of it jeopardizing democracy or political plurality, not to mention people's right to have lovers or, I don't know, visit kids they were too timid to claim as their own. A lot of things can grow out of that intercom. And now we're being told what a brilliant idea it is to have cameras on the highways that know where you're coming from and where you're going.

Are you saying that more cameras does not equal more security?

It can equal more security in the sense that if the state knows at all times where you are, who you're with and how fast you're going, it is possible to take you away very quickly should the need arise. Very safe that, and the others can breathe easy. As soon as you become unsuitable or behave incorrectly from the state's point of view.

A simple example from my own life is a teenager smoking or vaping in the street. Imagine the police finding out, showing up to take them away and holding them for a time in a cellar somewhere. Did we end up with a safer society? Because a minor who's smoking is breaking the law. They were security guards in this case. But is the state now more secure because security guards detained a teenager who was caught smoking in the street only to hand them over to the police who promptly released them?

What about if it's a narcotics crime?

That's the question, whether the apparatus should emulate Stalin in that if we find the man, we can find them a crime. We have enough laws to find something for everyone.

You also spoke up when the Tax and Customs Board wanted to start monitoring bank accounts to detect tax evasion. It didn't take off if memory serves.

It was bad communication. Because if the tax authority wants to know how much money passes through my account during a set period of time, all they need to do is ask the bank. That is enough for them to launch proceedings and check whether I should be registered as a VAT payer.

In 1995, the "Citizens' State Manifesto" was published in which [former PM] Siim Kallas describes the kind of country he would like to have. When the Reform Party was getting started, they did not want to build a state where the tax board is in your bank account to see what's happening there. Or in your bedroom or anywhere else one would build a surveillance society.

Today, it's increasingly the "faster and more efficient" mindset that comes out on top. If I have access to your accounts, I can find out all kinds of interesting thing on top of what I wanted. This is where the proportionality aspect comes in. That you do not always need all the information to carry out your task. Just like the police do not need to have my daughter's photo on file. The same goes for the Tax Board. They can just ask the bank to find out who needs to pay VAT without anyone protesting it.

Now imagine if they had the right. My account betrays business secrets – where I buy things, how much I pay, who I do business with and where I got my equipment. All of it can be garnered from my bank account. How difficult would it be to bribe a single tax agent to take pictures of it and hand them over... talking about big money.

That is why we need to weigh it against the risk of commercial secrets and privacy. Bank accounts also reveal lovers, where you went on holiday etc. The risk of blackmail. In return we get what? Faster and more efficient tax receipt.

/.../

I wanted to recommend a book, but I fear I've lost my notes. Interesting things have been written about the surveillance society tendency. The book deftly points out that while searching your house requires a permit from the court, going through your communications data does not. The state is authorized to access it without permission from the court. But it is generally accepted that your phone reveals a lot more about you than a search of your home. The book raised the rather interesting question of why searching your house requires a court permit, while profiling you based on your electronic data does not.

Just a case of the law falling behind progress.

Yes, but technology keeps developing. For example, the Brits are testing an AI-based speed camera that looks inside your car, at whether you're wearing a seatbelt and what you're doing behind the wheel. It also makes it possible to know – strictly for "planning traffic flow" of course – where you're going or coming from. Technology keeps developing. The latest bit of tech news I heard was that the systems that monitor the tire pressure in your car have radio transmitters so the car would know you're getting a flat. But they also have individual codes and there are radio receivers under bridges in the U.S. that can map out where a car has been based on those signals from the tires.

It's interesting how technology keeps developing, whereas we're not talking about science fiction here but completely everyday things. The person who wanted to monitor whether your tires were running out of air was probably not keeping tabs on you. But, basically, even if you don't take your phone, they'll still know where you've been from your tires.

--

Follow ERR News on Facebook and Twitter and never miss an update!