On 1 November 2023, a legislative amendment entered into force in Estonia, giving the Estonian Data Protection Inspectorate a more effective legal basis for holding companies accountable for breaches of data protection requirements, commonly known as GDPR.
Video cameras in workspaces, restaurants and service areas; GPS devices in company vehicles; website cookie consent pop-ups; automated messages saying, “For better service, your call will be recorded”; inboxes filled with advertising offers; background checks in recruitment processes; or company Christmas gifts for employees’ children. This list leads to several conclusions.
Data protection affects customers, employees and employers alike, as well as both the public and private sectors. Data processing surrounds us and has inevitably become part of everyday life.
Kaisi Udumäe, a member of the management board of DataVie, which provides data protection software and services, explains how awareness and preventive action help companies overcome the fear of fines. An annoying side task and legal provision should instead be turned into a benefit for the company and a sign of trustworthiness.
A fine is most likely when a company refuses to cooperate in improving the situation
WhatsApp received a fine of 225 million euros because its privacy policy, also known as personal data processing principles, were not transparent or understandable. Every data processor has an obligation to make privacy policy available to customers, usually through the company website.
Google Ireland was fined 90 million euros because it made it difficult for people to withdraw their consent (read more HERE). For example, if a person gives a service provider consent to receive advertising offers, they must always have a simple way to withdraw that consent.
In spring, East Tallinn Central Hospital was fined 200,000 euros, although the fine was later annulled in court, because patients’ medical records had been left unattended in a construction container (read more HERE). Compared with the rest of the European Union, Estonia’s previous fining practice had been modest. Until then, the law made it possible to hold a natural person working in the company accountable, which was difficult and, in many cases, unreasonable to prove.
From November onwards, however, it became possible to hold a legal person accountable. This gives the supervisory authority an additional tool to bring companies into line when they intentionally and persistently ignore requirements and/or orders to improve the situation. If a company comes under the attention of the Estonian Data Protection Inspectorate, it is important to cooperate and show a willingness to improve the situation.
Clarity in data protection also protects the company
Let us take a step back. In 2018, the European Union adopted GDPR, whose mission is noble: to protect the personal data of individuals as the weaker party.
Personal data means information about a person that can identify them directly or indirectly, and/or whose disclosure may pose a risk to life and health, identity theft, financial or reputational damage, and similar consequences. Examples include a name, personal identification code, real-time location data, credit rating, biometric data, health data, sexual orientation, racial origin and so on.
The purpose of the regulation is to provide a legal framework so that both parties, the company or institution as the data processor and the individual as the data owner, or data subject, are aware of their rights and obligations. In practice, transparency and clarity in data processing principles protect both parties.
A company can be trustworthy towards both customers and cooperation partners while also avoiding unnecessary disputes with customers. For example, if a customer asks on what basis service calls are recorded and where their data go, the company can quickly refer to its privacy policy and legal basis, avoiding an unintended exchange of lengthy correspondence.
A legitimate interest assessment shows whether the company’s business activity outweighs a person’s right to privacy
The well-known clothing brand H&M was fined 35 million euros in Germany for unlawfully monitoring employees by recording private information about them and allowing more than 50 managers to access that information (read more HERE). The Estonian Data Protection Inspectorate also sent an inquiry to AS Prisma Peremarket asking why the store’s cameras were directed inside fitting rooms (see the Estonian Data Protection Inspectorate public document register, reference No. 2.1.-5/23/1972-3).
Recording video, calls, work-related situations and meetings may be necessary to support business operations. For example, to improve service quality or protect assets. However, this requires carrying out a legitimate interest assessment and providing carefully considered reasons why the activity outweighs the individual’s interest and/or privacy.
For example, video recording to protect property may be justified, but adding audio recording for the same purpose is generally not justified.
Assessing a customer’s solvency before granting a home loan is justified and also in the customer’s own interest. However, assessing solvency before the purchase of a thirty-euro product is likely to be disproportionate and unnecessary.
A company is never fully protected from complaints, data leaks or human error, but prevention helps reduce risks
For entrepreneurs, complying with data protection requirements often feels like a side task that does not appear to support the company’s core business. Quite the opposite, it brings additional activities and costs. For example, the law requires all public sector institutions, without exception, to have a data protection officer. In the private sector, this requirement applies, for example, to companies that systematically process personal data (read more HERE). More broadly, the role of a data protection officer is to build a data protection culture within the organisation so that data protection becomes part of the company’s everyday work.
To comply with data protection requirements, a company should start by mapping its data processing. Having a data processing register is a legal requirement, and the Estonian Data Protection Inspectorate may request it at any time. Mapping data processing gives a complete overview. From there, it becomes easier to identify possible weaknesses, prepare an action plan and determine measures for reducing risks.
Protecting people’s data should be as natural a part of data processing as washing your hands before a meal. Ensuring data protection is not a one-off project, but an ongoing process. In the long term, it is cheaper to focus on prevention than to deal with consequences.
Do not collect data you do not need; reduce data waste and save on cloud costs
Data protection should be seen as an investment in a more sustainable future. If a company has no overview of what data it collects and has not set retention periods, it is very likely that unnecessary data are being collected, the same data are collected more than once, or data are stored indefinitely and forever. All of this consumes additional network resources. Collecting and storing only the truly necessary data, in line with the principle of minimisation, also helps reduce the risk of data leaks.
Make data protection a measure of your company’s success with DataVie
Since GDPR has been in force for only five years, there are still relatively few highly skilled data protection officers on the market, and practical experience in integrating data protection efficiently into companies remains limited. This is why DataVie was created. It grew out of DataVie founder Piia Laks-Järve’s wish, shaped by her experience as a data protection officer in one of Estonia’s large companies, to find more effective ways to ensure compliance with data protection requirements.
DataVie’s goal is to provide companies with a standard solution for meeting GDPR requirements, through both GDPR services and software. A company does not need to familiarise itself with all the regulations and requirements or invent ways to comply with them. DataVie provides the necessary support.
If you do not know where to start but want to invest in your company’s trustworthiness, contact the DataVie team, and we will find a personalised and suitable solution for your company.
The article was originally published in Geenius