Estonian DPA Orders Website to Add Safeguards After Republishing Restricted Personal Data
Written by AI from the linked story. Not reviewed by an editor. How this works
A website operator continued to display personal data sourced from public registers even after the originating authorities restricted access to that data, creating an ongoing GDPR violation. The operator failed to establish a lawful legal basis for continued processing and did not respond adequately to data subject requests, compounding the breach. This case highlights that republishing publicly available data does not exempt an operator from GDPR obligations, and that access restrictions imposed by source authorities must be honoured downstream. Special category data carries heightened obligations, meaning the absence of technical and organisational controls exposes operators to significant regulatory risk.
Tactical Insight
Immediate actions
- Audit all personal data sourced from third-party or public registers and verify that a current, documented legal basis exists for each dataset.
- Implement a process to monitor source authorities for access restriction notices and remove or restrict republished content within a defined SLA upon notification.
Data subject rights & compliance
- Establish a formal, time-bound procedure for handling data subject requests (access, erasure, rectification) that meets GDPR Article 12 response timelines.
- Maintain a Record of Processing Activities (RoPA) that explicitly documents the legal basis, data categories, and retention periods for all republished data.
- Apply additional safeguards (e.g., pseudonymisation, access controls, or redaction) wherever special category data under GDPR Article 9 is processed.
Long-term improvements
- Embed Privacy by Design principles into content ingestion pipelines so that data from external registers is reviewed for legal basis before publication.
- Conduct annual GDPR compliance reviews with a qualified Data Protection Officer (DPO) to reassess the ongoing legitimacy of all data processing activities.
- Implement automated monitoring to detect when source data has been removed or restricted, triggering a downstream review and takedown workflow.