Applicability of the Census Case in Estonian Personal Data Protection Law
| Author | Eneken Tikk, Monika Mikiver |
| Pages | 102-110 |
Eneken Tikk, Monika Mikiver
Applicability of the Census Case in Estonian Personal Data Protection Law
Estonian personal data protection law tends to adopt the German doctrine of informational self-determination as delivered by the Bundesverfassungsgericht (BVerfG) in its 1983 census ruling. While the new fundamental right deriving from this landmark case has influenced personal data protection law widely all over Europe, the authors take a critical look at national prerequisites for applying the principles deriving from the 1983 case. The elements of the census case are of a dynamic nature and cannot be applied without deeper analysis of the facts and context of the case, thereby calling for a systematic interpretation of its outcome.
The aim of this article is to provide an analytical structure for determining the correspondence of the principles and conclusions of the census case to Estonian information law. The proposed structure of the analysis can be used also as a basis for relevant analysis in other countries within the EU data protection law framework1.
One modern way to achieve a better democracy is to establish additional guarantees to free movement of information. Today, virtually all Member States of The European Union (EU) have adopted laws on access to public-sector information.
Estonia, in enacting its Public Information Act 2 (PIA), was among the first countries in Europe to offer a general instrument granting access to public-sector information. The act sets forth decisive steps toward securing the transparency of public-sector activities - by, e.g., requiring all Estonian state and local authorities to maintain a Web site and make accessible to the public any information that has been received or created in the course of carrying out public activities.
In its more than five years of application, the PIA has shown several practical problems and occasioned theoretical quandaries, most of these related to the issue of coherent application of the PIA concurrently with the Personal Data Protection Act * 3 (PDPA)4. The conflict of the two acts is fundamental: while the PDPA is aimed at securing the privacy of individuals, the PIA sees as its main goal the transparency of the exercising authority. Against the background of the different direction of these laws, the ideal of a transparent society made up of non-transparent individuals is difficult to achieve.
No official commentaries and best practice have yet been issued by Estonian authorities regarding the mutual application of the conflicting rights contained in the PDPA and PIA. Therefore, the comments to the Constitution, relevant court rulings, and decisions of supervisory authorities are a very valuable asset in determining the nature of the country's personal data protection regime and the basic approaches necessary for advising clients and proposing new regulatory steps in this environment5.
The first commentary to the Constitution of the Republic of Estonia, published 10 years after its enactment in 1992, takes the view that the right of a person to informational self-determination should be established upon the foundation of the German archetype expressed in the Volkszählungsurteil* 6 of the German Constitutional Court7. The same view has gradually been taken up by the Estonian legal chancellor 8 , the Data Protection Inspectorate 9 , and several Estonian legal scientists.
In view of the fact that the PDPA was drafted on the basis of German and Finnish legislation 10 , the use and application of German court practice to prepare and interpret Estonian legal acts in the field deserves independent analysis and reasoning.
The key elements of the census case may be summarised as follows:
- under the conditions of modern data processing shall be guaranteed the right of every person to decide how much information is to be disclosed about him or her, and when, and
- limitations to this right are tolerable only in cases of clear and overwhelming public interest and with the legal basis of a well-defined purpose.
In 1982, the West-German Bundestag unanimously enacted a census law (Volkszählungsgesetz* 11 ) whereby personal data (given name and surname, phone number, sex, birthday, marital status, citizenship, and fact of having or not having a religious affiliation) gathered during the census may be compared to data included in national registries (Melderegistern), with the latter to be corrected on the basis of such data12. Anonymous data referred to above, as well as a significant quantity of other data (including income, participation in acquisitions, data about domicile, etc.), were allowed to be transmitted to competent public and local authorities for purposes of their carrying out their mandates13.
The main aims of the law on the census were to enable updating of the information from that of the previous census, carried out in 1970, about the population in the federation and at state and local administrative division level and to guarantee the quality of decision-making related to, e.g., space planning and the labour market, as well as social, education, and traffic policy14. After the law was enacted, many complaints were filed with the BVerfG.The reason for anxiety among these people was the fear of potential threats likely to be caused by computerised processing of their data15.
Proceedings on constitutional supervision were initiated, and on 15 December 1983 the BVerfG declared § 9 (1)-(3) of the act null and void, thereby evidencing great concern about individuals' privacy in relation to the position of a person in the feared autocratic state16. The ruling stated that the guarantees of human dignity 17 and the right to free self-actualisation 18 create the basis for protection of a person against unconstrained processing of personal data, stating also that limitations to such protection are tolerable only in cases of prevailing public interest19.
The BVerfGsets forth the principle that the individual has the right to know what information is being processed that pertains to him or her and to make decisions on the basis thereof20. The court argued that "the freedom of an individual to decide for himself is at stake when the individual is uncertain about what is known about him, particularly where what society might view as deviant behaviour is at stake. The individual therefore has the right to know and make decisions on the information being processed about him"21.
The ruling derived the right of informational self-determination - the right of a person to decide how much information to allow to be disclosed about him or her, and when 22 - from the principle of human dignity enshrined in articles 2 (1) and 1 (1) of the German Constitution. The court has ruled that the guarantees to human dignity 23 and the right to free development of one's personality 24 create the basis for protection of a person against unconstrained processing of personal data.
However, the right to informational self-determination shall not be granted without limits. The court has stated that limitations to such protection are tolerable, although only where there is a prevailing public interest25.
Ernits is of the opinion that the general right to development of one's personality derives from § 19 26 of the Estonian Constitution, covering the right to self-determination (which also comprises the right to informational self-determination)27. The latter, in Ernits's view, is the right of the individual to decide whether, and to what extent, data pertaining to him or her may be gathered and saved28.
The Estonian legal chancellor predicates that the data processing can refer mainly to the right of privacy set forth in § 26 of the Estonian Constitution but that in some situations the right of informational self-determination devolves from § 1929.
Pursuant to § 19 (2), everyone is obliged to honour and consider the rights and freedoms of others, as well as to observe the law both in exercising his or her rights and freedoms and in carrying out his or her duties.
According to the BVerfG, an important prerequisite to individual self-determination is the opportunity of an individual to first freely decide upon a behaviour, and then the guarantee of the chosen behaviour to be effected30.
The BVerfG analysis reflects the concern about individual privacy in relation to the person in relationship to the feared autocratic state31. Unlike before, there are now new threats in the form of possibilities of using the personal data in database in short order every time and from everywhere without regard for remoteness. By combining the information with that in order databases, it can be possible to create a full profile of a person, without the individual concerned having a chance to control the use and appropriateness of the...
To continue reading
Request your trial