Partner in the IT and data protection practice at NJORD Law Firm, Liisi Jürgen, gave an interview on the ERR programme “Pealtnägija”, where she spoke about the use of forest owners’ data and privately initiated databases.
Last night’s main story on Pealtnägija did a good job of highlighting the telephone harassment targeted at forest owners and the related data protection concerns. In addition to what was said on the programme, Liisi Jürgen emphasises that illegal private databases should not be “normalised” by drawing up privacy documents after the fact. If data were originally collected without a legal basis, simply fixing the paperwork later does not make that collection or subsequent use lawful. The honest solution is to stop the unlawful collection, delete the data, and if someone wants to run a similar database in future, start from scratch: a clear legal basis, transparent rules, and only then data collection.
Liisi Jürgen also believes that supervision should not be limited to “calming down” individual complaints along the lines of “we’ll remove your number and now everything is fine”. These kinds of databases should be investigated comprehensively as a systemic phenomenon: where the data come from, how they are combined, to whom they are passed on, and what risks this creates for dozens or hundreds of people.
Thirdly, in Liisi Jürgen’s view, policymakers and society at large have some serious thinking to do about whether large-scale unlawful processing of personal data in privately initiated databases, especially when it serves illegal or seriously problematic purposes, should be criminalised under criminal law. Article 84 of the GDPR allows countries to do this; the issue is not whether it is possible, but whether there is the political will.
Watch the main story from the 22 April edition of the ERR programme HERE.
