Estonian Personal Data Protection Act

Targeted professionals: A processor of personal data is a natural or legal person, a branch of a foreign company or a state or local government agency who processes personal data or on whose assignment personal data are processed.

Professional Secrecy Provisions

Conditions for disclosing information

§ 11. Disclosure of personal data (1) If a data subject has disclosed his or her personal data, has given the consent specified in § 12 of this Act for the disclosure thereof or if such personal data have been disclosed on the basis of law, including subsection (2) of this section, then other sections of this Act do not apply to the processing of the personal data.

(2) Personal data may be processed and disclosed in the media for journalistic purposes without the consent of the data subject, if there is predominant public interest therefore and this is in accordance with the principles of journalism ethics. Disclosure of data shall not cause excessive damage to the rights of a data subject.

Right or duty to report

Personal data may be disclosed only in certain cases without the consent of the data subject.

Existence of disciplinary sanctions in case of non-reporting

Not specified. In cases of FGM, the Penal Code might be used:

§ 307. Failure to report crime

(1) Failure to report commission by another person of a criminal offence in the first degree is punishable by a pecuniary punishment or up to 3 years’ imprisonment.