The Advocate General of the Court of Justice of the European Union has clarified the legal framework applicable to the processing of data by financial intelligence units and the conditions for restricting data subjects' right of access.

This case follows a preliminary ruling request from the Estonian Supreme Court concerning a dispute between an individual and the Estonian financial intelligence unit (RAB). The latter repeatedly refused to disclose information held about the applicant, citing the need to preserve confidentiality to protect the Estonian financial system, despite contrary decisions from national courts and the Estonian data protection authority (AKI). The Supreme Court therefore asked the Court of Justice about the applicable data protection regime and the circumstances under which such an access restriction is lawful.

In her opinion, the Advocate General considers that data processing by financial intelligence units (FIUs) falls under Directive 2016/680, and not the GDPR, as they meet two cumulative conditions: being a competent authority for the prevention and detection of criminal offenses, and processing data for those purposes. She specifies that this classification does not depend on their organizational structure. Regarding the right of access, she considers that a total prohibition may be compatible with the confidentiality obligation of FIUs, provided that this restriction respects the principle of proportionality and is limited in scope and duration to what is strictly necessary to achieve the legitimate aim pursued.