The data protection authorities of Estonia, Latvia and Lithuania met on 22 and 23 September in Tallinn for their annual meeting to discuss common challenges and priorities in data protection.

The meeting highlighted several trends common to the three countries, including the growing importance of national security issues, an increase in the number and complexity of complaints, and a stronger focus on preventive work and public awareness, especially among young people. The authorities noted that the use of artificial intelligence for drafting complaints complicates their processing and requires prioritisation of high-impact cases due to limited resources. Discussions also focused on the importance of simple and clear communication to make data protection accessible to all.

The discussions addressed specific national cases, such as the responsibility of processors and the security measures provided for in Article 32 of the GDPR in Lithuania, the processing of data relating to criminal convictions in the employment context in Latvia, and the application of Article 10 of the GDPR in Estonia concerning a private website. The application of Articles 16 and 17 of the GDPR, notably regarding inaccurate information in public registers and exceptions related to national security, was also examined, as well as the use of new surveillance tools and the management of large-scale information systems of the European Union.