The Estonian Data Protection Authority (AKI) has closed a supervisory procedure against the Ministry of Climate regarding the management of the national building register. The closure decision, without sanction, was motivated by the presentation and the beginning of implementation of a concrete action plan by the ministry to address the identified data protection issues.

Facts and context

The Estonian authority (AKI) published on October 19, 2026, a decision to close a supervisory procedure against the Ministry of Climate concerning several compliance issues related to the national building register.

The case originated from a supervisory procedure initiated by the authority in spring 2026, which had identified several data protection issues in the operation of the register and had requested the ministry to propose an action plan to remedy them.

Reasons for the decision

The authority considered that the Ministry of Climate had taken concrete and sufficient measures to begin resolving the identified issues. In response to the authority's request, the ministry presented an action plan in May 2026, then a progress report in October 2026. This report showed that corrective actions had already been undertaken, notably by the entry into force in August of an amendment to the construction code governing the publication of personal data in the register, by technical developments of the register, and by the launch of a review of previously published documents. The issues raised by the authority notably concerned:

• The publication of personal data.
• Data retention.
• The implementation of access restrictions.
• The instructions provided to local municipalities for the processing of personal data.

Authority's decision

Consequently, the authority decided to close the supervisory procedure against the Ministry of Climate.

Furthermore, the authority specified that it expected the action plan to be carried through to completion and that the closure of the procedure did not prevent it from monitoring its future implementation or opening a new procedure if necessary.

Lessons learned

This decision reminds that:

• Active cooperation with a supervisory authority and the presentation of a credible and detailed action plan to remedy breaches can lead to the closure of a supervisory procedure without sanction.
• The compliance of a public register must be ensured at several levels: the legal basis for the publication of data, technical measures for access restriction, and data retention policies.
• When processing involves multiple actors (such as central administrations and local municipalities), the controller must provide clear and compliant instructions to all stakeholders regarding data protection requirements.