The Estonian Data Protection Authority (AKI) has ordered an association to stop publishing a register of criminal convictions, considering that such processing of sensitive data can only be carried out under the control of a public authority.

Facts and context

The Estonian Data Protection Authority (Andmekaitse Inspektsioon - AKI) published on 17 June 2026 a decision ordering the non-profit association ETTEVAATUST to stop publishing personal data relating to criminal convictions on its website.

The case originated from the association's operation of a website compiling in a structured manner data relating to nearly 900 individuals convicted of criminal offenses.

Reasons for the decision

• Obligation related to the processing of data concerning criminal convictions (Article 10 of the GDPR): The authority found that the website did not merely relay individual cases but constituted a complete and structured register of criminal convictions, including names, photographs, dates of birth, and links to judicial decisions. The authority considered that such processing, by its scope and purpose, amounted to maintaining a register of criminal convictions. However, under the GDPR, a complete register of this nature can only be maintained under the control of a public authority. Since the association acted outside any official control, the processing was deemed unlawful.

Decision of the authority

Consequently, the authority ordered the association ETTEVAATUST to cease publishing personal data relating to judicial decisions.

Furthermore, the authority specified that this injunction only concerned personal data related to judicial decisions and did not require the closure of the website or the removal of other content such as press articles. The association must comply with this decision no later than 29 June 2026.

Lessons learned

This decision reminds that:

• The creation by a private entity of a public, complete, and structured register of criminal convictions is unlawful, as this type of processing is exclusively reserved for entities acting under the control of a public authority.


• It is important to distinguish the publication of information on specific judicial cases of public interest from the systematic compilation of criminal data in a centralized database.


• The maintenance of conviction registers by uncontrolled private actors presents significant risks, notably creating a false sense of security for the public and causing harm to individuals whose data are processed inaccurately or not updated.


• Official registers managed by the State, such as the criminal record, constitute the appropriate mechanism to ensure reliable and controlled access to information on criminal convictions, respecting fundamental rights.