Source: https://www.riigiteataja.ee/en/eli/529032019012/consolide
Timestamp: 2019-04-24 18:44:01+00:00

Document:
22.04.2010 RT I 2010, 22, 108 01.01.2011 enters into force on the date which has been determined in the Decision of the Council of the European Union regarding the abrogation of the derogation established in respect of the Republic of Estonia on the basis provided for in Article 140 (2) of the Treaty on the Functioning of the European Union, Council Decision 2010/416/EU of 13.07.2010 (OJ L 196, 28.7.2010, p. 24–26).
3) the procedure for the exercise of state supervision and administrative supervision over the organisation of access to information.
(1) The re-use of information is the use of such public information, the public use of which is not restricted by law or pursuant to the procedure established by law (hereinafter open data), by natural persons or legal persons for commercial or non-commercial purposes other than the initial purpose within the public duties for which the information was obtained or produced. The exchange of information between holders of information for the performance of their public duties does not constitute re-use of information.
(3) Upon giving information for public use, the inviolability of the private life of persons, protection of copyrights, protection of national security, and protection of business secrets and other restricted information must be ensured. Before giving information for public use, the holder of information shall assess the need to establish restrictions on the public use of the information.
(4) If this is possible and appropriate, the holder of information shall grant access to open data in a file format which is structured so that software applications can easily identify, recognize and extract specific data, including individual statements of fact, and their internal structure (hereinafter machine-readable format), and in a format that is platform-independent and made available to the public without any restriction that impedes the re-use of documents (hereinafter open format). If conversion of open data into digital format, machine-readable format or open format is impossible or would involve disproportionately great effort, the holder of information shall grant access to open data in their original format or in any other format.
(5) Information in respect of which restriction on access is established by law or to which access is restricted pursuant to the procedure established by law, including information to which access is granted pursuant to law only upon existence of legitimate interest or in respect of which special conditions of, procedure for and methods of access are established by law, is not for public use.
(6) The information specified in subsection (5) of this section shall not be given for public use or only such part of the information shall be given for public use which does not contain restricted information and if giving such part of the information for public use does not involve the risk of disclosure of restricted information.
(7) If information disclosed pursuant to law contains personal data, the public use of such information may be restricted if giving such information for public use would significantly breach the inviolability of the private life of the person.
(8) If giving information, which is disclosed pursuant to law and contains personal data, for public use breaches the inviolability of the private life of the person, such information shall not be given for public use or only such part of the information shall be given for public use the public use of which does not significantly breach the inviolability of the private life of the person or the information shall be given for public use in a way which does not significantly breach the inviolability of the private life of the person.
(81) The Government of the Republic or the minister responsible for the area may establish, by a regulation a list specifying the personal data which do not constitute open data of subsections (7) and (8) of this section.
(9) A holder of information may give information for public use without conditions or impose conditions for the public use thereof through a licence provided for in the Copyright Act. The licence shall not unnecessarily restrict possibilities for re-use and shall not restrict competition. The holder of information shall publish the licence on its website.
A request for information is a request to obtain or re-use information submitted to the holder of information pursuant to the procedure provided for in this Act by a person making the request for information.
(3) Access to open data also includes the right to re-use that information. If the holder of information has imposed conditions for the public use of information through a licence, the information shall be used pursuant to the conditions of the licence.
(1) The document register of an agency is a digital database which is maintained by a state or local government authority or a legal person in public law in order to register documents received by the agency and prepared in the agency and to ensure access thereto.
(21) Documents related to a person, which have been entered in another database and to which access of the person is ensured, are not required to be entered in the document register.
(31) If the sender of documents received by an agency or the recipient of documents released from an agency is a natural person, information which would allow to identify the natural person shall not be indicated in public view of the document register.
(21) If a person making the request for information requests access to information for the purpose of re-use, the person shall notify the holder of information thereof.
If a holder of information needs to specify a request for information or if identification of the information is time-consuming, the holder of information may extend the term for compliance with the request for information for up to 15 working days. The holder of information shall notify the person making the request for information of extension of the term together with the reasons therefor within five working days.
(3) Holders of information shall cover the expenses relating to compliance with requests for information made by state or local government authorities.
(5) Holders of information who must cover a substantial part of the costs arising from the performance of their public duties or related to the holding of information may include, in addition to the costs specified in subsection (4) of this section, a reasonable return on investment in the income received for supplying information for re-use. A reasonable return on investment shall be up to five percent higher than the fixed interest rate applicable to the main refinancing operations of the European Central Bank, unless otherwise provided by law.
(6) If a fee is charged for the re-use of information, the holder of information shall disclose the bases for calculation of the fee at least every three years and organise recalculation of the fees, if necessary.
(3) The information specified in clauses 28 (1) 1)–4), 7), 8), 10)–13), 15)–24), 26), 27), 311) and 312) of this Act shall be open data which the holder of information must disclose in the manner provided for in subsection 31 (4) of this Act.
(4) Holders of information shall establish restrictions on public use of the information specified in clauses 28 (1) 5), 6), 9), 14), 25), 28), 29), 31) and 32) of this Act pursuant to the provisions of § 31 of this Act and shall disclose the information given for public use in the manner provided for in subsection 31 (4) of this Act.
(5) The holders of information specified in subsection 434 (1) of this Act shall establish restrictions on public use of the information specified in clause 28 (1) 30) of this Act pursuant to the provisions of § 31 of this Act and shall disclose the data of database given for public use (hereinafter open data of database), if this is possible and appropriate, in an up-to-date version and in a manner and format which allows to download the open data of database as a full set of data together with metadata in a machine-readable and open format. If conversion of the open data of database into machine-readable format or open format is impossible or would involve disproportionately great effort, the holder of information shall ensure disclosure of the open data of database in their original format or in any other format.
(6) The open data of database specified in subsection (5) of this section must be accessible through the Estonian information gateway.
(4) State and local government authorities are required to communicate information concerning events and facts and which is in their possession to providers of media services and the printed press for disclosure if public interest can be expected.
(1) The Chancellery of the Riigikogu, the Office of the President of the Republic, the Office of the Chancellor of Justice, the National Audit Office, courts, government authorities and legal persons in public law are required to maintain websites for the disclosure of information.
(3) The State Chancellery and ministries are required to take measures for the maintenance of websites by state agencies administered by them.
7) disclose information describing the accessibility of the website or mobile application on the website or in the environment from where the mobile application can be downloaded.
(2) The minister responsible for the area shall establish by a regulation the accessibility requirements for websites and mobile applications and the procedure for disclosure of information describing accessibility.
(3) The obligation of accessibility provided for in clause (1) 6) of this section does not extend to the content of websites and mobile applications specified in Article 1(4) of Directive (EU) 2016/2102 of the European Parliament and of the Council on the accessibility of the websites and mobile applications of public sector bodies (OJ L 327, 2.12.2016, p. 1-15).
(4) The effort is disproportionately great within the meaning of clause (1) 6) of this section if granting access to a website or a mobile application entails unreasonable costs, taking account of the size, resources and type of the holder of information and the frequency and duration of use of the website or the mobile application.
(5) It shall be possible to access directly the websites of agencies in the area of administration of the State Chancellery and ministries from the websites of the State Chancellery and ministries.
3) persons deemed to be equal to holders of information specified in subsection 5 (3) of this Act.
(5) The Government of the Republic may establish, by a regulation the requirements and procedure for the administration of the Estonian information gateway, for ensuring access to, developing and using the information therein and processing the personal data in the Estonian information gateway and for interfacing databases with the Estonian information gateway.
5) information related to the formation of stocks and provision of resources necessary for the performance of national defence tasks and for mitigating the consequences of an emergency, if the disclosure of such information could affect the formation of stocks and provision of resources.
12) precepts which have entered into force and legislation which is issued by way of state supervision, administrative supervision or supervisory control or under disciplinary procedure and information relating to punishments in force.
2) information pertaining to the use of funds allocated and assets transferred to legal persons in private law from the state or a local authority budget.
(3) State and local government officials or employees have the right to access information which is classified as information intended for internal use in order to perform their duties. Such information shall not be communicated to third persons without the permission of the agency which establishes the restriction on access.
(31) If, in a case provided by law, access is requested for the performance of public duties to information which is classified as information intended for internal use, the holder of information shall be notified of the basis and purpose of accessing the information provided by law.
(4) The head of an agency may decide to grant access to information classified as internal to persons outside the agency if this does not damage the interests of the state or a local authority.
(1) A holder of information shall grant access to personal data in its possession upon the existence of a basis provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1–88) or the law pursuant to the procedure provided for in this Act.
(2) A restriction on access to documents pertaining to state supervision, administrative supervision and supervisory control and preparation of individual decisions of executive power applies until adoption of a decision unless another reason to restrict access to the information exists.
3) confidentiality of internal information – against accidental or intentional unauthorised access.
(2) Organisational, physical and information technology security measures must be applied for the protection of internal information, regardless of whether the information is in digital format or on paper.
(3) The Government of the Republic may establish, by a regulation, the list of organisational, physical and information technology security measures applied for the protection of the integrity, availability and confidentiality of internal information.
(3) Collection of data in the database shall be based on the one-request-only principle.
(1) The state information system consists of databases which are connected to the data exchange layer of the information system and registered in the administration system of the state information system, and of the systems supporting the maintenance of the databases.
(1) The controller (administrator) of a database is the state or local government authority, other legal person in public law or person in private law performing public duties who organises the introduction of the database and the administration of services and data. The controller of a database is responsible for the legality of the administration of the database and for developing the database.
(11) Statistics Estonia shall coordinate the area of data governance.
(12) The specific requirements and conditions of data governance shall be provided by a regulation of the Government of the Republic or a minister authorised thereby.
(2) The controller of a database may authorise, within the extent determined by the controller, another state or local government authority, legal person in public law or, based on a procurement contract or a contract under public law, a person in private law to perform the tasks of processing of data and housing of the database.
(3) A processor is required to comply with the instructions of the controller in the processing of data and housing of the database, and shall ensure the security of the database.
(4) The controller of a database shall organise the establishment and administration of the central technological environment of a database established for the performance of the tasks imposed on or delegated to a local government by the state.
(1) The statutes of a database shall provide the procedure for maintaining the database, including the controller (administrator) of the database and where necessary, also the processor, the composition of the data to be collected in the database, persons submitting data and where necessary, also other organisational matters related to the keeping of the database.
(2) The persons submitting data shall be state or local government authorities or other persons in public or private law who have a duty provided by an Act or legislation issued on the basis thereof to submit data to the database or who submit the data voluntarily.
(6) The provisions of subsection (5) of this section shall not restrict exchange of data through the data exchange layer of information systems between other legal persons.
3) establishment, introduction, maintenance, reorganisation and termination of databases.
(1) A person whose rights provided for in this Act are violated may file a challenge with a supervisory body specified in § 44 of this Act or an action with an administrative court either personally or through a representative.
(2) If the Data Protection Inspectorate refuses to satisfy the challenge, the person who filed the challenge has the right to file a claim with an administrative court against the holder of information.
(1) The Estonian Information System's Authority shall exercise administrative and state supervision over the application of the system of security measures for information systems and the connection to the data exchange layer of information systems.
(2) Upon exercise of state supervision specified in subsection (1) this section, the Estonian Information System's Authority may apply the specific state supervision measures provided for in §§ 30, 31, 32, 49, 50, 51 and 52 of the Law Enforcement Act on the basis of and pursuant to the procedure provided for in the Law Enforcement Act.
Statistics Estonia shall exercise administrative supervision over compliance with data governance requirements.
(1) The provisions of clauses 32 (1) 6) and 7) or this Act shall apply to websites first published after 23 September 2018 as of 23 September 2019.
(2) The provisions of clauses 32 (1) 6) and 7) or this Act shall apply to websites first published before 23 September 2018 as of 23 September 2020.
(3) The requirements for the maintenance of mobile applications provided for in § 32 of this Act apply as of 23 June 2021.
(1) The Government of the Republic shall establish the bases for the records management procedures of state and local government authorities and legal persons in public law by 1 March 2001.
(4) A database registered in the national register of databases prior to the entry into force of Chapter 51 of this Act is deemed to be registered in the administration system of the state information system upon entry into force of Chapter 51 of this Act. The administrator of a database shall update the data of the database in the administration system of the state information system not later than within three months after the entry into force of Chapter 51 of this Act. Upon updating the data of a database, the basic data of the database shall be determined.
(5) The first sentence of subsection (4) of this section does not apply to the databases which are registered in the national register of databases but are not connected to the data exchange layer of the information system.
(6) Databases registered in the administration system of the state information system or which are deemed to be registered therein pursuant to subsection (4) of this section and are connected to the data exchange layer of the information system are deemed to be databases belonging to the state information system.
(1) A holder of information shall disclose the open data specified in § 28 of this Act pursuant to the provisions of § 29 of this Act by 1 February 2016 at the latest.

References: § 31
 § 31
 § 44
 § 32
 § 28
 § 29