Processing of personal data in the Estonian Education and Youth Board
We respect everyone’s right to the protection of their personal data, which is why we process personal data based on your (data subject’s - identified or identifiable natural person’s) interests, rights, and freedoms.
Personal data is any data that allows a person to be identified. The processing of personal data is an act performed on personal data.
We guarantee the integrity, availability, and confidentiality of your personal data through organizational, physical, and IT security measures (such as employee data protection training, restrictions on access to our information systems, building security measures).
This website provides an overview of the principles of personal data processing in the Estonian Education and Youth Board.
Board as a processor of personal data and contacts
The chief data processor is the Estonian Education and Youth Board (hereinafter the Board). You can find our contact details here. You can contact our data protection specialist at the e-mail address andmekaitse@harno.ee.
If we process data as an authorized processor, we do so according to the instructions of the controller (e.g., when processing personal data in national databases).
Purpose of the processing of personal data
We process personal data during the implementation of education and youth policy and activities supporting the operation of the Board (e.g., accounting, personnel management, conducting procurement procedures, etc.).
The composition of personal data (e.g., personally identifiable information, contact information, health data, etc.) depends on the specific service, but we always consider the principle of minimization, i.e., we collect only the personal data that is necessary to provide our services.
Legal basis for the processing of personal data
We process personal data only on the grounds permitted by law: for the performance of a public task, performance of a contract, performance of a legal obligation, with your consent, preparation, submission and protection of a legal claim, protection of your or another person’s vital interests, or, in the absence of a principal task, on the basis of a legitimate interest.
We process personal data on the basis of consent only if there are no other grounds specified in legislation and you have given unambiguous consent to the processing of your data. The consent must indicate the specific purpose of the processing of personal data and the data processor (the Board and, if necessary, the co-responsible processor). We ask for consent in such a way that it is clearly distinguished from other questions and formulated in such a way that it can be proved later (e.g., in a signed statement, e-mail, SMS). You have the right to withdraw your consent at any time by notifying us of your wish. Withdrawal of consent shall not affect the admissibility of processing prior to withdrawal.
For the processing of special types of personal data (e.g., health data), we ask for explicit consent, or we process special types of personal data for the performance of employment law obligations and special rights (e.g., in relation to occupational health) or for important public interest reasons (e.g., scholarships for students with special needs).
Transfer of personal data to third parties
We may transfer personal data to third parties who are entitled to receive the data by law, regulation, or international agreement or who cooperate with us (e.g., as part of a service provided to the Board). The partners process personal data on behalf of the Board and only for the purpose for which the Board processes the collected personal data and in accordance with the conditions of our personal data processing. We may also transfer personal data to the competent governmental authorities for the purpose of fulfilling a legal obligation.
Our partners may be located outside the scope of the General Data Protection Regulation (GDPR), i.e., outside the European Union and its economic area (e.g., if you take a foreign language proficiency test). In this case, we will implement safeguards to ensure the protection of personal data in accordance with the General Regulation.
Processing of personal data in the public document register
The Board is a state agency, and our activities are public. The website of the Board has a public document register where you can get acquainted with the documents that arise in the course of our activities. These documents may also contain personal data. As a rule, information containing the privacy of your personal life is protected by access restrictions. Possible grounds for access restrictions are set out in the Public Information Act.
We strive to ensure that your privacy is infringed as little as possible. If you correspond with us as an individual, your name will be visible as initials. If someone wishes to inspect your correspondence and submits a request for information to us, upon receipt of the request for information, we will review whether the person requesting the information has the right to see the requested document by law. We only provide information related to you to institutions and persons who have the right to receive the relevant information (e.g., pre-trial proceedings, court) and a justified need.
Processing of personal data of a candidate for the position in the Board
In the Board’s staff competitions, we proceed from the information provided by the candidates. In addition, we may collect information about candidates from public sources. When collecting information from public sources, the candidate has the right to examine the collected information and submit his or her explanations and objections.
Only employees involved in the recruitment process will have access to the information obtained through the staff competition.
If a candidate submits the details of his/her referrers when applying, we assume that it is not necessary to ask for separate consent to contact them, and the referrers have given their consent that a representative of the Board may contact them for information about the candidate.
We may keep the data of unsuccessful candidates for one year in order to resolve possible legal disputes; we may keep the data longer on the consent of the candidate (e.g., to be invited to participate in a future competition).
Processing of personal data in the information systems of the Board
The Board manages a number of sectoral information systems. The principles of personal processing data related to these information systems may be reflected in terms of use of a specific information system and in the statutes of the information system, or a detailed description of the data processed in information systems can be found on the Estonian Information System Authority (RIHA) website.
Time limits for the storage of personal data
We store personal data for the period necessary to achieve the purposes of processing or until the storage period provided by law (e.g., accounting data for seven years). The terms of personal data storage are confirmed in the classification scheme of the Board’s information assets; in addition, the terms of data storage may be included in other internal procedures of the Board. At the end of the storage period, the data will be anonymized or deleted unless there is a circumstance that precludes the deletion of personal data, such as an ongoing legal dispute.
Your rights as a data subject
You have the right to inspect your data at any time and to be informed of the purposes and deadlines for data processing. To get acquainted with the data, please contact us at the contacts provided on this website or, if the data is in the information system to which you have access, by examining the data in the information system.
You have the right to request the correction of your personal data if you have discovered incorrect data by inspecting the data. To do this, you must contact us or, if the personal data is in the information system, you can request a correction or, if possible, correct the data in the information system yourself.
You have the right to request the deletion of your data, i.e., the right to be forgotten if your personal data is processed with consent. However, complete deletion of personal data is not possible if the personal data are also processed for other purposes and bases (e.g., personal data are used to fulfill legal obligations when submitted to public authorities or to keep accounting documents or to prepare a legal claim on a contractual basis).
You have the right to object to the processing of personal data at any time. Upon receipt of the objection, we will consider the legal interests and, if necessary, terminate the data processing. The right to object cannot be exercised if we prove that personal data are processed for a valid legitimate reason, which outweighs the interests, rights, and freedoms of the data subject or for the purpose of drawing up, submitting, and defending legal claims.
You have the right to restrict the processing of data about you if a) you have challenged the accuracy of the personal data and the processing is restricted for the time of the data being checked, or b) you request a restriction on use instead of deletion in case of unlawful processing, or (c) if the Board no longer needs the data, but you need it to draw up, submit or defend a legal claim; or (d) if you object, the period within which the Board will make a decision on the lawfulness of the processing.
You have the right to require us to transfer data submitted in a structured, publicly available format and in a machine-readable manner to another controller if the data is processed automatically and with the consent of the data subject or the performance of a contract. In complying with the requirement, the Board must also assess that the exercise of the right would not prejudice the rights and freedoms of other persons.
To exercise your rights, please contact us at andmekaitse@harno.ee. In order to issue, correct, or delete data or respond to objections, we need to identify the requester, so we may ask you for a formal application, including a digitally signed one, or other means of identification. The Board will reply to you without undue delay, but no later than one month after receiving the request. The time limit for reply may be extended by two months, taking into account the complexity of the request and the volume of data. We will notify you of the extension within one month of receiving your request.
Submission of inquiries and right of appeal
You can always contact our data protection specialist with questions related to the processing of your personal data or to exercise your rights at the e-mail address andmekaitse@harno.ee. You also have the right to lodge a complaint with the Data Protection Inspectorate or a court at any time.