Retention of communications data needs clearer limits
Communications data can give as sensitive a picture of a person’s private life as the content of a message. NAMM attorneys Sander Potisepp and Kristjan Tuul wrote in ERR that the state has not sufficiently brought the rules on communications data retention into line with the case law of the Court of Justice of the European Union and the Supreme Court of Estonia.
Communications data shows who a person communicates with, where they move and what their habits are. The Court of Justice of the European Union has explained in several judgments that collecting everyone’s data without distinction is not compatible with the protection of fundamental rights. In the lawyers’ view, the same principle has been postponed in Estonian law for too long.
What does this mean for a person?
If communications data is retained about everyone just in case, it affects not only suspects but every phone and internet user. The question is not whether the state may use data to investigate serious crime. The question is whether data may be collected in advance about everyone.
What should the law specify?
The law should clearly state for the investigation of which serious crimes communications data may be used, whose data is retained and who authorises access to the data. General and unlimited collection gives certainty neither to the person nor to the investigative authority, because evidence collected under unclear rules may later become unusable in court.
Can communications data be used in criminal proceedings? Yes, but its use must be lawful, justified and reviewable. The investigation of a serious crime does not automatically justify the blanket retention of everyone’s data.
Read more from ERR or Postimees.
What has changed since then?
In its judgment of 20 March 2026 in case No 1-23-1551/97, the Supreme Court of Estonia explained that using communications data that a telecoms company keeps for its own business purposes is not ruled out in principle in criminal proceedings. However, the prosecution must prove that the data was recorded and stored only to the extent and for as long as needed to provide the service, issue bills or offer value-added services. A mere statement that only data kept for business purposes was requested is not enough. If this is not proven, it must be presumed that the data was kept under the general retention obligation imposed by law. In this case, in which NAMM attorney-at-law Sander Potisepp acted as defence counsel, the Supreme Court found that the prosecution had not proven the lawfulness of retaining communications data collected over 344 days.
On 14 September 2026, the Government initiated Bill 1007 SE on the retention and use of communications data, which would end the current general blanket retention. As a rule, only the data needed to identify a user, including IP addresses, would be retained. In criminal proceedings, data that telecoms companies keep for their own business purposes and data preserved quickly for the investigation of a specific offence could be used as evidence. In misdemeanour proceedings, the use of communications data would be limited to serious or organised offences, and judicial oversight would be strengthened.
Under the bill, in the event of a serious threat to national security, the Government could require wider retention of traffic and location data for up to one year. The bill is before the Riigikogu and its first reading has been completed. Until the law is adopted and enters into force, the current rules continue to apply.
This article was last updated on 6 October 2026.