Health data: can the police request it without consent?

Police requests for health data highlighted a problem raised by NAMM attorney-at-law Sander Potisepp. The question was not only whether the police may request health data in criminal proceedings. The main question was whether this is done with the person’s consent, under court supervision or on another clearly understandable legal basis.

Postimees wrote that the police had left the public with the impression that people’s health data was requested only with their permission. Sander noticed a contradiction in this and pointed out that the practice may be broader. After his intervention, the police had to admit that health data had also been requested without the person’s consent.

Health data is not ordinary procedural information. It can reveal a person’s illnesses, treatment, addictions, mental health condition and other highly personal matters. Its use must therefore be exceptional, justified and capable of later review.

The question raised by Sander is important for everyone, not only for people who are suspects or witnesses in a criminal case. If a state authority can request sensitive data simply by making a query, people must have certainty that this power is not used too broadly.

A practical problem is also that a person may not know who viewed their health data and why. This issue shows why data protection is not only a technical matter. It is a matter of fundamental rights. When the state uses a person’s health data, control must be stronger than in the case of an ordinary document or registry entry.

Read more from Postimees.

What did the later review show?

At the beginning of June, Minister of the Interior Igor Taro instructed the Police and Border Guard Board and the Internal Security Service to review all health data queries made by their officials. The results were published on 6 August 2026. The police reviewed all 2,139 queries made in 2026 and found 135 cases that were not considered correct or lawful or that require further assessment. The most serious problem was the use of prescription data to find out where a person was. Queries were also found that had been made before proceedings were opened, even though the legal basis for a query arises only once proceedings have begun.

Over 13 months, the Internal Security Service had queried health data on about 13,000 people. According to the review, these queries had a legal basis, but one breach had been identified earlier, in which an official had queried data on a relative. The police are introducing a four-eyes rule for health data queries and refining the query forms. In May 2026, Minister of Justice Liisa Pakosta said that the Government had initiated a change in the law that would reach the Riigikogu in the autumn. The review confirmed that the issue raised by Sander was justified: queries for sensitive data need stronger and more meaningful oversight.

This article was last updated on 6 October 2026.