Does this number reflect awareness of data protection or, conversely, the opposite? Either way, we are grateful that people turn to us to solve their concerns, and we can be a partner in addressing or resolving many questions. The content of the inquiries indicates that the most concerning issues are widespread, meaning preventative work must continue. The most frequent questions are about employment relationships, but complaints mainly concern individual rights and healthcare. Complaints and inquiries about surveillance devices are equally common, whether on private land, in apartment associations, or in employment relationships.
The Director General mentions in the introduction of the annual report that raising awareness is key and refers to the goals of the new term that began at the end of the summer, with key concepts being awareness, competence, expertise, openness, and cooperation. The number of DPI trainings increased by 51% in 2024 compared to 2023, with 47 trainings conducted. In addition to trainings, 64 on-site consultations were also carried out. Interest in both trainings and consultations is on the rise, reflecting a desire to collaborate.
"The state must set an example, as the public sector can show that data protection is not just a bureaucratic obligation, but an essential part of modern and transparent governance. Our goal is to change this mindset and help people understand that considering data protection at the grassroots level actually simplifies processes and builds trust," says Pille Lehis in the introduction of the annual report.
In 2024, the DPI initiated 12 administrative offense proceedings and imposed fines totaling €79,100. At the beginning of 2025, an additional fine of €85,000 was imposed as a result of an oversight proceeding against Asper Biogene. However, the imposition of fines has not proceeded as expected. "One of our main objectives in the coming years is to achieve legal clarity on whether and how our administrative offense proceedings allow for the imposition of fines under the GDPR," comments Lehis.
Last year, the DPI received a total of 184 violation reports. As a result of these violations, data of approximately 910,000 individuals were leaked. Many people are affected by data leaks, meaning data protection plays an important role for everyone. "There is an increasing discussion not just about data protection, but about the protection of fundamental rights or even human rights in the digital world. Therefore, personal data protection today is much broader than it was perhaps a decade ago," says Lehis.
The annual report includes detailed writings by DPI lawyers on why the publication of debt is not a legal remedy, children’s data, the availability of public information, the legitimacy of legitimate interest, the role of the data protection officer, and many other issues that need further attention and broader public debate based on last year's experiences. The report also provides an overview of major proceedings. All articles from the annual report are available on our website.