Personal data and principles of its processing

Below we present principles of data processing of the website of the Welcoming Programme of the Ministry of the Interior, and the rights of a person regarding familiarisation with his or her data.
Personal data means any information that allows to identify a person.
Processing of personal data means an action performed with any personal data or its aggregate.
AUTHORISED PROCESSOR THAT ALSO ADMINISTERS THE WEBSITE OF THE WELCOMING PROGRAMME
Tiigervisioon OÜ
Tartu maantee 84A, 10112 Tallinn
telephone:
e-mail: info@tiigervisioon.ee
website: www.tiigervisioon.ee
data protection specialist:
Conduct of a procedure regarding a person can result in accumulation of special types of personal data, access to which and processing of which is restricted. The Ministry of the Interior assures processing of personal data in a way that the possibility of public disclosure of personal data of special type of a person is reduced to minimum.
The Ministry of the Interior does not issue or send personal data to third persons, unless:
• such obligation arises from a legal instrument,
• it is necessary for adoption of a decision on a application, or
• the person has given his or her consent to that.
Rights of a person regarding processing data that concerns such person A person has the right to familiarise himself or herself with the data collected in his or her regard. The Ministry of the Interior refuses to provide data only if such provision can:
• damage rights or freedoms of another person,
• be detrimental to protection of public order or national security, or
• hinder or be detrimental to prevention or discovery of an offence, or to conduct of procedure or execution of punishment regarding an offence.

Rights of a person

When a person submits personal data, he or she has the right to know:
– who is responsible for processing of the data;

– what the legal basis for and goal of processing of such data is;

– whether the personal data is sent to anyone, including a third state or an international organisation, and what the basis for the obligation to do so is;
– for how long the personal data will be kept;
– whether an automated decision will be made or a profile analysis will be performed regarding such person. If the data does not originate from the person, such person, in addition to the above, is also informed with regard to the following:
– which personal data is being processed;
– where such personal data originates from.
A person has the right to submit an objection regarding processing of his or her personaldata.
A person is informed before processing of his or her data is started for a purpose different from the one for which the personal data was initially collected.
A person has the right:
– to demand correction of incorrect data or its deletion (except where such data is being processed for performance of a legal obligation, exercise of public authority or performance of duties in the interest of the general public);
– to demand imposition of restriction on processing of personal data (except where such data is being processed for performance of a legal obligation, exercise of public authority or performance of duties in the interest of the general public);
– to demand that no automated decision in his or her regard is to be made on the basis of his or her personal data;
– to withdraw the consent provided for processing of personal data (if processing of the data was based on such consent).
We will reply to an application without delay, however, not later than within one month after receipt of the application. We will send our reply first and foremost electronically, as well as using another method stated in the application.
The subject of an unreasonable or repeated application does not have to be satisfied, and we may ask for a reasonable payment for performance of the action applied for, taking into consideration administrative expenses required for satisfaction of the application.
If a person finds that his or her rights were unreasonably restricted or violated, the person has the right to turn to the Estonian Data Protection Inspectorate or to court Reply to a letter, request for explanation, registered letter and request for information According to the law, data regarding written communication with the Ministry of the Interior is available in the public document registry on the website of the Ministry of the Interior.
Based on the public view of the document registry a natural person cannot be identified –only the initials are disclosed.
Applications and inquiries of persons are registered in the electronic document administration system of the Ministry of the Interior, and they are identified as information with restricted access. Personal data of persons is stored electronically in the document administration system of the ministry and used only for replying to an inquiry of a respective person. If in order to reply to an inquiry of a person and to receive additional information for that purpose, the ministry needs to communicate with a third party is required, the respective personal data is disclosed in the minimum required amount.
If a third person wishes to get familiarised with the written communication between a person and the ministry, and submits a respective request for information, the ministry reviews the request of such person and decides whether the document can be issued in part of in full. When a document is issued under a request for information, personal contact details of a person such as e-mail address, postal address or telephone number are hidden (except for written communication with a representative of a legal entity or body). With respect to other aspects application of restriction on access depends on the content of the document. Grounds for application of restrictions on access are stated in Article 35 of the Public Information Act.
Irrespective of a restriction on access to a document, the document is issued to a body or person which has the right to familiarise itself with such document (such as, for example, an investigative body, prosecutor’s office or court). If the ministry receives from a person a letter, request for information, registered letter or request for information, replying to which belongs to the competence of another body, the request is forwarded to such body, and the person is notified of such forwarding in writing. Usually written communication with persons is retained in the ministry for five years or until expiry of the term stated in a legal instrument. After expiry of the term for retention the documents or data are deleted.
Processing of personal data of participants in the Welcoming Programme
Participation of persons in the Welcoming Programme results in accumulation of personal data which is processed only by servants occupying positions specifically provided for this purpose.
Personal data of participants is accumulated when a participant submits documents arising from the terms and conditions of participation, and:
• personal data is processed on the basis of information disclosed by a participant and information from public sources;
• a participant has the right to know which data has been collected in his or her regard by the Ministry of the Interior;
• a participant has the right to familiarise himself or herself with the data collected in his or her regard by the Ministry of the Interior, and to provide clarifications in its regard, demand correction of incorrect data and submit objections regarding its processing;
• data of other participants is not disclosed;
• data of participants constitutes information with restriction on access, and third persons (including competent bodies) can access such information only in cases provided for by the law.
Violations related to personal data
If a violation related to personal data took place in the ministry, and such violation can pose danger to rights and freedoms of a person, we will take measures in order to end the violation and prevent further violations. We will also prepare respective documents and inform the Estonian Data Protection Inspectorate.
If a violation committed with regard to personal data can result in a serious danger to a person, we will also notify the person thereof, so that the person can also adopt measures that could mitigate the situation.