PRESS RELEASE: Baltic Data Protection Authorities Meet in Tallinn to Address Common Challenges

The meeting highlighted several trends shared across all three countries: the growing relevance of national security and defence-related issues, an increasing focus on prevention and awareness-raising, rising complaint volumes and growing case complexity, particularly as a result of artificial intelligence.

"The challenges faced by data protection authorities are increasingly interconnected. Alongside a growing number of complex cases, we need to put greater emphasis on prevention and o making data protection understandable and accessible, particularly for children and young people. At the same time, the changing security environment requires us to carefully consider how data protection rules apply in the context of national security. Regional cooperation helps us share experience and develop practical responses to these common challenges." - Pille Lehis, Director of the Estonian Data Protection Inspectorate

All three authorities have seen a significant increase in complaints and requests, while cases are also becoming more extensive and complex. AI is increasingly used in preparing complaints and requests, which can result in submissions that require considerable resources to assess. Despite the growing workload, the authorities have so far maintained efficient processing and response times.

"The increase in complaints reflects growing awareness of data protection rights, but it also creates a clear need for prioritisation. With limited resources, supervisory authorities must carefully consider where their work can have the greatest impact. This means focusing more strongly on priorities and, where necessary, reconsidering or reducing work on individual cases involving disputes between natural persons ." - Jekaterina Macuka, Director of the Latvian Data State Inspectorate

Prevention and awareness-raising, particularly among children and young people, are becoming increasingly important across the Baltic region. The authorities exchanged experience on which awareness-raising tools and methods work best and how preventive activities could be developed in the longer term. The importance of simple and clear communication was also emphasised as data protection issues become increasingly complex.

The meeting also covered the application of GDPR Articles 16 and 17, including inaccuracies in national registers, and the national security exemption and situations in which the GDPR does not apply. The authorities presented significant national cases, including cases concerning data processor liability and Article 32 security requirements in Lithuania, criminal record data in employment matters in Latvia, and Article 10 of the GDPR in relation to a privately operated website listing persons convicted of sexual offences and offences against minors in Estonia.

Artificial intelligence and emerging technologies were another key focus. The authorities exchanged practical experience on new supervisory tools, including an anonymisation tool, as well as the monitoring of EU large-scale information systems and the management of large cross-border cases.

"Artificial intelligence is changing both the issues we supervise and the way supervisory work is carried out. At the same time, new technologies can provide us with better tools for more efficient supervision. Sharing practical experience, solutions and lessons learned between our authorities is therefore increasingly important as we respond to these rapid changes." - Dijana Šinkūnienė, Director of the State Data Protection Inspectorate of Lithuania

The annual meeting reaffirmed the importance of close cooperation between the Baltic data protection authorities in addressing shared challenges, exchanging practical solutions and developing effective and forward-looking approaches to data protection supervision.

Estonia, Latvia and Lithuania will continue to strengthen their cooperation and exchange experience in order to support effective data protection supervision across the Baltic region.