Finland vs Estonia: e-administration models
Key Features of Their E‑Administration Models (Brief Context)
Before diving into cases, some groundwork:
Estonia is often seen as one of the most advanced in digital public infrastructures in the world: digital identities (e‑ID), X‑Road data exchange, public registers, mandatory digital services, etc.
Finland also has strong digital public services, though somewhat more cautious / incremental in legal change; strong emphasis on privacy, data protection, proportionality, legal foundations; also strong document management and public procedure laws.
Legal systems in both require balancing between citizens’ rights (privacy, due process, freedom of expression) and the efficiency & innovation of digital services.
Selected Judicial / Administrative Case Studies in Finland
Here are detailed case law / decisions in Finland that illustrate issues in e‑administration, data law, procedural law, digital services, etc.
| Case | Facts / Issue | Legal Questions | Decision Summary | Implications for E‑Administration |
|---|---|---|---|---|
| Finland / Supreme Administrative Court: Google Search & “Right to be Forgotten” – X and Data Protection Ombudsman v Google (2018, Decision KHO:2018:112) | A person (“X”) asked Google (Finland and Google Inc.) to remove links in Google Search to web addresses containing personal data: psychiatric assessment, health info, and a criminal sentence (though with diminished responsibility). Google denied. “X” took the matter to the Data Protection Ombudsman who ordered removal; Google resisted. | The tension between privacy / protection of personal data vs freedom of expression / public interest, especially re: criminal convictions, public record, and historical record; whether national law implementing EU law (then the Data Protection Directive 95/46/EC) required removal. | The Supreme Administrative Court held that there must be a fair balancing: sometimes the public interest in information outweighs privacy, but in this case, the privacy interest overrode the public interest. The links were ordered removed. | This decision shows how digital search engines are regulated in Finland, how e‑administration systems that provide “searchable public records” must respect individual rights, and that “once searchable” is not always indefinite. For government services that provide data, this precedent sets boundaries. FRA |
| GDPR Fines – Two Cases by Supreme Administrative Court (KHO:2023:81 & KHO:2023:82) | The Finnish Data Protection Ombudsman imposed administrative fines on data controllers: one was Posti Oy (national postal) fined €100,000 for privacy breaches in change‐of‐address services; another on a company handling job applicants’ data (~€12,500). The controllers appealed. | What is required for transparency / information obligations under GDPR? What is “active measures” in giving data subjects necessary info? Also, what is the role of national supervisory authorities vs courts in imposing / upholding fines? And how proportionate & pre‑emptive must the controller be? | In the first case (Posti Oy), the Supreme Administrative Court upheld the fine: the information obligations were indeed breached; the data subject did not receive adequate information in a timely manner. In the second case, the Court upheld the lower court’s overturning of the fine: here the breach was less clear / disproved or not sufficiently serious. | These show that Finland’s e‑administration (and government contractors, public sector organizations) are strictly bound by GDPR obligations; digital services, online tools, e‑government interfaces must ensure proper notice/information, consent (where required), and handling of personal data. The precedent influences how public digital services are structured in terms of privacy. NIELS+1 |
| Can Public Schools Use Google Workspace under GDPR? – Finnish Supreme Administrative Court (2025) | The City of Espoo (a local municipality) decided to adopt Google Workspace for Education in its public schools. Pupils/students would use cloud‐based tools from Google. Concerns were raised whether use of such third‑party cloud services is compatible with GDPR, especially the legal basis for processing, data transfers, and whether public schools (as public authorities) can rely on “statutory obligation” basis. | What legal basis under GDPR can public institutions rely on? Is using a commercial cloud provider acceptable? Are such uses “necessary and proportionate”? What about data control, oversight, security? | The Court affirmed that public education institutions may rely on GDPR Article 6(1)(c) (“processing is necessary for compliance with a legal obligation”) as legal basis, but imposed conditions: the use must be necessary, proportionate; data subject (students etc.) rights must be preserved; security safeguards must be in place; oversight and transparency required. | This shows how digital tools adoption in public sector (schools) is possible but under strict legal control. E‑administration in education, a domain with sensitive data, requires good legal basis, and cannot simply adopt any cloud service without fulfilling privacy law. |
| Online Procedures & E‑Communication with Courts | Finland has progressively allowed initiation of court actions / certain procedural steps online (uncontested claims, certain enforcement applications, legal aid, reimbursement applications etc.). The justice system provides e‑communication and online processing of such cases. | Which procedural acts can be done online? Are there exclusive online procedures? What are due process / rights considerations (access, representation, identity, procedural fairness) when moving to online procedures? | Yes, many procedures can be initiated and conducted online; not all are exclusively online; parties’ participation via e‑communication is increasingly accepted subject to procedural protections. For example, the Supreme Court decision that judges themselves cannot sit via video link unless law explicitly allows: in two criminal appeal cases, judge participation via videolink (not just parties) was deemed a procedural error because law did not permit it. | Indicates that e‑administration of courts (digital filing, e‑participation) is expanding but is constrained by procedural law. Legal reforms sometimes lag behind technological possibilities; courts may overturn or declare invalid online/digital practices not backed by statute. It underscores importance of legal foundation for digital procedural changes. e-justice.europa.eu+1 |
| Platform Workers / Employee Status via Digital Platform – Supreme Administrative Court (2025) | Food delivery workers operating via platforms (apps) claimed that though they present themselves as contractors or self‑employed, in practice there is a subordinate / employer‐employee relationship because of supervision, direction, quality controls, etc., exercised through the digital platform. | Does platform work qualify as “employment” under Finnish Employment Contracts Act given digital supervision, algorithmic control, directive powers via platform? What rights follow (wages, social insurance, labor protections)? | The Court held that yes, in this case, the couriers are “employees” rather than independent contractors. Although they had some autonomy over working hours (thus certain labor laws like Working Hours Act did not apply in full), the overall structure (control, direction, standards etc.) created an employment relationship. | Has implications for regulation of digital/platform‑based public or quasi‑public services, gig economy in e‑administration context; government contracts, labor law must adapt to digital modes of work. Also influences tax, social welfare, rights through digital platforms. DLA Piper GENIE |
Selected Case Studies in Estonia
Estonia’s model has several landmark legal / administrative cases which show how its e‑administration legal framework has been tested, especially in data protection, constitutional/EU law, public registers, infrastructure, etc.
| Case / Decision | Facts / Issue | Legal Question(s) | Decision Summary | Implications for Estonia’s E‑Administration |
|---|---|---|---|---|
| Estonia / Supreme Court / Case No. 1‑16‑6179 (2021) – Traffic/Location Data as Evidence | Defendant was convicted of offences including computer‐related fraud and violent actions. The prosecution had obtained traffic and location data from a telecommunications operator under Estonian law, specifically the Electronic Communications Act, and Code of Criminal Procedure. | Whether the national provisions permitting collection / use of traffic / location data (stored under Electronic Communications Act) as evidence are compatible with EU law (privacy, directives on data, Charter of Fundamental Rights). And whether in case of conflict with EU law, national law should be disapplied. | The Supreme Court found those national law provisions were in conflict with EU law and could not be interpreted in a way to remove the conflict; accordingly, they had to be disapplied. Thus, the evidence obtained under those specific conflicting provisions was inadmissible (for the criminal proceeding in question). | This upholds strong protections for personal data in Estonia even when government seeks to use digital evidence; it reinforces that e‑administration tools (e.g. telecom data, metadata) must comply with EU standards. Also shows that national laws that conflict with EU law will be set aside, influencing how Estonian e‑gov develops its surveillance, data logs, etc. FRA |
| Tallinn Administrative Court / Case No. 3‑22‑2556 (Elisa Eesti AS v Cybersecurity Council etc.) CJEU Case C‑354/24 (2024) | Elisa Eesti AS applied for permit for using Huawei hardware/software in its network (2G‐4G existing, 5G planned). The application was reviewed by Estonian regulatory / cybersecurity / consumer protection authorities. There were national rules / concerns (security, supervision), and this has implications for foreign tech providers, network security. | Legal issues: How national regulation / permits for telecom infrastructure intersect with cybersecurity regulation, consumer protection, possibly EU law; what criteria are to be used; how rights and obligations balance. Also whether restrictions or approvals must take into account EU law principles (e.g., non‑discrimination, proportionate regulation). | The Tallinn Administrative Court decided on the matter; it's being referred to CJEU Case C‑354/24 for interpretation of EU law in relation to national rules. (As of the date, decision sought more guidance from EU level.) | Demonstrates how Estonia’s e‑administration (esp in telecoms, network infrastructure) is not just about digital services but hardware/software, foreign vendors, security; legal frameworks must align with EU law. The reference to CJEU shows that national digital infrastructure decisions are subject to supranational legal oversight. |
| RIHA (Administration System for State Information Systems) (Estonia, regulatory infrastructure case) | RIHA is essentially Estonia’s registry/catalogue of public sector information systems. It includes services, system components, data models etc. Use of RIHA is mandatory for state agencies; it's regulated under the Public Information Act and rules for State Information Management. | Legal questions around mandatory registration, transparency, public information, interoperability, oversight, possible obligations of agencies regarding reporting, public access. Also the regulation of digital infrastructure: what legal obligations agencies have to declare systems / services, ensure security, data flows. | The state requires that all public sector agencies register their systems, services etc. in RIHA; the system ensures record‑keeping, interoperability, oversight of what systems exist; ensures that there is a legal obligation to use and maintain metadata, security classification etc. | This is a foundational legal and institutional piece of Estonia’s digital administration. It ensures that digital systems aren’t ad hoc; that all systems are catalogued, known, with metadata, ownership, security status. Enables better governance of digital services. |
| Electrooniline Riigi Teataja (e‑RT) – Official Publication of Laws & Acts | Electrooniline Riigi Teataja is the official online publication for Estonian laws and official announcements. From certain dates, many laws are only published in this electronic format (paper version phased out). | Legal questions: what gives official force to electronic publication; when does a law become effective; whether electronic publication meets constitutional or statutory requirements; whether citizens’ rights to access law are satisfied via digital means. | Estonian law provides that e‑RT is the authoritative source; laws generally come into force a given number of days after official electronic publication. Paper publication is no longer required in many cases. | This is a core example of digitisation of legal administration: official lawbooks, legal norms moving fully online; reduces delays, cost, improves access. Also shows legal recognition of digital publication as equally valid as print. |
| General ‑ e‑governance & X‑Road / “Once Only” / AI GovStack etc. (less formal case, more policy + law) | Estonia has developed a digital infrastructure (X‑Road) to interconnect public and private data registries, allowing secure data exchange; compulsory digital IDs for citizens; The “Once Only Principle” (government doesn’t ask you for data you’ve already given elsewhere); recent development of AI GovStack (reusable AI components for public administration) etc. | Not always litigated in court, but legal frameworks (Data Protection Act, Public Information Act, cybersecurity law, privacy law) regulate these systems. Some courts have had to decide on conflicts (e.g., in cases about privacy or admissibility of data). The infrastructure’s legality, standards, transparency, security, checks & balances are under legal oversight. | The systems are operating under legal frameworks; citizens’ rights are protected via court decisions (as above, e.g. traffic/location data case). There is administrative oversight, data protection supervision, and legal obligations for transparency, purpose limitation etc. | These institutional legal frameworks support Estonia’s e‑administration model: legal basis for digital ID, for mandatory participation, for data sharing, for public services fully online. Also provide model for proactive services, automation, etc. |
Comparative Insights / Contrasts via These Cases
From the above cases, some patterns, similarities, differences emerge. These help understand strengths, trade‑offs, and lessons.
| Dimension | Estonia’s Approach (from cases + practice) | Finland’s Approach (from cases + practice) |
|---|---|---|
| Legal basis & formal recognition of digital services | Estonia often has legal provisions for e‑ID, mandatory use of e‑services, official electronic publication (laws via e‑RT), and mandatory registries for public systems (RIHA). These are codified in law/regulation. | Finland has legal basis for e‑communication, online procedures, but courts are strict about what is allowed: e.g. judges cannot sit via video link unless law explicitly allows; GDPR legal basis must be well justified. Digital adoption is cautious and governed by case law. |
| Data protection and privacy | Heavily integrated. Courts in Estonia have struck down national laws that conflict with EU law (traffic/location data case). Digital infrastructure must align with EU directives / regulation. | Similarly strong. Finland’s GDPR cases (both transparency / information obligations, right to be forgotten, cloud services) show close legal scrutiny; public institutions held to high standards. |
| Procedural fairness / due process in digital settings | In Estonia’s criminal evidence law: court disallows evidence collected under conflicting data laws; thus procedural rights are protected even in digital surveillance / telecom data settings. | In Finland: procedural rules govern what can be done online; participation of judges, parties via video link, e‑communication is allowed under certain conditions; courts are cautious when law does not support certain practices. |
| Interoperability, infrastructure & system registries | Estonia’s RIHA and X‑Road ensure that digital systems are catalogued, interoperable, governed; once‑only principle; strong infrastructure for data exchange. | Finland also has strong document management (e.g. Finnish Parliament’s past SGML/XML project), legal databases (Finlex), e‑communication with courts etc., but maybe less centralized / less mandatory in some respects; more layering of rules. |
| Balance of innovation vs legal constraints | Estonia tends to push innovation (eID, digital voting, proactive services), with legal framework evolving; sometimes courts have to adjust or interpret law in the context of new technologies. | Finland tends to be more incremental: courts often emphasize that legal changes or legal basis must exist; innovation must stay within bounds of statute / EU law; emphasis on legality, proportionality. |
Additional Hypothetical or Emerging Issues (Based on Cases, Trends)
From the cases above and ongoing developments, some issues are emerging or will become more central:
Algorithmic / AI systems in public sector: As Estonia builds AI GovStack etc., Finland may also move into automation / decision support. Legal questions will include transparency, accountability, bias, rights to explanation, etc.
Cross‑border / EU law conflicts: The Estonia traffic/location data case shows that national laws that conflict with EU law will be disapplied. Finland too must ensure national laws (and local municipal rules) align with GDPR, Charter. Also, issues around cloud service providers outside EU jurisdictions, data transfers etc.
Digital identity, e‑signatures: Estonia has deeply embedded eID; Finland had TUPAS and strong electronic identification. The legal recognition and security frameworks are critical.
Access, inclusion & procedural access: Ensuring citizens who are less digitally literate or have no reliable internet are not excluded; procedural fairness in court participation via digital means.
Cybersecurity, national security vs privacy: As digital infrastructure comes under threat, legal decisions will need to balance early notification of incidents, disclosure, oversight vs confidentiality, protection of state interests. Finland’s “precedent setting cyber security incident” case is an example. Castrén & Snellman
Conclusion
Putting it all together:
Both Estonia and Finland have robust legal models for digital administration.
Estonia tends to have more foundational mandatory digital infrastructure (eID, official electronic law publication, system registries), pursuing greater digitalization / proactive services; but this requires continuous legal oversight, especially regarding privacy, evidence, EU compliance.
Finland tends to have carefully incremental evolution, with courts ensuring that digital practices are supported by statute; strong privacy enforcement; cautious expansion in procedural digitalization (e.g. online court communications).
The case law shows that while digital administration offers efficiency, convenience, etc., legal principles like legal basis, proportionality, due process, data protection, and EU law supremacy repeatedly act as constraints / boundaries.
RELATED Blog
0 comments