Short answer
The production Legalcode index returned four relevant orders of the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI). Two answer the question especially directly:
- In , the person repeatedly disputed two parking-related claims and sought deletion. AKI ordered the payment-default register to stop publishing both entries and delete their data by 11 May 2023.
- In , four old debt entries contained materially inaccurate and repeatedly altered amounts, dates or statuses. AKI ordered the register to stop publishing and delete all four entries by 12 June 2023.
Two adjacent decisions show that deletion was also ordered where the objection concerned limitation or the proportionality of continued publication rather than a simple factual error:
- , concerning an €82.06 time-barred parking claim; and
- , concerning a small entry after the principal had been paid and €34.68 in ancillary charges remained displayed.
In each order AKI required Krediidiregister OÜ to end publication of the specified payment-default data and delete it. Each order set a deadline, required confirmation of compliance and warned of a €25,000 coercive payment for non-compliance—per unfulfilled point where the order contained several points.
The decisions do not establish that labelling a debt “disputed” always compels immediate deletion. They show that the register must investigate accuracy, legal basis, necessity and the person's objection, and must stop processing when it cannot prove a lawful and proportionate basis for continued publication.
The four indexed orders at a glance
The euro figures describe what the register displayed at the dates stated in the orders. They are not findings that every stated amount was a legally enforceable debt.
Case 2.1.-1/23/53-152-8: the person disputed the claims
The first directly responsive decision concerned two payment-default entries submitted by Julianus Inkasso OÜ. The register displayed €82.69 for an entry dated 16 March 2019 and €33.79 for an entry dated 15 August 2021.
The person sought deletion at least three times in January 2023. They said they had disputed the creditor's claims, that the claims lacked a basis and, in relation to the earlier correspondence described by AKI, that they had not parked at the location in question. Krediidiregister rejected the objections and maintained that it had sufficiently checked accuracy, transparency and excessive harm.
AKI did not accept that response. Its analysis treated the register as responsible for its own processing. The register had to establish a legal basis, perform the necessary balancing, respond properly to the objection and comply with the information duties under Article 14 of the GDPR. It could not make the person's exercise of deletion rights depend on separately persuading every joint or participating controller.
The operative order required Krediidiregister to:
- stop publishing and delete the €82.69 entry; and
- stop publishing and delete the €33.79 entry.
Both points had to be completed by 11 May 2023. AKI required notice of compliance and warned that each unfulfilled point could attract a €25,000 coercive payment, repeatedly if necessary until compliance.
The important distinction is between a bare assertion and a substantiated objection. The decision does not say that adding the word “disputed” to a file necessarily makes an otherwise accurate entry unlawful. It shows that once the person challenges the basis of the claim, the register cannot continue publication on generic assurances. It must have evidence sufficient to verify the debt data and must be able to justify continued processing despite the objection.
Case 2.1.-1/2023-2727: the register published inaccurate debtor information
This is the clearest indexed accuracy decision. The register contained four entries originating between 2008 and 2010. During AKI's investigation, evidence about amounts, creditors, dates and limitation did not match the underlying documents.
AKI recorded striking changes. One original figure of €200.27 was increased to €9,857.86 and later reduced to €6,136.71. Another amount was changed to approximately six times its earlier value. Dates and statuses were also altered. AKI found that the displayed data had not matched the source documents, that the controller admitted at least some mismatch, and that inaccurate information had been disclosed to third parties for a long period.
The person had been notifying the register of inaccuracies and requesting correction since October 2022. They also asked for publication to be restricted while their objection was considered. The register nevertheless continued displaying the entries and began substantive checking only after AKI opened supervisory proceedings.
AKI linked those facts to the accuracy principle in Article 5(1)(d) of the GDPR and the verification duty in §10 of Estonia's Personal Data Protection Act. Its reasoning also referred to the rights to rectification, erasure and objection, and to the duty to notify recipients of corrections or erasure. A payment-default register must check more than whether the original supplier continues to assert that a debt exists; it needs sufficiently precise supporting material.
AKI ordered Krediidiregister to stop publishing and delete all four entries. The displayed figures were €6.83, €3,749.57, €1,680.74 and €6,136.71. The deadline was 12 June 2023, with a €25,000 coercive-payment warning for each unfulfilled point.
Deletion, rather than merely substituting another set of figures, reflected the combined findings. The entries were inaccurate, old and time-barred; their history and presentation did not give a reliable account; continued publication was not shown to be necessary or proportionate; and the controller had not complied with objection and transparency duties.
Case 2.1.-1/23/601-1542-9: a time-barred claim was still displayed
The September 2023 order concerned one €82.06 parking-related entry dating from November 2019. The person argued that the claim was time-barred and asked the register to stop publication. Earlier Finnish parking claims had been cancelled and removed.
AKI noted that a consumer-dispute body had regarded the remaining parking claim as justified. That did not decide whether publishing it in a payment-default register remained lawful. The consumer body had not performed the data-protection assessment of excessive harm, necessity and proportionality.
The register marked the claim time-barred but proposed to display it for five more years. AKI rejected automatic reliance on the maximum period. It considered the small amount, the age and limitation of the claim, the absence of newer displayed defaults, the creditor's collection activity, the objection and the harm caused by continued publication. AKI also rejected reliance on four earlier Finnish claims that had been cancelled.
The result is useful for disputed-debt handling: a dispute over enforceability and a data-protection objection are not resolved simply by leaving the entry visible with an “expired” label. Nor may a register use publication as pressure to pay a claim that the debtor may refuse to perform because of limitation.
AKI ordered the register to stop publishing and delete the €82.06 entry by 21 September 2023. The order carried a €25,000 coercive-payment warning.
Case 2.1.-1/23/1323-3299: principal paid, ancillary charges remained
The May 2024 order concerned a small payment-default entry. During the proceeding the person paid €40 in principal, but the register continued displaying €34.68 in ancillary charges. The person had objected to publication and requested deletion.
AKI considered the small amount, the fact that the principal had been paid, the period for which the information had already been public, the lack of demonstrated intentional non-payment and the weak connection between the remaining entry and a meaningful creditworthiness assessment. It also found failures in the controller's response to the objection and its transparency duties.
AKI ordered Krediidiregister to stop publishing the entry and delete its data by 5 June 2024. It again required confirmation and warned of a €25,000 coercive payment.
This case is not primarily a finding that the remaining €34.68 was mathematically false. It is an example of accurate-in-the-narrow-sense data becoming unlawful to publish because the controller cannot establish continuing necessity and proportionality after the circumstances change.
What a credit bureau should take from the decisions
A dispute must trigger evidence-based review
The controller should identify exactly what is challenged: the identity of the debtor, formation of the agreement, amount, creditor, payment status, assignment, limitation, or the necessity of publication. It must obtain and examine evidence suited to that issue. Asking the reporting creditor whether it still stands by the claim is not always enough.
Accuracy includes dates, amounts and status
The accuracy obligation is not confined to matching a name or personal identifier. The indexed decisions examine the principal and ancillary sums, claim and publication dates, whether a claim has been paid or time-barred, and whether the display suggests an active enforceable debt.
Any change should be traceable to source evidence. Repeated unexplained changes during a complaint or supervisory proceeding are a warning that the original publication controls were inadequate.
Restriction may be necessary while facts are checked
Where accuracy is contested and cannot be established immediately, continuing to disclose the adverse entry to lenders can compound the harm. The 2023 accuracy order records that the person sought suspension of publication during review. A bureau should therefore have a workflow for restricting third-party display while it investigates, rather than treating deletion as the only possible control.
A valid debt does not automatically justify publication
The September 2023 order makes this especially clear. Whether an underlying claim exists and whether a credit bureau may continue disclosing it are distinct questions. A bureau must separately establish the purpose, necessity, legitimate-interest balance, transparency and the absence of excessive harm.
The five-year ceiling is not a guaranteed publication period
AKI treated the statutory period as an outside limit, not a default entitlement. Small amounts, an isolated incident, payment of principal, limitation, lack of active collection, cancelled comparator claims and the passage of time can all weaken the case for continued display before the maximum period ends.
The register owns the compliance decision
The four orders were addressed to the register operator. A credit bureau cannot outsource its GDPR and §10 duties to the creditor or debt collector. It must be able to show its own accuracy checks, legal-basis analysis, response to objections, transparency notices and deletion decision.
A practical dispute-and-correction workflow
The decisions support a workflow that records:
- the precise entry and every field challenged;
- the person's stated grounds and supporting material;
- the creditor, original source documents and chain of assignment;
- identity matching and evidence for the amount, dates and current status;
- whether the claim is paid, settled, cancelled, adjudicated or time-barred;
- whether publication should be restricted during verification;
- a fresh legitimate-interest and excessive-harm assessment;
- the response to the person and the evidence relied upon;
- correction or deletion across every public and downstream copy;
- notification to recipients where required; and
- proof of completion and an audit trail of every change.
The decision should not be framed as “creditor says debt exists, therefore keep it.” The legally relevant output is whether this controller can prove that these particular data are accurate and that their continued disclosure for this purpose remains lawful and proportionate.
Authority, scope and currentness
Each source is an AKI ettekirjutus-hoiatus: a binding supervisory order accompanied by an enforcement warning, not general guidance. The orders state that an appeal does not suspend the duty to comply. They decide the identified facts and entries; they do not create an automatic deletion rule for every contested claim.
The decisions applied the GDPR and the Estonian Personal Data Protection Act provisions in force for their proceedings. They are most useful as concrete examples of AKI's application of accuracy, transparency, objection, erasure, legitimate-interest and excessive-harm requirements. A present-day case still requires checking the current legislation and its own evidence.
All four decisions were found in the production Legalcode EE_AKI_DECISIONS collection and their complete text was reviewed through MCP-provided authenticated downloads on 13 September 2026. The public links above point to the official AKI PDFs.
During this review, source-scoped discovery of documentType values for the separate EE_AKI guidance collection returned an unmeasured snapshot instead of facet values. That production discovery defect is tracked in . It did not affect the text or metadata of the four decisions discussed here.
Conclusion
AKI's indexed decisions show two different routes to the same practical remedy. In one, the person disputes the legal or factual basis and the register cannot substantiate continued processing. In the other, the register's dates, amounts or statuses are themselves inaccurate. Limitation, payment and disproportionality can also make continued publication unlawful even when the underlying claim is not proven false.
In all four indexed orders, AKI required the payment-default register to stop publishing the specified entries and delete them. The lesson for a credit bureau is not “delete whenever anyone objects,” but “verify promptly, restrict where necessary, perform a fresh legal assessment, and delete when accuracy or lawful necessity cannot be demonstrated.”
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.