Short answer
The two source types perform different jobs.
, gives a general workflow. A person may object to a payment-default register at any time, explain why publication is wrong or excessively harmful, and expect a response within one month. The register should perform a fresh legitimate-interest assessment. If there is no satisfactory response, the person may complain to the Estonian Data Protection Inspectorate (AKI) with signed, case-specific evidence.
Published AKI decisions show what happens when that workflow becomes a supervisory case. They do not merely repeat the FAQ. They test the actual claims, documents, dates, amounts, controller response, transparency and proportionality. Where the register could not prove accurate and lawful continued publication, AKI issued binding orders to stop publication and delete identified entries by a fixed date, backed by a coercive-payment warning.
Two decisions illustrate the contrast:
- concerned two disputed parking-related entries. AKI ordered both to be removed and deleted by 11 May 2023.
- concerned four old entries with materially inaccurate or repeatedly altered amounts, dates or statuses. AKI ordered all four to be removed and deleted by 12 June 2023.
The decisions do not establish an automatic rule that writing “I dispute this debt” requires immediate deletion. Their stronger lesson is that an objection shifts the matter from routine display to documented verification and renewed legal justification. Continued publication requires proof; a creditor's assertion or a generic policy is not enough.
Guidance and decisions answer different questions
Guidance is therefore a starting framework. Decisions are applications of law to proved facts and contain an operative outcome.
What the guidance tells a person to do
AKI's FAQ defines a payment default as information about an unpaid obligation disclosed through a payment-default register. It explains that the data are not simply open to every internet user; a recipient must have a legal basis, with prospective lenders given as a typical legitimate-interest example for creditworthiness assessment.
Where a person disagrees with publication, the FAQ says they may object to the register at any time and explain why publication is incorrect or excessively harmful. The register should respond within one month and perform a new legitimate-interest assessment explaining why continued publication is lawful and not excessively damaging.
If the register does not respond within the month or its answer is unsatisfactory, the FAQ says the person may complain to AKI. It asks for:
- a signed complaint so identity can be verified;
- correspondence with the register and/or creditor;
- a screenshot of the register display;
- an explanation of why publication is excessively harmful; and
- an explanation of the underlying debt circumstances.
That checklist reflects an intake and evidence function. It helps AKI identify the exact processing, prior objection and disputed facts. It does not place the ultimate burden of proving lawful continued publication on the data subject.
Guidance separates three questions that are often conflated
A dispute may concern at least three distinct issues:
- Underlying claim: does the creditor have a valid and enforceable claim?
- Data accuracy: do the register's debtor identity, amount, creditor, dates and status accurately represent the supported facts?
- Publication lawfulness: even if some claim exists, is disclosing this record for creditworthiness assessment necessary, proportionate and supported by a valid legitimate-interest balance?
The FAQ focuses primarily on the second and third questions. AKI is not presented as a general debt court. A register cannot, however, avoid data-protection responsibility by saying the first question belongs only between creditor and debtor.
When a dispute reveals that the register cannot substantiate what it publishes, accuracy and lawfulness become data-protection issues within AKI's remit.
The guidance gives a framework, not a mechanical score
The FAQ explains legitimate interest through three stages:
- identify the controller's or third party's interest and its weight;
- identify the data subject's rights and interests and their weight; and
- balance the competing interests, adding safeguards where needed and reaching a final assessment.
It also points to statutory circumstances that prevent processing, including excessive harm, publication too soon after breach and publication beyond the statutory outer period after the obligation ends. It treats accuracy and relevance as part of excessive-harm analysis.
The FAQ says payment-default data may be published for no more than five years after payment or limitation, but immediately qualifies that maximum: the proper period depends on the amount, the person's other debts and circumstances relating to debtor and creditor.
The maximum is therefore not a five-year entitlement. Nor does the FAQ say that every small, disputed, paid or time-barred entry must be deleted on the same day. It describes factors to assess.
Decision 2.1.-1/23/53-152-8 tested two disputed claims
The April 2023 order concerned two entries submitted by Julianus Inkasso OÜ and displayed by Krediidiregister OÜ. The register showed €82.69 for one entry and €33.79 for another. The complainant did not accept the parking-related claims and repeatedly asked for deletion.
AKI examined more than the fact that an objection existed. Its order records:
- what the complainant asserted;
- the register's responses;
- the material supplied to support the claims;
- whether a legitimate-interest assessment addressed this person's position;
- the handling of the Article 21 objection; and
- whether the person had received the required information before publication.
AKI found that the register continued publication after the objection without supplying the required individual balancing analysis and without establishing the compelling legitimate grounds needed to continue. It also found transparency failures: publishing data-protection terms on a website did not prove that the person had received the required information before the default was published.
The operative part ordered the register to stop publishing and delete both entries by 11 May 2023. It required confirmation to AKI and warned of a €25,000 coercive payment for each unfulfilled point, repeatable until compliance.
That is the key difference from guidance. The FAQ tells a controller to reassess. The order determines that this controller's assessment and proof were insufficient for these entries and commands a remedy.
Decision 2.1.-1/2023-2727 tested accuracy as well as proportionality
The May 2023 order concerned four older payment-default entries. The full decision records material instability in their presentation.
One amount originally shown as €200.27 was increased to €9,857.86 during the supervisory process and later reduced to €6,136.71. AKI also recorded changes to dates and statuses, mismatches with supporting documents, old and time-barred claims, and objections the person had raised repeatedly since October 2022.
AKI explained why this matters to both sides of a credit decision. Materially inaccurate debt data can harm the data subject by causing refusals or worse terms, while also misleading a prospective creditor that relies on the register.
The decision also states that payment-default disclosure cannot serve as a collection-pressure mechanism. Its legitimate purpose is to support meaningful creditworthiness assessment. Old, inaccurate or misleading records that no longer characterize payment behaviour do not achieve that purpose merely because a creditor still wants payment.
AKI rejected the suggestion that the complainant's failure to quantify excessive harm relieved the controller of its own balancing duty. That assessment is required before collection or disclosure and must be revisited when the person objects. The register continued publication without proving accuracy, producing the required individual balancing assessment or addressing the objection adequately.
AKI ordered publication of all four entries to stop and their data to be deleted by 12 June 2023, again with a €25,000 coercive-payment warning for each unfulfilled point.
An objection changes the burden of continued publication
The guidance invites the person to give reasons and evidence. The decisions make clear that this is not a transfer of accountability.
A useful operational distinction is:
- the person should identify why an entry is contested and provide material reasonably available to them; but
- the controller must be able to prove the accuracy, legal basis, necessity and proportionality of its own processing.
After an Article 21 objection, the decisions treat proof of compelling legitimate grounds as a precondition to continued processing. A standard-form rejection saying “the creditor confirms the debt” does not establish that the register independently checked the disputed fields or balanced this person's circumstances.
“Disputed” is a status requiring analysis, not the final answer
Neither source type supports either extreme:
- automatic deletion: any objection, however unsupported, instantly erases an otherwise lawful record; or
- automatic retention: the creditor maintains its claim, so the register can keep displaying it until a maximum period expires.
Instead, the controller should identify the precise point of dispute:
- identity or matching;
- formation of the underlying transaction;
- principal or ancillary amount;
- creditor or assignment chain;
- due date, breach date or publication date;
- payment, settlement, cancellation or limitation;
- description of the entry's current status; or
- necessity and proportionality of continued disclosure.
The evidence needed depends on that issue. A ledger may help prove an amount but not contract formation. A creditor's internal note may not prove notice. A judgment or settlement may resolve the claim but still leave a separate proportionality question about continued publication.
Restriction during verification may be necessary
The general guidance says the register must answer and reassess. The accuracy decision records that the complainant sought restriction while the dispute was investigated.
Where accuracy cannot be established immediately, continuing disclosure can multiply the harm with every lender query. A defensible dispute workflow should therefore include an express decision on temporary restriction, record the reasons, and prevent downstream systems from treating an unresolved field as verified.
The two fetched orders ultimately required deletion, but deletion and interim restriction are not interchangeable. Restriction preserves the record while stopping or narrowing use during verification; deletion removes it when continued processing lacks a lawful basis or the applicable right requires erasure.
Guidance is general; orders have bounded reach
The FAQ is public guidance. It summarizes AKI's interpretation for recurring situations and can be used to design a complaint or compliance process. It is not a finding that a named register or creditor breached the law.
The two decisions are ettekirjutus-hoiatus documents—binding orders with warnings—addressed to Krediidiregister OÜ. They establish AKI's findings for the specified records, parties, evidence and dates. They are strong examples of how AKI applies accuracy, transparency, objection, legitimate-interest and excessive-harm requirements, but they are not court precedents and do not automatically decide another person's debt.
The correct use is analogous reasoning:
- compare the disputed field and available proof;
- compare the age, amount, payment and limitation circumstances;
- examine whether an individual balance was performed;
- test whether the register answered the objection and informed the person properly; and
- choose restriction, correction, continued publication or deletion on the current evidence.
A combined dispute workflow
Reading the guidance and decisions together supports this sequence:
- Identify the exact record, every challenged field and who supplied it.
- Record the objection date, grounds, requested remedy and attachments.
- Consider temporary restriction while disputed facts are checked.
- Obtain evidence suited to the dispute rather than only asking whether the creditor still asserts the claim.
- Verify identity, agreement, amount, creditor, dates, payment and current status.
- Separate the claim's existence or enforceability from the lawfulness of publishing it.
- Perform a fresh, individual legitimate-interest and excessive-harm assessment.
- Answer within the applicable period with the evidence and reasoning relied upon.
- Correct, restrict or delete the entry where the evidence or legal assessment requires it.
- Notify relevant recipients where correction or erasure duties apply.
- Preserve the version history, decision, completion evidence and downstream actions.
- If the person remains dissatisfied, retain a complete complaint file for AKI review.
The workflow should never reduce to “creditor confirms—objection closed.”
Authority and coverage limits
This comparison is based on the AKI payment-default FAQ carrying a source-native “Last updated” date of 4 January 2024 and two published supervisory orders dated 27 April and 26 May 2023. They were returned from the separate EE_AKI guidance and EE_AKI_DECISIONS decision collections and verified through exact authenticated full-text downloads on 13 September 2026.
The FAQ and decisions apply data-protection principles to payment-default publication. They do not decide the civil validity of every underlying claim, replace the current GDPR or Estonian statute, or establish that the same remedy follows from superficially similar facts. Current law, later decisions and the complete evidence should be checked for a live dispute.
MCP and source audit findings
Production research used two source-profile Discover calls, two source-scoped Estonian-language Searches and three exact Fetches, reaching the seven-call cap. Every call used the configured production bypass token and charged zero. The three authenticated downloads were reviewed in full.
The guidance record's source-native update date matched its Search and Fetch publication date. The two orders' case numbers, decision dates, official PDF URLs and operative text were internally consistent. Search correctly separated the guidance and agency-decision source families.
Two decision-metadata defects were confirmed:
- The fetched metadata for order 2.1.-1/2023-2727 includes
GDPR Article 19 point 21, although Article 19 has no such point and the authenticated text cites Article 21 separately. This current agency-decision reproduction was added to , which asks for legal-basis hierarchy validation and repair of mixed locators. - Four returned payment-default orders omit
decisionOutcome,finalOutcome,remedyOrOrder,governmentActionandsanctionType, although Discovery advertises those fields as present and filterable and the operative text contains explicit deletion orders and coercive-payment warnings. requests extraction, backfill, provenance and source-scoped filter verification.
These metadata defects do not change the verified operative text, but they prevent reliable outcome filtering and can create false law-to-decision relationships. This article therefore treats the authenticated decision bodies—not the incomplete structured outcome fields—as the evidence of the remedies.
Conclusion
AKI guidance says how a disputed payment-default record should enter review: object to the register, explain the problem, expect a timely and individualized reassessment, and escalate to AKI with the correspondence and evidence if necessary.
Published decisions show the evidentiary and enforcement consequences. AKI examines whether the particular data are accurate, whether the controller answered the objection, whether transparent notice was given and whether continued publication remains necessary and proportionate. When the controller cannot prove those conditions, AKI may order identified entries removed and deleted by a deadline under threat of coercive payment.
The legally careful rule is therefore neither “disputed means delete” nor “creditor says valid means retain.” A dispute requires prompt verification and a fresh legal assessment; continued publication must be proved on the record.
Sources and audit issues
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.