In December 2019 and January 2020, the Estonian Financial Intelligence Unit (RAB) rejected two requests by X for access to the information held by that unit about the exchange of information with financial institutions or foreign authorities concerning him. X challenged the decision before the national courts, and the Estonian Supreme Court ultimately ruled in his favour, holding that the GDPR applied to the processing of personal data by financial intelligence units.

Meanwhile, X submitted a new access to information from the RAB regarding any ongoing investigations into him. The RAB refused access again. Following a complaint lodged by X, the Estonian Data Protection Authority (AKI) ordered the RAB to reconsider its decision and grant X access to the requested information.

However, the RAB continued to refuse disclosure, maintaining in a series of decisions its obligation to preserve the confidentiality of the information contained in the RAB database in order to protect the Estonian financial system. X challenged these refusals before the national courts. At both first and second instance, the courts ordered the RAB to disclose the requested information.

The RAB appealed the judgment to the Estonian Supreme Court, which referred questions to the Court of Justice concerning the EU legal framework governing the processing of personal data by financial intelligence units. The questions essentially concern which EU data-protection rules apply, whether access to the information may be deferred until its destruction, whether a financial intelligence unit may refuse such access, and under what circumstances such a restriction is lawful.

In her opinion, European Court of Justice Advocate General Laila Medina delineates the legal framework applicable to Financial Intelligence Units (FIUs), such as the RAB. She emphasises that a proper balance must be struck between limiting access to personal data processed by the public authority in pursuing its legitimate aims, and safeguarding against any abuse, unlawful access or misuse of those data.

Firstly, the Advocate General recalls that the GDPR excludes the application of the general framework for data protection when two specific conditions are met: (i) the processing is performed by a public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties as well as any other body or entity designated under national law as possessing public authority or power for the same purposes and (ii) the processing operation is for the purposes of preventing, investigating, detecting, or prosecuting criminal offences, or executing criminal penalties.

When both criteria are met, the processing of the data falls under the scope of the EU’s specialised regime namely Directive 2016/680.

Financial Intelligence Units (FIUs), in the exercise of their mission to prevent, detect and combat money laundering and terrorist financing, fulfil both of these criteria and therefore qualify as competent authorities. Such qualification does not depend on the organisational structure of the FIU. In fact, EU legislation on combatting money laundering and terrorist financing requires FIUs to operate as independent and autonomous bodies with extensive powers to obtain information from law enforcement authorities and swiftly and decisively act against transactions that facilitate money laundering or terrorist financing. The missions, functions and powers of the FIUs demonstrate the importance of their role in crime detection and crime prevention in that field.

Secondly, under EU law, a total prohibition on access to personal data held by FIUs may be compatible with their mission to safeguard strict confidentiality. However, any such restriction must comply with the principle of proportionality, which requires it to be limited in scope and duration to what is necessary to achieve the legitimate aim.

Read more here