CHANCELLOR OF JUSTICE AS THE PREVENTIVE MECHANISM Under § 5 of the PDPA, processing of personal data is any act performed with personal data, including the collection, recording, organisation, storage, alteration, disclosure, granting access to personal data, consultation and retrieval, use of personal data, communication, cross-usage, combination, closure, erasure or destruction of personal data or several of the aforementioned operations, regardless of the manner in which the operations are carried out or the means used. In addition to the requirement that processing of personal data by an administrative authority must have a legal basis (§ 10(2) of the PDPA), the Act also establishes the principles of purposefulness and minimalism of processing, i.e. a social welfare institution is obliged to process personal data only in conformity with the objective of the processing and to the minimum extent necessary for achieving the objective (§ 6 clauses 2 and 3 of the PDPA). This means that signs on the doors of the rooms of residents in a social welfare institution should only include data which is unavoidably necessary for achieving the purpose of the processing. The purpose of disclosing personal data of the clients is simplification of orientation for the clients in the institution. However, to achieve this purpose, it is not unavoidably necessary to disclose both the first name and surname of the client. Definitely, it would also be sufficient to disclose only first names and/or initials of the clients. Thus, the practice of disclosing first names and surnames of clients in social welfare institutions is not in conformity with the principles of personal data protection. In order to bring the situation in line with the requirements of the law, it could be recommended that the nameplates on the doors should be designed in the above manner. 9. Notifying legal representatives of clients Workers of social welfare institutions asked in which cases and on which basis a social welfare institution should notify a legal representative of a client. First, it should be clarified who can be a person’s legal representative. A legal representative of a minor is their parent, guardian or rural municipality or city authority having the right of curatorship; a legal representative of an adult person is their guardian or rural municipality or city authority. The relevant regulation concerning when and what information a social welfare institution should notify to a client’s legal representative is established in the Social Welfare Act. First, under § 1131(1) clause 1 of the Social Welfare Act, upon commencement of the provision of special care service, a provider of special care service is required to notify, in addition to the person receiving the service, also the person’s legal representative of its rules of procedure and the rights of the person and restrictions during the receipt of the service. Notification takes place orally or in writing and only if the person is able to understand what is said or read. If the person is not able to understand what is being said or read, the legal representative of the person is notified of the rules of procedure of the service provider and the rights of the person and restrictions during the receipt of the service. Thus, it is assumed that if a service recipient has a legal representative the latter visits the institution upon commencement of the provision of the service to the person under their guardianship. A social welfare institution must have available exhaustive and clear material for the service recipients, describing the internal rules of the institution, the rights and duties of the service recipients, and indicating the possible appeal mechanisms (available procedures either inside or outside the institution and the possibilities for their use). This document should be made publicly available on the notice-boards in the institution and issued in writing to each service recipient and their legal representative in a language understood by them. This requirement is also noted in the CPT report on the visit to Estonia, paragraph 122 of which states that “an introductory leaflet/brochure setting out the establishment’s routine and patients’/residents’ rights should be issued to each patient/resident on admission, as well as to their families”. On this basis, a service provider is required to issue this information material to each service recipient and their legal representative regardless of whether the persons ask for the information or not.18 18 18 Similarly, e.g. the Supreme Court Administrative Law Chamber in its judgment of 15 February 2005 No 3-3-1-90-04, para 16, decided as follows: “Duties of the administrative authority include not only conducting formally inevitable proceedings for issuing acts but also ensuring that individuals without knowledge of law and unskilled in bureaucratic procedures could productively participate in the proceedings. Counselling and explanation may take place at the request of a person as well as on the initiative of the administrative authority.”