The official portal of the Estonian courts — 420 requests, 19 nodes, a 116-second recording. The pages run five external measurement and sharing services, none of which is named in the data-processing policy, and the very fact that analytics and cookies are used is absent from it. Meanwhile the document states outright that visit data is collected only in anonymised form. There is no consent mechanism: Google's analytics, Matomo and Cloudflare Insights start from the page markup before any user choice. The Universal Analytics property running on the site has been defunct since 2023.
Request timeline
Declared versus actual
Transfer timings
Container gtm 4e68d0, inserted into the home page markup.
Social-share buttons, 34 requests over the recording.
Performance measurement, six requests.
Matomo on RIK infrastructure, six requests to matomo.js.
Google fonts, IP address goes to Google.
The analytics.js counter, property UA-57253013-1, defunct since 2023.
Detected trackers
- Google Analytics (UA-57253013-1) via www.google-analytics.com — Universal Analytics, property defunct since 2023, requests keep going out
- Google Tag Manager (www.googletagmanager.com, container gtm 4e68d0) — loads the analytics.js counter
- Matomo (statistika.rik.ee) — visit counter on RIK infrastructure, six requests to matomo.js
- AddToAny (static.addtoany.com) — social-share buttons, 34 requests
- Cloudflare Insights (static.cloudflareinsights.com) — performance measurement, six requests
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — fonts, IP address goes to Google
Indicators of GDPR non-compliance
- GDPR Art. 5(1)(a) — transparencyThe courts' data-processing policy describes visiting the site in a single paragraph: IP address, browser and operating-system version, time and duration of the visit are collected — and it states outright that this information is not linked to data identifying you and is used only in anonymised form, solely for technical-security purposes and compiling visit statistics. In fact the pages run Google Analytics, Google Tag Manager, Matomo, AddToAny and Cloudflare Insights. Google's analytics relies on a client identifier stored in a cookie — that is, data tied to the device, which is incompatible with the declared anonymity. Neither analytics, nor cookies, nor any of these services are mentioned in the document.
- GDPR Art. 13(1)(e) — disclosure of recipientsNot a single recipient of web data is named in the document. Google, Matomo, AddToAny and Cloudflare are absent from the text. The document names controllers and processors for the judicial registers in detail — the Ministry of Justice, RIK, the Maritime Administration — but does not disclose the recipients of data collected when visiting the site at all.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the portal: across 116 requests to kohus.ee there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The analytics scripts — Google Tag Manager, the analytics.js counter, Matomo — start from the page markup at +184…+717 ms, before any user choice. The regulator Andmekaitse Inspektsioon states directly that placing analytics and advertising cookies requires prior freely given consent (Directive 2002/58/EC, Art. 5(3); CJEU judgment C-673/17). The portal offers neither consent nor any means of refusal.
- GDPR Art. 5(1)(c) — data minimisationThe pages run the Universal Analytics property UA-57253013-1: data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023. Requests to www.google-analytics.com nonetheless keep going out, and the Google Tag Manager container keeps pulling in the counter. Transmission to a defunct property serves no declared purpose. Separately: fonts are loaded directly from Google's servers (fonts.gstatic.com), so the visitor's IP address goes to Google without necessity — they could be hosted on the site's own infrastructure.
Context
www.kohus.ee is the official portal of the Estonian courts. The data-protection specialist is andmekaitse@kohus.ee. The portal is served through Cloudflare (headers cf-ray, server: cloudflare) over Varnish (x-adv-varnish, x-pass-varnish); the content is in Estonian.
The recording: 420 requests, 19 nodes, a recording length of 116.4 seconds, taken on 17 August 2026. Of the 420 requests, 116 fall on the kohus.ee domain itself and 304 go outward. However, the greater part of the external requests (272) relates to the LinkedIn page the user navigated to via a link midway through the recording; directly on the kohus.ee pages, 32 external requests to seven nodes are at work. The session runs across several internal sections of the portal, departs midway to an external company page on LinkedIn and returns.
The processing is described by one document — “Processing of personal data in the courts” (Isikuandmete töötlemine kohtutes), with the file last edited on 17 August 2026. The document is detailed: definitions, grounds for processing, court proceedings, disclosure of data online, judicial registers, the rights of the data subject. No separate cookie document for the portal was found.
Who receives data directly
Google (Analytics, Tag Manager, Fonts), Matomo, AddToAny, Cloudflare.
Declared versus actual
The document describes anonymised collection; the page behaves otherwise. The policy sets out the processing of a site visit in one paragraph: IP address, browser and operating-system version, time and duration of the visit are collected. And then — a direct guarantee: this information is not linked to data identifying you and is used only in anonymised form, data is collected only on which part of the page was visited and how long was spent there, and it serves only technical-security purposes and compiling visit statistics.
The recording shows five external measurement and sharing services. Google Tag Manager (container gtm 4e68d0) pulls in the Universal Analytics counter — a model built around a client identifier in a cookie, that is, data tied to the device. Matomo on statistika.rik.ee is a visit counter. AddToAny is a set of share buttons that call an external domain on every page. Cloudflare Insights is performance measurement. The anonymity declared in the document is incompatible with analytics that rely on a persistent identifier.
Not a single recipient of web data is named. The document thoroughly lists controllers and processors for the judicial registers — the Ministry of Justice, RIK, the Maritime Administration. But with respect to the data collected when visiting the site, there are no recipients: Google, Matomo, AddToAny and Cloudflare are absent from the text. The words “cookie” (küpsis) and “analytics” (analüütika) do not appear in the document even once.
The basis is not declared, yet consent is required by law. Analytics and advertising cookies, per the guidance of the Estonian regulator Andmekaitse Inspektsioon and the CJEU judgment C-673/17, require prior freely given consent from the user. The portal does not request such consent: across all requests to kohus.ee there was neither a consent-management platform nor a script bearing the marks of a banner. The analytics scripts — Google Tag Manager, the analytics.js counter, Matomo — start straight from the page markup within the first few hundred milliseconds, without any preceding choice.
A running counter that is defunct. The property UA-57253013-1 is Universal Analytics. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023. Requests to www.google-analytics.com nonetheless keep going out on every page, and Google Tag Manager keeps pulling in the counter. Transmission to a defunct property serves none of the declared purposes.
The fonts carry the IP address to Google. The Montserrat fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor’s IP address goes to Google on every visit. They can be hosted on the site’s own infrastructure — there is no technical need for external loading.
Security headers are set in part. The portal sets strict transport with a one-year term, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban, and also a detailed Content-Security-Policy with a domain allow-list — this is noticeably better than average. But there is no referrer policy and no permissions policy.
Consent: what is proven and what is not
Proven: there is no consent mechanism on the portal. Across 116 requests to kohus.ee there is not a single request to a consent-management platform and not a single script bearing the marks of a banner. The names of known platforms and general markers in addresses and initiators were checked; zero matches.
Proven: the loading of analytics does not depend on the user’s choice. The scripts for Google Tag Manager, the analytics.js counter, Matomo, AddToAny and Cloudflare Insights are initiated by the page markup itself and run when the browser parses it, at +184…+717 ms. There is no condition before them; on every new internal page the bundle runs again.
Proven: the running analytics property is defunct. The property identifier UA-57253013-1 is readable in the addresses of requests to Google Tag Manager and to the counter. This is a Universal Analytics property that stopped processing data in 2023.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. All conclusions rest on addresses, initiators, response codes and the composition of requests.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers several internal pages of the portal and one departure to an external company page on LinkedIn. Resources loaded after that departure — the LinkedIn page itself (licdn.com, linkedin.com), the protechts.net anti-bot protection with transmission to Microsoft, a Google sign-in button and Azure WAF — belong to LinkedIn’s territory, not kohus.ee, and do not enter the analysis of the portal’s violations. They are listed in the timeline only for the completeness of the session picture.
The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. Because response bodies are absent, checks against page markup — the insertion of counters, the presence of a hidden consent banner in the code — are impossible with this file; the conclusion that there is no consent mechanism rests on the absence of requests to consent platforms and of scripts bearing their marks. Full identifiers are not reproduced in the analysis.
The identification of services rests on domains and address patterns: Google Analytics — by google-analytics.com and the property number UA-57253013-1; Google Tag Manager — by googletagmanager.com and the container number; Matomo — by statistika.rik.ee and the matomo.js file; AddToAny — by addtoany.com; Cloudflare Insights — by cloudflareinsights.com; the serving provider — by the cf-ray, server: cloudflare and x-adv-varnish headers.
Conclusion
The official portal of the Estonian courts collects visitor data through five external services — Google Analytics, Google Tag Manager, Matomo, AddToAny and Cloudflare Insights — none of which is named in the data-processing policy. Meanwhile the policy itself states outright that visit data is collected only in anonymised form and serves only technical security and statistics. Google’s analytics, relying on an identifier in a cookie, contradicts this statement.
There is no consent mechanism on the portal: the analytics scripts start from the page markup before any user choice, whereas placing analytics cookies, per the regulator’s guidance and CJEU practice, requires prior freely given consent. The words “cookie” and “analytics” do not appear in the document at all. The Universal Analytics property running on the site has been defunct since 2023, yet requests to it keep going out on every page. The fonts are loaded directly from Google, carrying the visitor’s IP address outward without necessity.
Remediation: name all recipients of web data in the policy, with the fields transmitted and the purposes; introduce a consent mechanism that actually governs the loading of analytics and advertising services, with the option to refuse before they start; bring the paragraph on anonymised collection into line with actual practice, or abandon analytics that rely on identifiers; remove the defunct Universal Analytics property UA-57253013-1; move the fonts to the site’s own infrastructure; add a referrer policy and a permissions policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
a5bdc59a8d680a36e7fe1f689259f7a69e5a01ffdc969eb2d1f940d698568e01Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — kohus.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта kohus.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Политика обработки данных судов описывает посещение сайта одним абзацем: собираются адрес IP, версия браузера и операционной системы, время и длительность посещения — и прямо заявляет, что эта информация не связывается с идентифицирующими данными и используется только в обезличенном виде, исключительно в целях техбезопасности и составления статистики посещаемости. Фактически на страницах работают Google Analytics, Google Tag Manager, Matomo, AddToAny и Cloudflare Insights. Аналитика Google опирается на идентификатор клиента в cookie — то есть на данные, привязываемые к устройству, что несовместимо с заявленной обезличенностью. Ни аналитика, ни cookie, ни один из этих сервисов в документе не упомянуты. 2) Ни один получатель веб-данных не назван в документе поимённо. Google, Matomo, AddToAny и Cloudflare в тексте отсутствуют. Документ подробно называет контролёров и обработчиков для судебных реестров — Минюст, RIK, Департамент водных путей, — но получателей данных, собираемых при посещении сайта, не раскрывает вовсе. 3) Механизма согласия на портале нет: за 116 обращений к kohus.ee не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера. Аналитические сценарии — Google Tag Manager, счётчик analytics.js, Matomo — стартуют из разметки страницы на +184…+717 мс, до какого-либо выбора пользователя. Регулятор Andmekaitse Inspektsioon прямо указывает, что установка аналитических и рекламных cookie требует предварительного добровольного согласия (директива 2002/58/EC, ст. 5(3); решение Суда ЕС C-673/17). Ни согласия, ни возможности отказа портал не предлагает. 4) На страницах работает ресурс Universal Analytics UA-57253013-1: обработка данных в стандартных ресурсах Universal Analytics прекращена Google 1 июля 2023 года. Обращения к www.google-analytics.com тем не менее уходят, а контейнер Google Tag Manager продолжает подгружать счётчик. Передача данных в недействующий ресурс не служит никакой заявленной цели. Дополнительно: шрифты подгружаются напрямую с серверов Google (fonts.gstatic.com), из-за чего адрес IP посетителя уходит в Google без необходимости — их можно разместить на собственной инфраструктуре. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — kohus.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website kohus.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The courts' data-processing policy describes visiting the site in a single paragraph: IP address, browser and operating-system version, time and duration of the visit are collected — and it states outright that this information is not linked to data identifying you and is used only in anonymised form, solely for technical-security purposes and compiling visit statistics. In fact the pages run Google Analytics, Google Tag Manager, Matomo, AddToAny and Cloudflare Insights. Google's analytics relies on a client identifier stored in a cookie — that is, data tied to the device, which is incompatible with the declared anonymity. Neither analytics, nor cookies, nor any of these services are mentioned in the document. 2) Not a single recipient of web data is named in the document. Google, Matomo, AddToAny and Cloudflare are absent from the text. The document names controllers and processors for the judicial registers in detail — the Ministry of Justice, RIK, the Maritime Administration — but does not disclose the recipients of data collected when visiting the site at all. 3) There is no consent mechanism on the portal: across 116 requests to kohus.ee there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The analytics scripts — Google Tag Manager, the analytics.js counter, Matomo — start from the page markup at +184…+717 ms, before any user choice. The regulator Andmekaitse Inspektsioon states directly that placing analytics and advertising cookies requires prior freely given consent (Directive 2002/58/EC, Art. 5(3); CJEU judgment C-673/17). The portal offers neither consent nor any means of refusal. 4) The pages run the Universal Analytics property UA-57253013-1: data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023. Requests to www.google-analytics.com nonetheless keep going out, and the Google Tag Manager container keeps pulling in the counter. Transmission to a defunct property serves no declared purpose. Separately: fonts are loaded directly from Google's servers (fonts.gstatic.com), so the visitor's IP address goes to Google without necessity — they could be hosted on the site's own infrastructure. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — kohus.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi kohus.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Kohtute andmetöötluspoliitika kirjeldab saidi külastamist ühes lõigus: kogutakse IP-aadress, brauseri ja operatsioonisüsteemi versioon, külastuse aeg ja kestus - ning sätestatakse selgesõnaliselt, et see teave ei ole seotud andmete tuvastamisega ja seda kasutatakse ainult anonüümsel kujul, ainult tehnilise turvalisuse ja kohalolijate statistika jaoks. Tegelikult töötavad lehed Google Analytics, Google Tag Manager, Matomo, AddToAny ja Cloudflare Insights. Google Analytics tugineb küpsises olevale kliendi ID-le – see tähendab seadmega seotud andmetele, mis ei ühildu deklareeritud anonümiseerimisega. Analüütilisi ega küpsiseid ega ühtegi neist teenustest dokumendis ei mainita. 2) Veebiandmete saajat dokumendis ei nimetata. Google, Matomo, AddToAny ja Cloudflare on kadunud. Dokumendis kirjeldatakse üksikasjalikult kohturegistrite vastutavaid ja volitatud töötlejaid – justiitsministeeriumi, RIKi, veeteede ministeeriumi –, kuid saidi külastamisel kogutud andmete saajaid ei avalikustata üldse. 3) Portaalis puudub nõusolekumehhanism: kohus.ee 116 kõne puhul puudub juurdepääs nõusoleku haldamise platvormile, puudub bännerimärkidega skript. Analüütilised stsenaariumid - Google Tag Manager, analytics.js counter, Matomo - algavad lehekülje märgistusest +184. +717 ms, enne kasutaja valikut. Reguleeriv asutus Andmekaitse Inspektsioon sätestab sõnaselgelt, et analüütiliste ja reklaamiküpsiste paigaldamiseks on vaja eelnevat vabatahtlikku nõusolekut (direktiiv 2002/58/EÜ, artikli 5 lõige 3; kohtuotsus C-673/17). Portaal ei paku nõusolekut ega keeldumisvõimalust. 4) Universal Analytics UA-57253013-1: andmete töötlemine Universal Analyticsi standardressurssides lõpetas Google 1. juulil 2023. Kontaktid www. Kuid google-analytics.com on kadunud ja Google Tag Manageri konteiner jätkab arvesti laadimist. Andmete edastamine mitteaktiivsele ressursile ei täida ühtegi kindlaksmääratud eesmärki. Lisaks laaditakse fonte alla otse Google'i serveritest (fonts. gstatic.com), mistõttu läheb külastaja IP-aadress Google'ile ilma vajaduseta - neid saab paigutada oma infrastruktuuri. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — kohus.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом kohus.ee. 2. Обстоятельства Я посетил сайт kohus.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 17.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Политика обработки данных судов описывает посещение сайта одним абзацем: собираются адрес IP, версия браузера и операционной системы, время и длительность посещения — и прямо заявляет, что эта информация не связывается с идентифицирующими данными и используется только в обезличенном виде, исключительно в целях техбезопасности и составления статистики посещаемости. Фактически на страницах работают Google Analytics, Google Tag Manager, Matomo, AddToAny и Cloudflare Insights. Аналитика Google опирается на идентификатор клиента в cookie — то есть на данные, привязываемые к устройству, что несовместимо с заявленной обезличенностью. Ни аналитика, ни cookie, ни один из этих сервисов в документе не упомянуты. 2) Ни один получатель веб-данных не назван в документе поимённо. Google, Matomo, AddToAny и Cloudflare в тексте отсутствуют. Документ подробно называет контролёров и обработчиков для судебных реестров — Минюст, RIK, Департамент водных путей, — но получателей данных, собираемых при посещении сайта, не раскрывает вовсе. 3) Механизма согласия на портале нет: за 116 обращений к kohus.ee не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера. Аналитические сценарии — Google Tag Manager, счётчик analytics.js, Matomo — стартуют из разметки страницы на +184…+717 мс, до какого-либо выбора пользователя. Регулятор Andmekaitse Inspektsioon прямо указывает, что установка аналитических и рекламных cookie требует предварительного добровольного согласия (директива 2002/58/EC, ст. 5(3); решение Суда ЕС C-673/17). Ни согласия, ни возможности отказа портал не предлагает. 4) На страницах работает ресурс Universal Analytics UA-57253013-1: обработка данных в стандартных ресурсах Universal Analytics прекращена Google 1 июля 2023 года. Обращения к www.google-analytics.com тем не менее уходят, а контейнер Google Tag Manager продолжает подгружать счётчик. Передача данных в недействующий ресурс не служит никакой заявленной цели. Дополнительно: шрифты подгружаются напрямую с серверов Google (fonts.gstatic.com), из-за чего адрес IP посетителя уходит в Google без необходимости — их можно разместить на собственной инфраструктуре. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 5(1)(a) — прозрачность; GDPR Art. 13(1)(e) — раскрытие получателей; ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — минимизация 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — kohus.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website kohus.ee. 2. Circumstances I visited the website kohus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 17 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The courts' data-processing policy describes visiting the site in a single paragraph: IP address, browser and operating-system version, time and duration of the visit are collected — and it states outright that this information is not linked to data identifying you and is used only in anonymised form, solely for technical-security purposes and compiling visit statistics. In fact the pages run Google Analytics, Google Tag Manager, Matomo, AddToAny and Cloudflare Insights. Google's analytics relies on a client identifier stored in a cookie — that is, data tied to the device, which is incompatible with the declared anonymity. Neither analytics, nor cookies, nor any of these services are mentioned in the document. 2) Not a single recipient of web data is named in the document. Google, Matomo, AddToAny and Cloudflare are absent from the text. The document names controllers and processors for the judicial registers in detail — the Ministry of Justice, RIK, the Maritime Administration — but does not disclose the recipients of data collected when visiting the site at all. 3) There is no consent mechanism on the portal: across 116 requests to kohus.ee there is not a single request to a consent-management platform, nor a single script bearing the marks of a banner. The analytics scripts — Google Tag Manager, the analytics.js counter, Matomo — start from the page markup at +184…+717 ms, before any user choice. The regulator Andmekaitse Inspektsioon states directly that placing analytics and advertising cookies requires prior freely given consent (Directive 2002/58/EC, Art. 5(3); CJEU judgment C-673/17). The portal offers neither consent nor any means of refusal. 4) The pages run the Universal Analytics property UA-57253013-1: data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023. Requests to www.google-analytics.com nonetheless keep going out, and the Google Tag Manager container keeps pulling in the counter. Transmission to a defunct property serves no declared purpose. Separately: fonts are loaded directly from Google's servers (fonts.gstatic.com), so the visitor's IP address goes to Google without necessity — they could be hosted on the site's own infrastructure. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 5(1)(a) — transparency; GDPR Art. 13(1)(e) — disclosure of recipients; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — data minimisation 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil kohus.ee. 2. Asjaolud Külastasin veebisaiti kohus.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 17.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Kohtute andmetöötluspoliitika kirjeldab saidi külastamist ühes lõigus: kogutakse IP-aadress, brauseri ja operatsioonisüsteemi versioon, külastuse aeg ja kestus - ning sätestatakse selgesõnaliselt, et see teave ei ole seotud andmete tuvastamisega ja seda kasutatakse ainult anonüümsel kujul, ainult tehnilise turvalisuse ja kohalolijate statistika jaoks. Tegelikult töötavad lehed Google Analytics, Google Tag Manager, Matomo, AddToAny ja Cloudflare Insights. Google Analytics tugineb küpsises olevale kliendi ID-le – see tähendab seadmega seotud andmetele, mis ei ühildu deklareeritud anonümiseerimisega. Analüütilisi ega küpsiseid ega ühtegi neist teenustest dokumendis ei mainita. 2) Veebiandmete saajat dokumendis ei nimetata. Google, Matomo, AddToAny ja Cloudflare on kadunud. Dokumendis kirjeldatakse üksikasjalikult kohturegistrite vastutavaid ja volitatud töötlejaid – justiitsministeeriumi, RIKi, veeteede ministeeriumi –, kuid saidi külastamisel kogutud andmete saajaid ei avalikustata üldse. 3) Portaalis puudub nõusolekumehhanism: kohus.ee 116 kõne puhul puudub juurdepääs nõusoleku haldamise platvormile, puudub bännerimärkidega skript. Analüütilised stsenaariumid - Google Tag Manager, analytics.js counter, Matomo - algavad lehekülje märgistusest +184. +717 ms, enne kasutaja valikut. Reguleeriv asutus Andmekaitse Inspektsioon sätestab sõnaselgelt, et analüütiliste ja reklaamiküpsiste paigaldamiseks on vaja eelnevat vabatahtlikku nõusolekut (direktiiv 2002/58/EÜ, artikli 5 lõige 3; kohtuotsus C-673/17). Portaal ei paku nõusolekut ega keeldumisvõimalust. 4) Universal Analytics UA-57253013-1: andmete töötlemine Universal Analyticsi standardressurssides lõpetas Google 1. juulil 2023. Kontaktid www. Kuid google-analytics.com on kadunud ja Google Tag Manageri konteiner jätkab arvesti laadimist. Andmete edastamine mitteaktiivsele ressursile ei täida ühtegi kindlaksmääratud eesmärki. Lisaks laaditakse fonte alla otse Google'i serveritest (fonts. gstatic.com), mistõttu läheb külastaja IP-aadress Google'ile ilma vajaduseta - neid saab paigutada oma infrastruktuuri. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-kohus-ee/ 3. Sätted, mille järgimist palun kontrollida GDPR artikli 5 lõike 1 punkt a Läbipaistvus; GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR artikli 5 lõike 1 punkt c – minimeerimine 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]