Telia Eesti AS

Complaint filed

28.03.2026

Decision

19.05.2026

Time to decision

52 days

Decision number

2.1-1/26/646-1332-2

GDPR articles

57

What was in the complaint

A Telia customer since 2016 — the contract was signed on 30 January, ten years of relationship.

21 February 2026 — an Art. 15 GDPR request with six specific demands: profiling and RTB, cross-border transfer, shadow-banning, third-party logs for 5 years, the legal basis for data enrichment, automated decisions. The statutory reply deadline was 23 March.

25 February and 10 March — clarifying letters.

12 March — Telia replied partially.

20 March — a formal warning letter was sent with five breaches and technical evidence: HAR files, GTM containers, transfer to Grafana (USA), Ultimate.AI, the national ID code in the URL. The deadline for correction was 27 March.

23 March — the statutory deadline for replying to the request expired. No complete reply under Art. 15(1)(a)–(h) was received.

27 March — the warning deadline expired. Telia did not respond to a single one of the five points.

The key evidence: the national ID code in an open URL

The national identifier was transmitted as a GET parameter in the address bar of Telia’s personal account area — on every click. This means it ended up in Telia’s server logs and those of all intermediate systems, in the user’s browser history, and was potentially accessible to third-party analytics systems loaded on the site.

Recorded in several independent sessions, in different browsers.

What the DPO himself acknowledged

27 March — a day before the complaint was filed — Telia’s DPO Andrus Hinrikus replied personally. The reply contains four written admissions:

1. The GTM tags fired without consent.
2. On the transmission of the ID code in the URL — “additional technical measures are planned”.
3. Grafana Labs is a sub-processor of Ultimate Enterprises Oy, not named in the privacy policy.
4. Ultimate Enterprises Oy (formerly Culinar OY) is a data processor, not named in the privacy policy.

The complaint was filed on 28 March — despite the admissions, because the breaches had already occurred and the reply remained incomplete on a number of points.

GDPR articles: 5(1)(f), 5(1)(c), 6/7, 13(1)(e), 22, 25, Chapter V.

What AKI decided

Proceedings discontinued on 19 May 2026. Decision No. 2.1-1/26/492-1102-2.

The regulator restated Telia’s explanations and accepted them: Grafana does not use personal data and is a component of the technical infrastructure; Google Tag Manager does not collect personalised data without consent.

Grounds for refusal: Art. 57(1)(f) — complaints are handled “to the appropriate extent”; the GDPR does not oblige issuing an order on every complaint.

Analysis

What makes this case special

The operator admitted the breaches in writing — and it did not help. Telia’s DPO confirmed that the GTM tags fired without consent. This is not the complainant’s assumption or a disputed reading of a HAR file. It is an admission by the controller, made in correspondence.

The regulator closed the case.

On discretion — honestly

Formally AKI is right: the CJEU in case C-768/21 (26 September 2024) confirmed that a supervisory authority is not obliged to apply corrective measures in every situation — including when the breach was in the past and the controller has taken measures that give no grounds to expect a recurrence.

But the conditions of that judgment work only in combination: the breach is remedied, the processing is brought into compliance, and the inaction does not undermine the rigour of enforcement.

Here not one of the conditions is met. The DPO wrote that the measures are “planned” — that is, not taken. The ID code was transmitted in the URL and still is.

What remained unchecked

AKI accepted the explanation that “Grafana is a component of the technical infrastructure”. But the DPO, in the same letter, admitted that Grafana was not named in the privacy policy. That is Art. 13(1)(e): recipients of data must be disclosed. There is an admission, there is no check.

The same with Ultimate Enterprises Oy: a processor not named in the policy. Admitted. Not checked.

← back to all cases