Data Protection Inspectorate orders Treimann-Legrant to cease maintaining offender registry

The Data Protection Inspectorate has ordered the cessation of publishing personal data related to court judgments on the website ettevaatust.ee. Blogger Mallu Mariann Treimann-Legrant and her husband created a registry in March containing data on approximately 900 sexual and intimate partner violence offenders. The Inspectorate considers such a privately-initiated registry to violate the EU General Data Protection Regulation.

The Data Protection Inspectorate (DPI) issued an order on Wednesday, 17 June 2026, requiring the cessation of publishing personal data related to court judgments on the website ettevaatust.ee. The order is directed at the NGO associated with blogger and content creator Mallu Mariann Treimann-Legrant and her husband Tomas Märten Legrant.

What is ettevaatust.ee?

Treimann-Legrant and her husband created a registry in mid-March containing deliberately and systematically compiled data on approximately 900 sexual and intimate partner violence offenders, including names, photographs, dates of birth, and references to convictions. The website allowed users to display an offender's name, photograph, and court judgment with a few clicks.

DPI: an unlawful registry

According to the DPI, the website maintains a registry of court convictions in criminal cases, which under the EU General Data Protection Regulation is not permitted to be maintained outside the supervision of a public authority. The Inspectorate emphasises that this is not a matter of reporting individual cases, but rather a deliberately compiled extensive registry.

"The structure of the website, its operation, and the explanations provided by its operator confirm that it is a registry collecting criminal data. No public authority has instructed the website operator to maintain such a registry or exercises oversight over its contents. Therefore, the website must cease publishing personal data related to court judgments," states the DPI notice.

Director General: the registry creates false sense of security

Pille Lehis, Director General of the Inspectorate, understands the public's desire to know who lives around them. "People's wish to know whether dangerous criminals live in their vicinity is entirely understandable. Particularly when it comes to sexual offences or crimes against children. However, we must recognise that a privately-initiated registry can create a false sense of security," said Lehis.

He explained that viewing the website may give the impression that all individuals one should be cautious of are listed there, but this impression is mistaken. "Privately-initiated registries, whose data processing is not clearly regulated, which lack oversight, and whose operator does not assume responsibility for their accuracy, cannot guarantee this and may cause additional harm both to victims of crimes and to people whose data is included there by mistake," Lehis added.

What does the order mean?

The DPI order concerns only the publication of personal data related to court judgments and does not require the NGO to completely shut down the website. Other content, such as media coverage, may remain. The order also does not affect the public accessibility of court judgments in the State Gazette nor does it restrict the right to publish information on matters of public interest. The website operator must comply with the order by 29 June 2026 at the latest.

Estonia maintains a state criminal register, the maintenance of which is regulated by law. The Ministry of Justice and Digitalisation is currently preparing amendments that should make it easier to use this register.