On 12 November 2026 the Tallinn Administrative Court ordered the Estonian state to pay businessman Parvel Pruunsild and politician Priit Humal €150,000 each in non-pecuniary damages, plus legal costs, according to ERR News. Both men were acquitted in the underlying corruption case, and the acquittals are final. The state can appeal to the Tallinn Circuit Court until 14 December.
The damages are large for a case like this. The court's reasoning is the more important part, because it is a warning about what happens when a government keeps using a surveillance power after the legal basis for it has gone.
The case for retention, stated fairly
Investigators have a real argument. Traffic and location records show who contacted whom, when, for how long and from where. In cases of organised crime, fraud and online abuse, that is often the only evidence that exists, and a record that was never kept cannot be recovered later. Estonia's prosecutors have said exactly this. In October 2024 ERR reported that the Prosecutor's Office had told prosecutors to stop using telecoms data as evidence. Chief Prosecutor Taavi Pern said that, given court practice, "it is indeed not possible to collect evidence in criminal proceedings in this way." The office wanted the Criminal Procedure Code and the Electronic Communications Act amended to allow limited access under stricter rules. Estonian telecoms were then retaining a year of data covering date, time, duration, recipient and location.
That is a legitimate public-safety concern. It is a reason to fix the law, not a reason to keep using an invalid one.
What the court found
According to ERR's account, the court held that Estonian law had conflicted with EU law since the CJEU's judgment of 21 December 2016. In Tele2 Sverige and Watson, the Grand Chamber held that EU law precludes national legislation providing for general and indiscriminate retention of all traffic and location data for the purpose of fighting crime. It also precludes access that is not subject to prior review by a court or an independent authority.
Estonia's own highest court then applied that logic. In its ruling of 18 June 2021 in case 1-16-6179, summarised by the EU Fundamental Rights Agency, the Supreme Court found the relevant provisions incompatible with EU law. That ruling followed the CJEU's judgment of 2 March 2021 in Case C-746/18, which concerned Estonian rules specifically. As eucrim explained, that judgment held that only serious crime or serious threats to public security can justify such interference. It also held that the length of the period and the quantity of data "cannot play a role," and that Estonia's prosecutor's office is not an independent authority, because it directs the investigation and brings the prosecution.
The Tallinn court's key finding, per ERR, is that after June 2021 the authorities "should have been fully aware" of the incompatibility. Neither the executive nor the legislature acted for more than three years. Authorities also kept submitting new requests for data under the invalid provision and used the results in criminal proceedings. The court described general, indiscriminate collection as seriously disproportionate and inherently incompatible with liberty and the presumption of innocence. It also found that the state knowingly continued requesting unlawfully collected data.
The damages follow from that knowledge. A state that makes a good-faith mistake is in a different position from one that continues after being told by both the CJEU and its own Supreme Court.
Why this matters beyond Estonia
First, the legal risk of blanket retention is now financial as well as procedural. Until now, the usual consequence was that evidence was excluded or a conviction fell. Here, two people who were prosecuted and acquitted collected damages. Other member states with retention laws that have not been brought into line may face similar claims.
Second, inaction is the costly choice. The three-year gap between the Supreme Court's ruling and any legislative fix left prosecutors without a lawful tool and exposed the state to liability. A narrow, targeted regime, such as retention tied to specific people, places or serious-crime categories with independent prior authorisation, would have given investigators something usable. Legislatures that treat the court rulings as someone else's problem end up with neither security nor legality.
Third, this matters for the open internet and for innovation. Mandatory retention of everyone's communications metadata is a compliance burden on telecoms and communications providers. It also creates a store of sensitive data that can leak or be misused, and it chills lawful speech and association when people expect their contacts to be logged. The pro-innovation position is not that governments should have no access to data. It is that powers should be specific, proportionate and reviewed by an independent body, which is the standard the CJEU has set.
What to watch
The state may appeal, and the Circuit Court could revisit both the liability finding and the amounts. Whatever happens, the underlying question is for the Riigikogu. The Prosecutor's Office had asked for amendments back in 2024. I have not confirmed whether a compliant replacement regime has since been enacted. If one has not, the ruling is a direct incentive to legislate. Any new law should be targeted, limited to serious crime, and subject to prior review by a court or another independent body. It should not be a fresh attempt at blanket retention under a new label.
The broader lesson is that when a court has said a surveillance power is unlawful, continuing to use it is a choice, and this ruling shows it can have a price.