Estonia's ruling coalition is not fighting itself over a partisan wedge issue. It is fighting itself over how literally to take a Court of Justice of the European Union (CJEU) ruling that Estonia itself lost.
On July 10, 2026, Interior Minister Igor Taro publicly broke with Justice and Digital Affairs Minister Liisa Pakosta over her bill to end Estonia's year-long, population-wide retention of telecom metadata — who called whom, for how long, from where (ERR News). Both ministers belong to the same party, Eesti 200, which holds the interior, justice, foreign affairs, education, and regional-affairs portfolios in Prime Minister Kristen Michal's coalition with the Reform Party (Estonia's new government: who's who, ERR). This is not coalition friction. It is an intra-party dispute over what proportionality means.
Why the current law has to change
The root cause is not political preference — it is a court order. In Prokuratuur (Case C-746/18), decided March 2, 2021, the CJEU ruled on a reference from Estonia's own Supreme Court and found that blanket, undifferentiated retention of communications metadata is incompatible with EU law, and that access must be limited to serious-crime investigation and authorized by a body independent of the prosecution (EUR-Lex, judgment text). Estonia's Public Prosecutor's Office, the court held, cannot be that independent authorizer because it directs the investigations it would be approving access for.
Five years on, Estonian law has not caught up. Pakosta describes the result in stark terms: the current framework requires telecoms to store everyone's call and location metadata for a full year, "treating everyone as a potential criminal," while the unresolved conflict with EU law has left prosecutors unable to reliably use the data they do collect — creating what she calls an evidentiary crisis for genuine criminal investigations (Pakosta, ERR opinion, May 15, 2026). Her ministry's bill would end mandatory 12-month retention of call and location records, retain only subscriber identity data for a year, preserve internet-data retention for cybercrime cases, and lean on data telecoms already keep for billing.
Taro's case, steelmanned
Taro's objection deserves to be taken on its own terms before it's weighed against. Estonia sits on NATO's eastern flank, a few hundred kilometers from a revanchist Russia that has already contested Baltic airspace this month — Estonia, Latvia, and Lithuania jointly protested Russian airspace violations just days before Taro's intervention (ERR News). A country in that position has a genuine argument that border-zone communications metadata — who is calling whom near a military installation, a port, or a border crossing — is a distinct category of national-security data, not ordinary policing data, and that the CJEU's own Prokuratuur line reserves room for member states to respond to "serious threats to national security" with heightened retention. Taro is not proposing indiscriminate nationwide retention; his counter-proposal is explicitly geographic — one year of retention within 10 kilometers of Estonia's border or defense facilities, in government-designated zones, near critical infrastructure, and on the islands, layered under a KAPO-requested three-year bulk framework with the option to extend by three years at a time (ERR News, July 10, 2026). That is a materially narrower ask than the status quo, even if it is broader than Pakosta's bill.
Why the narrower framing still doesn't fix the core problem
The trouble is that Taro's argument proves too much once you look at the retention period rather than the geography. A three-year bulk order, extendable by three more years at a time, is not a targeted national-security carve-out — it is a rolling, indefinite mass-retention regime with a border label attached. The CJEU's 2021 ruling did not turn on geography; it turned on the seriousness of the interference with privacy, which the Court said exists "regardless of the length of the period" of data involved, once the dataset is large enough to reveal a private life. A KAPO order covering every prepaid and foreign SIM near a border, renewable indefinitely, will sweep up commuters, tourists, and cross-border workers who have no connection to any security threat — precisely the undifferentiated collection Prokuratuur forbids.
There is also an institutional-design problem Taro's counter-proposal does not touch: Prokuratuur required an independent authorizer for access, not just narrower geography for collection. KAPO requesting its own multi-year retention order and expecting to remain the primary consumer of that data is the same authorization architecture the CJEU found deficient, just relabeled as border security.
Pakosta's framework, not Taro's, is closer to what compliance actually requires: narrow the default to subscriber-identity data, preserve targeted, judicially authorized access for genuine serious-crime and national-security investigations, and stop conscripting telecoms into storing a year of everyone's movements as a matter of routine. If Estonia's security services need faster access in an active border crisis, the fix is a well-defined emergency-authorization procedure with independent sign-off and a hard sunset — not a standing three-year dragnet justified by proximity to a fence.
What to watch
The bill has not yet gone to the Riigikogu; this is a pre-legislative cabinet dispute, and Pakosta's own ministry has acknowledged the draft leaves room for up to twelve months of mass retention in a declared security emergency, which is itself a concession to Taro's camp (Pravda Estonia, citing the Justice Ministry draft). Whether that compromise satisfies KAPO's three-year ask, or whether the coalition ships two competing texts to parliament, will determine whether Estonia becomes a model for CJEU-compliant policing data or another slow-motion infringement case.