Makes public services decisions, in Estonia

Võlaõigusseadus, §§ 1061-1067 · Read the law's page

• If you produce, import into the EU, or put your name or trade mark on a product, including computer software, you answer for the death, bodily injury or damage to health it causes while defective (Arts. 1061(1), 1062(1), 1063(1)).
• If you cannot name the producer or your own supplier to the injured person within a reasonable time after being asked, you answer as the producer (Art. 1062(2)).
• Be ready to prove one of the defences in Art. 1064(1): that you did not put the product on the market, that it was probably not defective then, that it was not made for sale or distribution in your business, that the defect results from mandatory requirements in force then, or that the state of science and technology did not allow the defect to be discovered.
• If you make a raw material or component, be ready to show that the defect results from the design of the finished product or the finished-product producer's instruction (Art. 1064(2)).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (Art. 1067).

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Give a person in Estonia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, under GDPR Article 22.
• Do not subject a person in Estonia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Estonia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Estonia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Infoühiskonna teenuse seaduse, autoriõiguse seaduse ja maksukorralduse seaduse muutmise seadus, RT I, 21.06.2024, 1; giving effect to Regulation (EU) 2022/2065 (Digital Services Act)

• Conduct an annual systemic-risk assessment of your algorithmic recommendation systems if you operate a very large online platform or search engine.
• Offer users at least one recommendation option not based on profiling if you operate a very large online platform or search engine.
• Disclose your recommendation-system parameters to users and regulators if you operate a very large online platform or search engine.

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Estonia as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, except within narrow exceptions the law allows.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users, before or at the start of an interaction, that they are communicating with an AI system.
• Mark generated image, video, audio and text output in machine-readable form that identifies it as artificially generated.

Võlaõigusseaduse ning võlaõigusseaduse, tsiviilseadustiku üldosa seaduse ja rahvusvahelise eraõiguse seaduse rakendamise seaduse muutmise seadus (uue tootevastutuse direktiivi ülevõtmine) · Read the law's page

• Treat software as a product: software you develop or supply in your business answers like any other product, whether sold alone or built into another product (draft § 1063(1)).
• Keep supplying the software updates and upgrades a product needs to stay safe while it is within your control; a defect caused by software, an update, a missing safety update or a substantial modification within your control is not excused by saying it arose after you put the product on the market (draft §§ 1061(3[1]), 1061(3[2]), 1064(2[2])).
• Keep the technical documentation you could produce if a court orders disclosure on the injured person's application; failing to produce it presumes the product defective (draft §§ 1065[1](1), 1065(2)).
• If you are outside the EU, your importer or authorized representative answers for the product in your place, then your fulfilment service provider, then a distributor or online platform that does not name the responsible business within one month (draft § 1062[1](6), (7), (9), (10)).
• Be ready to prove one of the defences in § 1064(1), including that the defect could not be discovered given the state of science and technology when the product was put on the market, put into service or under your control (draft § 1064(1) point 5).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (draft § 1067).