Statutes of the Visa Register

The official name of the database is the Visa Register (hereinafter database).

(1) The objective of operating the database is to ensure public order and national security through processing the data pertaining to the legal bases and conditions of the temporary stay of aliens in Estonia.

(2) For the purposes of meeting the objective set regarding the operation of the database, data from the following sources is processed: visa applications, applications for the extension of the period of stay, applications for formalisation as a long-stay visa of the right to stay in Estonia arising from the expiry of the temporary residence permit, premature termination of the period of stay, annulment of visas, revocation of visas and coordination of visas, and the administrative acts issued and acts performed in the course of the respective proceedings.

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

(1) The chief processor of the database is the Ministry of the Interior (hereinafter chief processor).

(2) The authorised processors of the database are the Police and Border Guard Board, the Estonian Internal Security Service, the Ministry of Foreign Affairs and the IT and Development Centre of the Ministry of the Interior (hereinafter authorised processor).

(1) The chief processor

1) is responsible for the legality of database operations;

2) ensures that the database is operated in accordance with statutory requirements;

3) decides on and ensures access to the database for entitled persons;

4) is responsible for the release of database data as required;

5) ensures, by employing organisational and technical measures, the integrity of database data and the protection and retention of database data;

6) is responsible for compliance with personal data processing requirements;

7) in cooperation with authorised processors, arranges for database development.

(2) The Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs

1) are responsible for the legality of database operations;

2) ensure that the database is operated in accordance with statutory requirements;

3) are responsible for the release of database data as required;

4) ensure, by employing organisational and technical measures, the integrity of database data and the protection and retention of database data;

5) are responsible for compliance with personal data processing requirements;

6) make suggestions to the chief processor of the database as to database development.

(3) The IT and Development Centre of the Ministry of the Interior

1) ensures that the database is operated in accordance with statutory requirements;

2) ensures the release of database data to the Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs as required;

3) ensures, in cooperation with the Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs, the integrity of database data and the protection and retention of database data by employing organisational and technical measures;

4) is responsible, together with the Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs for compliance with personal data processing requirements;

5) makes suggestions to the chief processor of the database as to database development;

6) provides the information technology environment necessary for hosting the database and ensures its technical readiness.

The data entered in the database has legal effects.

The data entered in the database and the source documents for the entry of data in the database are subject to the provisions of this Regulation, unless otherwise provided for in a treaty.

(1) The database is operated as a single-level computerised database and as hard-copy procedural files (hereinafter procedural file).

(2) The database is composed of digital database cards (hereinafter database card) and procedural files.

(3) A procedural file consists of source documents referred to in § 16 of this Regulation and of other documents and evidence collected in the course of administrative proceedings and forming the basis for performing the relevant operation.

(1) Fur the purposes of ensuring the availability, integrity and confidentiality of the data processed in the database, appropriate organisational, physical and information technology security measures are applied.

(2) The security class of the data processed in the database is K2S2T2. The security level of the data processed in the database is medium (M).

(1) The following data regarding a visa applicant is entered in the database

1) given name(s);

2) surname(s);

3) surname(s) at birth and former surname(s);

4) date of birth;

5) personal identification code, where applicable;

6) country and place of birth;

7) citizenship(s);

8) citizenship at birth, if different from current citizenship;

9) gender;

10) marital status;

11) type and number, date of issue, date of expiry, issuing country and issuing authority of travel document;

12) applicant’s current profession;

13) name, address and telephone number of employer; in the case of students, name and address of educational institution;

14) home address, telephone number and email address;

15) details of legal representative, including given name(s), surname(s), address, if different from that of the applicant, and citizenship(s);

16) photo;

17) fingerprint images and date of fingerprinting.

(2) In addition to the data referred to in subsection (1) of this section, the following data is entered in the database when applying for a visa

1) Member State(s) of destination;

2) type of visa;

3) number of requested entries;

4) duration of the planned stay or transit in days;

5) visas issued over the past three years and validity periods thereof;

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

6) with regard to applying for a Schengen visa, date of previous fingerprinting, where applicable;

7) authorisation to return to the country of residence if the applicant resides in a country other than their country of nationality, and number and validity period of the authorisation;

8) authorisation to enter the country of destination if the applicant is in transit, and issuer and validity period of the authorisation;

9) previous stays in Estonia or other member states of the Schengen Convention;

10) main purpose(s) of travel;

11) expected dates of arrival in Estonia and departure from Estonia;

12) Member State of first arrival;

13) name of the person paying for travel and living expenses;

14) means for covering travel expenses;

15) name(s) and address, telephone and fax number and email address of the hotel or temporary accommodation used by the applicant;

16) given name(s) and surname(s) and address, telephone and fax number and email address of the natural person or company and its liaison visited and residing in Estonia or another member state of the Schengen Convention.

(3) The following data regarding a visa applicant’s family member who is a citizen of the European Union, a European Economic Area member country or the Swiss Confederation is entered in the database

1) given name(s);

2) surname(s);

3) date of birth;

4) citizenship or citizenships;

5) number of travel document or ID card;

6) relatedness to the citizen of the European Union, a European Economic Area member country or the Swiss Confederation.

(4) The following data regarding the visa application is entered in the database

1) registration number and date;

2) given name(s), surname(s) and position of the official who registered the application;

3) city and date of submitting the application;

4) details of the paid state fee or details regarding the reduction of the state fee or exemption from the payment thereof;

5) type of issued visa, number of visa sticker, valid from and expiry date of visa, allowed number of entries and the allowed length of stay under the visa in days;

6) given name(s), surname(s) and position of the official who issued the visa;

7) legal basis for the refusal to issue a visa and given name(s), surname(s) and position of the official who issued the refusal decision.

(5) The data listed in clauses (1) 12) and 13) and (2) 9)–14) of this section regarding family members of the citizens of the European Union, European Economic Area member countries or the Swiss Confederation is entered in the database if this data is available.

(1) The following data regarding an applicant for the extension of the period of stay is entered in the database

1) given name(s);

2) surname(s);

3) former names;

4) date of birth;

5) gender;

6) country and place of birth;

7) citizenship(s);

8) marital status;

9) address of residence in a foreign country and address of the place of stay in Estonia;

10) type and number, date of issue, date of expiry, issuing country and issuing authority of travel document;

11) details of legal representative, including given name(s), surname(s) and citizenship(s);

12) photo;

13) fingerprint images and date of fingerprinting.

(2) In addition to the data referred to in subsection (1) of this section, the following data is entered in the database when extending the period of stay

1) basis for temporary stay in Estonia and the corresponding document number, valid from and expiry date, number of entries, allowed length of stay in days, date and place of issue;

2) date until which the extension of the period of stay is requested;

3) reason for extending the period of stay and where available, name of the natural person or company and its liaison residing and visited in Estonia;

4) issuer and number of the applicant’s health insurance policy and its date of issue, period of validity and the amount of liability insurance.

(3) The following data regarding the representative of an applicant for the extension of the period of stay is entered in the database

1) type of representation;

2) given name(s);

3) surname(s);

4) former names;

5) personal identification code;

6) date of birth;

7) gender;

8) type, number and issuing country of an identity document;

9) home address in Estonia and telephone number.

(4) The following data regarding the application for the extension of the period of stay is entered in the database

1) registration number and date;

2) given name(s) and surname(s) of the official who registered the application;

3) details of the paid state fee or details regarding the reduction of the state fee or exemption from the payment thereof;

4) number of the sticker of the extension of the period of stay, valid from and expiry date, allowed length of stay in days;

5) legal basis for the extension of the period of stay and given name(s) and surname(s) of the official who made decision;

6) legal basis for the refusal of the extension of the period of stay and given name(s) and surname(s) of the official who made the refusal decision.

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

(1) When formalising the right to stay in Estonia arising from the expiry of the temporary residence permit as a long‑stay visa, the following data regarding the applicant is entered in the database

1) given name(s);

2) surname(s);

3) personal identification code;

4) contact details;

5) type and number, date of issue, date of expiry, issuing country and issuing authority of travel document;

6) submission date of the application.

(2) When formalising the right to stay in Estonia arising from the expiry of the temporary residence permit as a long‑stay visa, the following data regarding the applicant’s representative is entered in the database

1) type of representation;

2) given name(s);

3) surname(s);

4) personal identification code or date of birth;

5) type and number and issuing country of an identity document;

6) contact details.

(3) The following data regarding the application for the formalisation as a long-stay visa of the right to stay in Estonia arising from the expiry of the temporary residence permit is entered in the database

1) registration number and date;

2) given name(s), surname(s) of the official who registered the application;

3) details of the paid state fee or details regarding the reduction of the state fee or exemption from the payment thereof;

4) sticker number of the issued visa, valid from and expiry date, allowed length of stay in days;

5) given name(s) and surname(s) of the official who formalised the right to stay in Estonia arising from the expiry of the temporary residence permit as a long-stay visa.

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

When annulling or revoking a visa or terminating the period of stay prematurely, the following data is entered in the database

1) number and date of the decision;

2) name of the authority and structural unit whose official issued the decision, subject to the State Secrets and Classified Information of Foreign States Act;

3) given name(s), surname(s) and position of the official who issued the decision, subject to the State Secrets and Classified Information of Foreign States Act;

4) date as of which the period of stay is invalid;

5) given name(s), surname(s), date of birth and travel document number of the person who was issued the visa;

6) number of the annulled or revoked visa sticker, period of validity, number of entries, length of stay in days, issuing authority of the visa, date of issue and type of visa;

7) reason for annulling or revoking the visa or reason and legal basis for terminating the period of stay prematurely;

8) in the case of terminating the period of stay prematurely, a statement regarding visa waiver.

The following data regarding issuing a visa at a border checkpoint in exceptional cases is entered in the database

1) number and date of the decision on granting the visa;

2) given name(s), surname(s) and position of the official who issued the decision on granting the visa;

3) given name(s), surname(s), date of birth, gender and citizenship of the person granted the visa;

4) photo and fingerprints of the person granted the visa and date of fingerprinting;

5) type and number, issuing country and issuing authority, date of issue and date of expiry of the travel document of the person granted the visa;

6) travel purpose(s) of the person granted the visa;

7) address and telephone number of the person granted the visa while staying in Estonia or a Schengen Convention member state;

8) type of the issued visa, visa sticker number, valid from and expiry dateof the visa and the allowed length of stay under the visa in days;

9) legal basis for granting the visa and given name(s), surname(s) and position of the official who issued the visa;

10) date of entry into the country and date of departure from the country as stated in the application;

11) legal basis for the refusal to issue a visa and given name(s), surname(s) and position of the official who issued the refusal decision.

(1) The following data regarding a person contesting a decision on the refusal to issue a visa, annulment of a visa, revocation of a visa, refusal to extend the period of stay and premature termination of the period of stay (hereinafter referred to in this section as decision) is entered in the database

1) given name(s);

2) surname(s);

3) date of birth;

4) contact data, including postal address and country, telephone number, email address.

(2) In addition to the data referred to in subsection (1) of this section, the application contains the following information

1) name of the administrative body receiving the application;

2) type and number of contested operation;

3) a statement as to whether the decision is contested for the first or second time;

4) reason for submitting the application.

(3) The following data regarding the representative of the person contesting the decision is entered in the database

1) given name(s);

2) surname(s);

3) date of birth;

4) contact data, including postal address and country, telephone number, email address.

(4) The following data regarding the application is entered in the database

1) registration number and date;

2) name of the authority and structural unit whose official registered the application, subject to the State Secrets and Classified Information of Foreign States Act;

3) given name(s), surname(s) of the official who registered the application;

4) decision issued regarding the application and date of issuing the decision;

5) given name(s), surname(s) and position of the official who issued the decision, subject to the State Secrets and Classified Information of Foreign States Act;

6) details of the paid state fee, including amount of state fee, date of receipt of state fee, given name(s) and surname(s) of the person who paid the state fee or name of the corresponding legal entity.

The data providers of the database are

1) an alien submitting a visa application, an application for the extension of the period of stay or an application referred to in sections 101 and 13 of this Regulation;

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

2) the Police and Border Guard Board, the Estonian Internal Security Service, the Ministry of Foreign Affairs within the limits of the functions assigned to them by law or by legislation adopted based on law.

The chief processor of the database and the Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs are authorised, for the purposes of fulfilling the functions assigned to them by law or by legislation adopted based on law, to submit queries to other European Union state or local government databases and to receive data from these databases.

The following constitute source documents for entering data in the database

1) standard format visa application together with the decision on granting or refusal to grant a visa;

2) decision on granting a visa at a border checkpoint in exceptional cases;

3) standard format application for an extension of the period of stay together with the decision on extending or refusing to extend the period of stay;

4) decision on the annulment or revocation of a visa;

5) decision on the premature termination of the period of stay;

6) travel document of a visa applicant;

7) travel document of an applicant for an extension of the period of stay;

8) power of attorney of the representative of an applicant for an extension of the period of stay;

9) identity document of the representative of an applicant for an extension of the period of stay;

10) basis for an alien’s stay in Estonia or extension thereof;

11) proof of payment of the state fee;

12) proof of exemption from the payment of the state fee or of reduction thereof;

13) proof of the basis for extending the period of stay;

14) standard format application together with the decision on satisfying or dismissing an appeal;

15) application for formalisation as a long-stay visa of the right to stay in Estonia arising from the expiry of the temporary residence permit together with the decision on formalising the long‑stay visa;

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

16) other documents and evidence presented.

[RT I, 28.03.2017, 3 – entry into force 31.03.2017]

(1) Pursuant to the terms and conditions and the procedure provided for in the Aliens Act, data is entered in the database as follows

1) data listed in sections 9–13 of this Regulation: by the Police and Border Guard Board;

2) data listed in sections 11 and 13 of this Regulation: by the Estonian Internal Security Service;

3) data listed in sections 9, 11 and 13 of this Regulation: by the Ministry of Foreign Affairs.

(2) The data is entered in database cards immediately after the receipt of the data.

(3) The Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs keep, either digitally or on paper, a record of the time of entering data in the database, of the composition of data and of data providers.

Data providers are responsible for the accuracy of the data submitted by them and contained in source documents at the time of submitting a source document. The Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs are responsible for having the data entered by them match the data submitted by data providers.

If the Police and Border Guard Board, the Estonian Internal Security Service or the Ministry of Foreign Affairs detect inaccurate data in the database or if they are notified thereof, they arrange for the data to be amended within three working days as of learning of the inaccurate data, and where possible, annex proof of the correct data or a reference to such proof to the procedural file.

(1) The data contained in the database is subject to access restrictions and intended for internal use.

(2) Access to the data entered in the database is granted to the officials and employees of the chief processor and the Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs within the limits of their service or employment duties and by the supervisory authority for carrying out its statutory functions.

(3) Access to the database is granted to the employees of the IT and Development Centre of the Ministry of the Interior within the limits of their employment duties.

(4) Access to the database data provided for in sections 9–13 of this Regulation, without the right to alter the data, is granted to the officials and employees of the Estonian Foreign Intelligence Service in fulfilling the functions set out in the Security Authorities Act, and to the officials and employees of the Estonian Internal Security Service in fulfilling the functions set out in the Security Authorities Act and the Code of Criminal Procedure within the limits of their respective service or employment duties.

[RT I, 20.06.2017, 1 – entry into force 01.07.2017]

(5) The right of access to the database is granted to the person developing or maintaining the database to the extent and subject to the terms and conditions laid down in the development or service contract.

(6) The chief processor of the database decides on granting access to data to third parties through the data exchange layer of information systems in accordance with the Public Information Act and the Personal Data Protection Act, provided that the relevant basis is established by law. Where necessary, an agreement is concluded with the recipient of data, setting out the composition of the data to which access is granted and the legal basis, purpose, terms and conditions, procedure and manner of granting access to the data.

(7) Third parties are granted access to data through the data exchange layer of information systems to the extent that is technically possible and does not obstruct performing the functions assigned to the chief processor, the Police and Border Guard Board, the Estonian Internal security Service and the Ministry of Foreign Affairs.

(8) Access to the data entered in the single Visa Information System (VIS) of the European Union is granted in accordance with the following

1) Regulation (EC) No 767/2008 of the European Parliament and of the Council regarding the information exchange between the visa information system (VIS) and the Member States relating to short-stay visas (VIS Regulation) (OJ L 218, 13.08.2008, pp. 60–81) (hereinafter VIS Regulation);

2) Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.08.2008, pp. 129–136).

(1) The chief processor of the database, the Police and Border Guard Board, the Estonian Internal Security Service or the Ministry of Foreign Affairs release data entered in the database as follows

1) personal data regarding a data subject, to the data subject or their legal representative;

2) to third parties, based on their written request, provided that there are grounds established by law for releasing the data.

(2) The chief processor of the database, the Police and Border Guard Board, the Estonian Internal Security Service or the Ministry of Foreign Affairs release personal data regarding a data subject entered in the VIS to the data subject or their legal representative in accordance with the VIS Regulation.

(3) The Police and Border Guard Board, the Estonian Internal Security Service and the Ministry of Foreign Affairs keep a record of when data is entered in and released from the database and of the composition, providers and recipients of data.

(4) Data is released from the database free of charge.

(1) Regarding visa applications, the data referred to in Article 9 of the VIS Regulation is forwarded to the VIS.

(2) Regarding the issue of visas, the data referred to in Article 10 of the VIS Regulation is forwarded to the VIS.

(3) Where the examination of a visa application is discontinued, the data referred to in Article 11 of the VIS Regulation is forwarded to the VIS.

(4) Where a visa is refused to be granted, the data referred to in Article 12 of the VIS Regulation is forwarded to the VIS.

(5) Where a visa is revoked or annulled, the data referred to in Article 13 of the VIS Regulation is forwarded to the VIS.

(6) Where a period of stay allowed under a visa is extended, the data referred to in Article 14 of the VIS Regulation is forwarded to the VIS.

(7) Where a period of stay exempt from the visa requirement is extended, the data referred to in Articles 9 and 10 of the VIS Regulation is forwarded to the VIS.

Data is retained, archived and destroyed in accordance with the VIS Regulation, the Archives Act and the legislation established on the basis thereof, and in accordance with the procedures of the chief processor, the Police and Border Guard Board, the Estonian Internal Security Service or the Ministry of Foreign Affairs.

Supervision over operating the database is subject to the VIS Regulation, the Personal Data Protection Act and the Public Information Act.

(1) Database maintenance and operation are financed using the funds allocated for that purpose from the state budget to the chief processor and the IT and Development Centre of the Ministry of the Interior.

(2) Database development is financed using the funds allocated for that purpose from the state budget to the chief processor, the Police and Border Guard Board, the Estonian Internal Security Service, the Ministry of Foreign Affairs and the IT and Development Centre of the Ministry of the Interior.

(1) The decision on liquidating the database is made by the Government of the Republic on a proposal of the minister responsible. When liquidating the register, it is decided whether the data is to be transferred to another database, state register or state archive, or destroyed, followed by establishing the term for the corresponding transfer or destruction.

(2) The database is liquidated in accordance with requirements provided for in the Archives Act and the Public Information Act.

This Regulation enters into force on 1 January 2016.