The Estonian Supreme Court (Riigikohus) seeks clarification on the interpretation of the GDPR (Regulation 2016/679) and Directive 2016/680 concerning data protection in the context of financial intelligence units (FIUs). The case concerns the extent to which the Rahapesu Andmebüroo (Estonian FIU) may process and retain personal data under EU law, whether such processing falls within the scope of criminal law enforcement, and whether data subjects can be denied information about their own data when access might compromise security or investigations. The questions also touch on restrictions to data subject rights, including the right to access and right to be informed, and the compatibility of such national limitations with EU law.