What works at the population level of one million, might very well not work at the population level with more than 20 million, right? Also, the Estonians made some mistakes too. Like, the unique personal identifier has your date of birth. That right there is a privacy infringement.