New trends in Latvia concerning personal data processing activities

Referring to IT company in question, this company inter alia provides their customers with access to the general national legal information database as well as a range of other services such as monitoring and analytical services. As for obtaining such information this IT company has amongst others concluded an agreement on information services with the Registry of Enterprises which in turn provides lawful basis to be as a re-user and provide respective information to third parties. Nonetheless, in this regard the Data State Inspectorate initiated administrative proceedings against the IT company for re-publishing company documents submitted to the Registry of Enterprises which contain personal data of natural persons.

The publically available details of this case at this point are still scarce, however, it is worth to note that in early 2020 the Data State Inspectorate had already issued an opinion in regards to publishing personal data at the official website of the Registry of Enterprises. It was explained that the Registry of Enterprises operates with its own publically accessible database system where information on legal entities can be obtained free of charge. The Data State Inspectorate stated that making publically available documents which contain personal information of natural persons is not an unlawful processing of personal data since the purpose for processing the information in the public registries is to provide information on legal entities required by the law. Therefore, a natural person who is participating in the commercial activities, for instance, as a board member of the company or is the ultimate beneficial owner thereof shall reconcile with less privacy than natural persons who are not participating in the business as official representatives of the company.

The other case against the same IT company concerns the insolvency database and the disclosure of insolvency proceedings of natural persons. As an interim measure, until the case will be settled, the IT company agreed to not publish information on the insolvency proceedings of natural persons if more than one year since completion of the proceedings has passed.

Both aforementioned cases are still pending and they surely will draw much more attention in the coming months. Given that into account, it will be interesting to see, how the Data State Inspectorate will handle these cases. And, if the outcome will be different from the one that was provided one year ago concerning the Registry of Enterprises, then a new regulation and trends concerning disclosure of personal data in public registers shall be adopted.

Another important matter in the context of personal data processing has been provided by the Latvian Supreme Court ruling on journalists’ freedom of expression.

Namely, the Supreme Court of Latvia adopted a judgement in a case concerning the broadcast of a story on national television that was accompanied (among other things) by a video recording in which the home address of the person, on which the report was based on, was clearly visible. The applicant argued that his personal data was processed without his consent and to a greater extent than it was necessary to achieve the purpose of the broadcast – informing the public on specific events. The Supreme Court reached to a conclusion that the Court of Appeal had not sufficiently determined why the public interest outweighed the protection of private life, and whether there were available other, less privacy impacting ways, how to balance the journalists’ freedom of expression and person’s privacy. Therefore, the case was sent back to the Court of Appeal for new examination of the case. Stemming from this, it can be concluded that even, when informing the public on specific events, the privacy of the individual must be respected and the rights on freedom of expression must be assessed and they shall be in balance with the individual's right to privacy.