The Supreme Court of Latvia has resolved that the GDPR does not provide the rights to claim compensation in the civil procedure for police actions

In particular case, an applicant complained to the civil court about the data processing performed by the police after it investigated the breakage of his car window. The court refused to accept his application on the ground that the matter does not fall within the competence of the civil court. Namely, the complaint shall be brought before the administrative court because the potential infringement, that the applicant may have suffered, is connected with an action performed by the state in the domain of public law.

The matter was brought before the Supreme Court, which agreed with the applicant that both the GDPR and the national Personal Data Processing Law, adopted on the basis of the GDPR, foresees the right to bring a claim for infringement suffered as a result of wrongful data processing. However, Article 2 of the GDPR  states that the GDPR does not apply to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In this regard the scope of the Personal Data Processing Law is the same as in case of the GDPR. Thus neither of both laws foresee the rights to bring a claim and claim compensation in the civil court for data processing performed by the police while performing actions within its competence. 

The court also pointed out to the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data. This particular directive and the national law introducing it is applicable to the data processing performed by the police when investigating crimes and administrative offences. However, when the particular facts of the case took place, the national law in this regard was not yet adopted and the processing was governed by the relevant provisions of the Personal Data Protection Law, which was in force before the GDPR. None of this provisions granted the applicant the rights to bring a claim against the police for alleged incompliant personal data processing in the civil procedure, but the Supreme Court emphasized that such matters shall be reviewed in the administrative proceedings. Considering that the Supreme Court upheld the decision of the court of lower instance and refused to accept the application of the applicant.

The judgment of the Supreme Court is final and not subject to appeal. This case emphasizes that, while citizens become more aware of their rights enshrined in the GDPR, they still struggle to understand different procedures stemming from the processing of their data. While the scope of rights granted to data subject in different procedures might be comparable, it is still relevant to determine who processes their data and in what capacity, as well as what procedure is applicable in this regard.