The Supreme Court of Latvia: GDPR does not provide a possibility to lodge a complaint in the public interest

An applicant complained to the Inspectorate about processing of data of Latvian residents by third country companies, such as World Check, Accuity, Wall AML and Worldcompliance, whose data bases are possibly used by Latvian credit institutions. 

The complaint stated that such data processing violates GDPR and puts data of Latvian residents at risk. The applicant himself had his accounts frozen by a bank, possibly due to information on his past criminal conviction, however, the complaint was not addressing the applicant’s data processing done by a particular credit institution. The Inspectorate refused to initiate administrative proceedings stating that the applicant does not have the subjective rights to complain about processing of other persons’ data. The complaint of the applicant was also declined by the district administrative court.

The matter was brought before the Supreme Court. In the view of the Supreme Court, Article 77 of GDPR and the national law on data processing do not establish the subjective right of any person to demand the Inspectorate to investigate a possible infringement in such case when the Inspectorate has the right to decide on commencement of investigation.  Article 77 of GDPR does not foresee the right to lodge a complaint to protect the interests of population, i.e. to lodge a complaint in the public interest or actio pupularis. The applicant did not address the Inspectorate with a complaint about processing of his own data but with a general complaint about processing of data of Latvian residents by third country companies and Latvian banks. The court has no rights to impose on the Inspectorate an obligation to start investigation about processing of data by credit institutions, as such question is within the discretion of the Inspectorate. However, the Inspectorate shall investigate the matter if a person lodges a complaint about processing of his or her data by a particular credit institution specified in the complaint.

The judgment of the Supreme Court is final and not subject to appeal. Therefore, this case emphasizes that, when addressing the supervisory institution on alleged infringement of GDPR provisions, it must be directly related to a respective person because, under GDPR, individuals may seek protection only of their own rights and privacy.