The Supreme Court of Latvia overrules judgement over wrongful use of private data in a government commercial

This means the matter will have to be tried once again by the Regional Court. The case at hand presents a possible breach of the GDPR Article 6 (1) (e) – processing of personal data is allowed when necessary for the performance of a task carried out in the public interest.

According to case materials, the CRPC had used the applicant's data in its campaign aiming to raise awareness of the possible fraudulent operations performed within the market of used goods. The campaign contained video and audio content in which the applicant could be seen, heard and recognized. The CRPC was calling for consumers to be careful when purchasing a used car from a publicly known person as this might create a false sense of security and trust in the buyer. The judgement describes the applicant to be a well-known person in Latvia, however, his identity has been disclosed for the purposes of confidentiality during the court process. Thus the applicant argued that the commercial painted them in a negative light and their public image could be damaged due to the actions of the CRPC. The applicant asked for a public apology, the suspension of the particular ad as well as 2000 EUR to cover trial expenses. The CRPC along with their supervising institution – the Ministry of Economics – rejected the applicant’s claims, stating that the actions comply with the GDPR exemption.

The case was eventually brought before the Supreme Court of Latvia after the applicant's claims were also ruled unjustified by the lower instance courts. The Supreme Court was therefore presented with the question of whether the use of a private person’s data in a government ad can be justified under GDPR Article 6 (1) (e) as being done in the name of public interest. The Supreme Court confirmed that there are in general cases where the consent of the person is not necessary if the execution of a task of public interest is performed. Nevertheless, the court also points to GDPR preamble (39) and its general condition of natural person's data processing. Under this consideration it is not enough for the goal of the task to be of public interest – it also has to be the only means by which the goal can be achieved. Furthermore, a reference to the Court of Justice of the European Union is made in order to reinforce the position. In its judgement on June 22nd 2021, the Grand Chamber of the Court of Justice of the European Union rules as follows: "As recital 39 of the GDPR makes clear, that requirement of necessity is not met where the objective of general interest pursued can reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary." 

Thus the Supreme Court ruled that the retraction from this principle can only be made as far as it is absolutely necessary. All of applicant's claims will be reviewed once again by the Regional Court in light of the discovered GDPR breach. It is worth mentioning that the CRPC has not deleted the respective video from the Internet yet as it is still publicly available for everyone to view. It is expected that further use of this video will be known after the final judgement arrives in case described above.