Data processing in court

Although, the Data State Inspectorate (DSI) is national supervisory institution overseeing compliance under the General Data Protection Regulation, but DSI cannot enforce compliance provisions on the courts, as the Data State Inspectorate has not been granted such competence and, moreover, this may jeopardise the independence of the court. Consequently, if a person considers that there may have been violations of the processing of personal data in the course of legal proceedings in court, he or she cannot make a complaint with the DSI. 

Nevertheless, Latvian courts are bound by the GDPR provisions, and the processing of personal data cannot be disproportionate or arbitrary and the obligation to ensure this during the proceedings lies with the court itself. Courts apply appropriate technical and organisational measures to protect personal data under their control. Court staff is obliged to ensure that information about personal data available to them is used only for the performance of their duties and that case materials, including all the related personal data therein, do not reach persons who do not have a statutory right of access to that information.

In general, court hearings are held publicly, but in certain cases – to protect the privacy of individuals or other secret or sensitive information (certain type of court hearings) – can be held behind ‘closed doors’. Audio-recording, filming or photography may only be carried out in cases provided for by law, which in most cases requires the permission of the persons present at the hearing or even confirmation by the judge to carry out such acts and, if this procedure is not followed, the court may impose procedural sanctions. 

Worth mentioning that on March 2, 2023, the Court of Justice of the European Union (CJEU)heard Case C-268/21, which raised the question whether the General Data Protection Regulation applies to the production of evidence containing personal data in legal proceedings. The CJEU pointed out that any processing of personal data, with derogations provided for in Article 23, must comply with the principles applicable to the processing of personal data (in particular the principle of data minimisation) and the rights of data subjects. Personal data must be equivalent, relevant, and limited to what is necessary to achieve the objective of the applicable national law. The national court must also assess whether less intrusive evidence can be used to achieve the same objective (e.g., to cross-examine a witness).

If only part of the data contained in a document is needed as evidence, the national court should consider protecting personal data by taking additional measures such as pseudonymisation, limiting public access to the court file, or explicitly ordering the parties not to use the data for other purposes. Therefore, if any individual considers that his/her personal data is being misused in the court proceedings, it may bring this matter to attention of the presiding judge, who then can decide on further procedural sanctions if he/she it deems necessary. Afterwards, person can evaluate the need to continue protect it’s interests and whether to use respective decision, i.e., outcome of the assessment on appropriate personal data processing, as basis for a compensation claim. ​