Processing of personal data in the field of electronic communications

The information as requested would include the users and IMEI codes of the devices called or making the calls, the sites visited and reached, the times and durations of calls and connections, the details of the cells and/or towers concerned, as well as the users and IMEI codes of senders/receivers of SMS and MMS. Furthermore, such access has to be an exception rather than the rule to ensure minimal interference with a person's fundamental rights. The court or an independent administrative body shall review and determine a fair balance between the capacity of available data of the person concerned by the access and the legitimate interest of combating crime. 

In turn, the second case C-470/21 of the same date expands on the previously mentioned criteria, adding that, if the national legislation authorizes a public authority that is responsible for the protection of copyright and related rights against infringements of those rights committed on the internet, needs information about IP addresses relating to the civil identities of people who are liable for infringements they can access the publicly available data retained by providers of electronic communications services. But it can be done if the authority ensures that their access is separate and serves exclusively to identify persons suspected of committing the offense and not to allow precise conclusions about the private life of the IP address holders unless required in an atypical situation. If such an authority needs information a data processing system used by the public authority is subject to a review at regular intervals, by an independent body acting as a third party about that public authority, intended to verify the integrity of the system. 

In Latvia, the same requirements can be observed. If an authority wishes to acquire the personal data of a person they have to process it only for a certain legitimate interest as well as the information cannot be used for anything outside of this specifically determined interest. The Consumer Rights Protection Centre, the State Data Inspectorate, and other supervisory and control bodies monitor the circulation of public information services within the scope of their competence. To also address safety concerns data registers can document any activity related to access of personal data – modification, deletion, browsing. The logs of access must be time-stamped and protected from tampering. If the processing of personal data is done based on the legitimate interest of investigation data that is used to identify a person can be kept only for the amount of time it takes to fulfill that interest and it can be used for other purposes only if it serves the legitimate interests of the public, history, statistics or science and data has to be processed proportionally to the new purpose. The purpose, besides the initial legitimate interest, can be mentioned in external laws and regulations. 

Therefore, it can be concluded that Latvian local regulation does provide almost similar considerations and requirements for the processing of personal data in the field of electronic communications, as it was explained by the recent ECJ rullings.​