Data protection

On 21 October the EU Council approved a negotiating position on simplifying digital rules (the Digital Omnibus), aimed at easing certain personal-data processing obligations for businesses. It plans to clarify pseudonymisation rules, information duties, and how to handle unfounded or excessive data-subject requests. The change affects every business processing personal data under GDPR.

In an e-consultation the Data State Inspectorate notes that publishing a video in which people can be identified is personal-data processing requiring a purpose and a legal basis under the GDPR. Consent to record a conversation does not amount to consent to publish the recording; without it another legal basis must exist and the public interest must be weighed against privacy. The inspectorate cannot assess the specific case without knowing the video's content.

The Data State Inspectorate explains that parental consent to photographing a child and publishing images on an institution's website does not extend to uploading them into artificial-intelligence tools, because consent is tied to specific purposes and a manager's permission does not replace a legal basis for data processing (BilancePLZ, paywalled, only the lead is visible).

The European Data Protection Board has published a report on video recording, surveillance and evidence management in the age of smart glasses. It warns that while such devices are useful for communication and everyday support, they create new risks of inadvertently processing third parties' personal data and of video being used as evidence. The report is relevant for employers considering such devices at work.

Latvia's Data State Inspectorate has opened a new website section on supervision of the EU AI Act, where it will progressively publish guidance for developers and users of AI systems. The first piece explains in plain language what counts as an AI system versus an ordinary automated program. The section targets individuals, businesses and public authorities that use or build AI solutions.

On 14 October the EBA classified Circle's USDC as the first "significant" e-money token in the EU among the 45 e-money tokens notified under MiCA. From 12 November the EBA takes over direct prudential supervision from France's ACPR for own funds, reserve-of-assets, liquidity requirements and redemption plans, while the ACPR keeps oversight of governance and outsourcing.

The State Digital Development Agency has announced that the unified authorisation module (VPM), which verifies identity for accessing various state and municipal e-services, is getting its own visual identity and logo so users can clearly distinguish it from the Latvija.gov.lv portal. The authorisation process itself and the ways users log in remain unchanged.

After the CSDD data leak, more than 10,000 compensation claims have been filed, mostly around 10,000 euros each. A lawyer notes claimants must prove not just the breach itself but concrete harm, and that emotional distress can be backed by, for instance, a medical certificate. CSDD currently plans no payouts, and a lawsuit without solid grounds may prove fruitless.

An analytical article by an RSU law master's graduate examines banks' growing use of AI in credit-scoring decisions and the problems raised by Article 9 of the GDPR on sensitive data when an automated decision leaves the person refused with no understanding of the reasoning behind it.

RGSL scholar Dr Viktorija Soņeca and student Elizabete Fiļipoviča published an article in the journal Jurista Vārds on digital citizenship in the AI era, examining how deepfakes and AI-generated content affect privacy and dignity under the EU AI Act, GDPR and Digital Services Act.

From 1 April 2027 the reduced patent fee can no longer be paid alongside the starter micro-enterprise tax, under amendments adopted on 17 September 2026 to the Law on Personal Income Tax. The State Revenue Service has updated its guidance on the reduced patent fee to reflect the change.

From 1 January 2027 the Patent Office will be renamed the Latvian Intellectual Property Office to better reflect its remit. The Cabinet of Ministers approved the renaming on 29 September 2026 following a proposal from the Justice Ministry.

The article explains the labeling duties for AI-generated content under Article 50 of the EU AI Act. From a set point, developers of AI systems must ensure that AI-generated images, audio, video and text carry machine-readable markings, while people must be told when they are interacting with an AI system such as a chatbot. An extra duty applies to those who publish deepfakes or use AI to write texts meant to inform the public - they must clearly disclose the AI's involvement.

Latvia's Data State Inspectorate clarified that a car's registration number alone is not personal data unless it can be linked to a specific person — for instance, when tied to the vehicle owner's details for collecting unpaid parking debt. Operators using licence-plate recognition systems must inform drivers in advance via proper signage and disclosure, and may retain the data only as long as necessary for the stated purpose.

The article explains how a company should properly handle a data subject's request to delete personal data under the GDPR, to avoid mistakes such as unjustified disclosure to third parties, hasty deletion, or missing the response deadline. It stresses that this is a business process a company can prepare for in advance by setting internal procedures.

Following a cyberattack on Latvia's road traffic authority CSDD that exposed data of roughly 1.2 million people, many affected individuals filed claims for €10,000 compensation each. Sorainen explains that a mere data-protection breach does not automatically entitle a claimant to compensation — concrete harm (material or non-material) must be proven. The article analyses GDPR Article 82 and the burden of proof in such claims.

PTAC took part in a meeting of the European Board for Digital Services, where EU member-state supervisory authorities discussed enforcement of the Digital Services Act (DSA) and cross-border cooperation. In Latvia, PTAC is the DSA supervisory coordinator responsible for overseeing platforms' and online intermediaries' compliance with their obligations.

In 2025 Cert.lv ran 16 phishing simulations targeting staff at public bodies and companies: almost 32% of the 15,436 emails sent were opened, and in 3,032 cases users entered authentication credentials. Separately, 27 IT system security tests found 82 vulnerabilities, including critical ones, which were fixed before they could be exploited in cyberattacks.

Following three major 2026 cyberattacks on state-run registries (LVM, CSDD, the consumer rights authority's ASDIS system) that exposed data on more than half the population, attorney Lauris Klagišs explains how Article 82 of the GDPR applies. Victims are entitled to claim compensation from the data controller or processor for both real financial loss and non-material damage.

The article looks at how, following a data breach at the Road Traffic Safety Directorate (CSDD), fraudulent phone calls and text messages may be using information from the leaked data to make scams more convincing.

The paywalled article explains whether, and in which cases, an outsourced accounting company must appoint a person responsible for data protection.

Based on guidance from the Data State Inspectorate, the article notes that a vehicle's registration number is not by itself personal data unless linked to an identified person, but paid-parking operators must, before a camera captures the plate, give transparent information about the processing, retention period and legal basis.

DVI clarifies that automatic licence-plate reading at paid parking lots becomes personal-data processing once the plate is linked to an identifiable person, e.g. for billing or dispute resolution. Operators need not obtain consent - contract performance or legitimate interest can serve as the legal basis - but must state the processing purpose, the operator's identity and contact details, post signage before the camera zone, and keep data only as long as necessary.

The EBA published its response to the European Commission's consultation on reviewing the Markets in Crypto-Assets Regulation (MiCA), setting out priority areas for future amendments. The document could also affect Latvian market participants dealing in crypto-assets or planning related services across the EU single market.

The paywalled interview-style article with an industry expert addresses the risks created in companies by uncontrolled use of AI tools, which has outpaced both staff training and internal policy.

ESMA announced that from 2027 digital innovation and related supervisory convergence will become one of its supervisory priorities - relevant to financial-service providers active in the Latvian and EU markets that use digital/AI solutions.

A cybersecurity assessment of the CSDD data breach, commissioned by the Transport Ministry, found serious gaps in data-security management — incomplete security checks, weak network protection and missing multi-factor authentication — that let the attacker obtain personal data. A lawyer argues the published assessment already provides sufficient evidence of CSDD's negligence, so affected people no longer need to wait for the State Data Inspection's own findings before filing a civil compensation claim.

Advocate General Dean Spielmann concluded that consent given by a person to a company for data use for direct-marketing purposes on behalf of 'its partners' is valid only if the identity of those partners is known. If the Court follows the opinion, it would clarify GDPR consent requirements also for businesses in Latvia using third-party consent models for direct marketing.

On 17 September the European Commission unveiled a proposal for a new EU-wide regulation to protect children online (the so-called EU Kids Act), which would restrict children's access to social media platforms. The proposal still needs to go through the legislative process, but if adopted would create new obligations for platform operators active on the Latvian market too.

The Data State Inspectorate (DVI) published guidance for organisations on avoiding personal-data breaches: keep an up-to-date inventory of IT hardware and software, segment networks, keep protected backups, deploy multi-factor authentication and other technical security measures, and limit access to personal data strictly to what staff need for their duties. The guidance stresses proactive prevention over after-the-fact response.

The Consumer Rights Protection Centre is calling on e-commerce businesses to ensure the accessibility of digital services for people with functional limitations. Since mid-2025, Latvia's Law on the Accessibility of Goods and Services has been in force, setting accessibility requirements that also apply to e-commerce services.

The paywalled article examines the widespread belief that, since 2 August 2026, the EU requires all AI-generated content to be labelled, and clarifies when that disclosure requirement actually applies to businesses and institutions.

The European Union has prepared a legislative package called the 'Digital Omnibus', aimed at simplifying digital regulation and boosting innovation. The initiative seeks to remove overlapping requirements and poorly aligned definitions created by several EU acts applying in parallel.

Sorainen lawyers explain how companies should respond when facing a cybersecurity incident such as a ransomware attack or data breach. The article stresses immediately involving management, isolating affected systems, and reporting to authorities within statutory deadlines. The guidance applies to all companies regardless of whether they fall under Latvia's Cybersecurity Law.

DVI explains that a missing person's personal data may be disclosed to relatives or to service providers (creditors, banks, utilities) under the GDPR's legitimate-interest ground (Article 6(1)(f)) when needed to settle urgent payments or obligations. Providers must verify the requester's identity, family relationship and the person's missing status, and apply data minimization. The aim is to prevent debt accumulation or contractual penalties while disclosing only what is strictly necessary.

LSM.lv reports that a cyberattack on TSC, an LMT-group appliance and device repair company, exposed roughly 7% of customer data — mainly names, email addresses and phone numbers of clients who submitted repair requests via its website. LMT's own databases were unaffected, and the company temporarily closed its website for security reasons. Its head said compensation would be assessed case by case.

PRESS.LV reports that CERT.LV is warning about fallout from a CSDD (Road Traffic Safety Directorate) data breach in which an attacker obtained customers' names, personal ID codes, payment amounts and dates, vehicle registration numbers and service-time addresses; phone numbers, emails, banking details and e-CSDD login data were not stolen. Since the incident, residents increasingly report suspicious letters, texts and calls, including fake debt or unpaid-fine notices, though no direct proof yet links specific cases to the leak.

The 11th regional judges' seminar took place September 8-9 in Priekuļi, bringing together representatives of Baltic and European courts, the Industrial Property Board of Appeal, WIPO, EUIPO and the EPO to discuss recent European and national case law on intellectual property enforcement. Topics included the interaction between AI and copyright, trade-secret protection, patent dispute adjudication and trademark protection developments; participants worked through practical litigation scenarios in group exercises, stressing the need for consistent case law amid fast-moving technology.

The article summarises the steps a company should take after a cybersecurity incident: notify management, isolate affected systems, conduct a risk analysis, and report to supervisory authorities within statutory deadlines. Under the National Cybersecurity Law, incidents must be reported to CERT.LV within 24 hours, 72 hours and one month; GDPR requires notifying the Data State Inspectorate within 72 hours where the breach poses a risk to individuals' rights. Violations carry administrative fines of up to EUR 20 million or 4% of turnover under GDPR and up to EUR 10 million or 2% under the cybersecurity law, plus possible liability under Criminal Law Article 245.

An LV portāls consultation, citing guidance from the Data State Inspectorate, states that naming an employee in a work document is not in itself a personal-data violation. Processing the name must have a lawful basis and legitimate purpose, such as accountability or letting the public contact the responsible official; whether it is permissible depends on the document type, job duties, and the institution's internal procedures.

Riga Graduate School of Law (RGSL) has been selected to join a Council of Europe consultancy framework on tackling disinformation, running through 2030. RGSL will contribute expertise in European law, human rights and digital regulation to help states improve legislation while safeguarding freedom of expression and media freedom.

RGSL researchers will join three European COST Action research networks for 2026-2030: HARPA on privacy in AI development, "Moving Data for Europe" on data mobility across Europe, and STONE on steward-ownership models.

DVI clarifies that a service provider may refuse service only if it can justify an objective need for the specific data requested. Merely listing data fields in a contract or application form does not automatically make providing them mandatory. The guidance reiterates the GDPR data-minimization principle: businesses may only collect data necessary for a specific purpose, not for convenience or established practice.

NRA.lv reports that the EU's Markets in Crypto-Assets Regulation (MiCA) has imposed strict licensing requirements on crypto firms — capital reserves, compliance certification, cybersecurity and anti-money-laundering measures. Many small companies and startups in Estonia, Poland and elsewhere in the EU face a choice between costly compliance or relocating to jurisdictions such as the UAE, Georgia or the US. The article concludes the rules are consolidating the market around larger, better-capitalized players, dampening innovation and entrepreneurship in Latvia and the EU.

PRESS.LV reports that an IT expert checked on social media what data the Rimi supermarket chain receives when using Smart-ID for age verification, after followers asked whether Rimi was "stealing" customer data. The expert found that Rimi receives the customer's exact age rather than just an 18+ confirmation, questioning why the store needs the precise age when a simple age-threshold confirmation would suffice.

The Data State Inspectorate (DVI) explains that a person wishing to claim compensation in court for damage caused by a personal data protection breach under Article 82 of the GDPR does not first need to obtain a decision from the supervisory authority – the authority's investigation and the question of compensation are two separate matters. Referring to CJEU case law, the DVI notes that the purpose of compensation is to make good the damage actually suffered, not to punish the controller: a breach alone does not give rise to a right to compensation, damage and a causal link must be proven, and the amount also depends on the sensitivity of the data.

Following data breaches at state forestry company AS "Latvijas valsts meži" and at CSDD, Ombudsman Karina Palkova urges state and municipal institutions to act preventively rather than react after the fact, and to check whether their information systems comply with data-protection rules. She calls for immediate security audits of systems handling health and children's data (particularly E-Health and E-Class) and for cooperation with cybersecurity authorities to detect and prevent further breaches.

Also reported by: lvportals.lv

Following a string of data-security incidents in state information systems, Latvia's ombudsperson Karina Palkova has called on state bodies and municipalities to urgently check the security of systems under their control and take preventive steps to protect personal data, singling out systems holding health and children's records.

Economy Minister Viktors Valainis and parliamentary secretary Jurģis Miezainis held a videoconference with counterparts from Lithuania, Poland, Germany, Czechia and Bulgaria on the European Commission's Digital Omnibus proposal (2025/0360), which consolidates several digital-data rules to cut businesses' administrative burden while keeping data-protection standards. Ministers agreed competitiveness needs must weigh more heavily in the final text and pledged further expert-level coordination ahead of Council working-group meetings.

The Consumer Rights Protection Centre (PTAC) reports a possible security incident in the Remote Statistical Data Collection System (ASDIS, a class C system). The contact details (name, e-mail, telephone) of 697 company representatives and 34 PTAC officials were affected – mainly contacts of licensed consumer lenders, debt collection service providers and package travel service providers, most of which are already available in public registers. Supervisory data submitted by companies were not affected; the system has been shut down and users have been informed.

After an early-August cyberattack on road-safety authority CSDD exposed payment-receipt data for about 1.2 million individuals and 200,000 legal entities, a sworn advocate explains that compensation for the leak is not automatic — it must be proven case by case, with real claim numbers likely in the hundreds rather than thousands.

Lawyer Aleksandra Baranova (law firm Kronbergs Čukste Levin) analyses the CJEU judgment of 14 July 2026 in case C-474/24 on the Austrian anti-doping organisation's practice of publishing athletes' names, violations and the length of their bans. Four athletes challenged the publication as disproportionate processing of special categories of personal data; the article assesses the circumstances in which such publication is permissible under data protection law. The article is paywalled.

Kristīne Puķēna, senior lawyer at TEGOS, analyses companies' digital and organisational resilience in the context of the requirements of the National Cybersecurity Law, NIS2, DORA and the GDPR. The article stresses that the most common problems are unclear processes and undefined responsibility, so risk management, information protection and incident reporting procedures should be reviewed in calm times. In practical terms, it recommends putting contracts with service providers and subcontractors in order – roles, responsibility, service level (SLA) terms and incident response deadlines.

Sworn attorney Annija Švemberga-Streikiša (AmberLaw) analyses the CJEU judgment of 16 July 2026 in joined cases C-258/23–C-260/23 on competition authorities' access to employees' e-mails. The Court held that work e-mail is correspondence protected by the EU Charter of Fundamental Rights, and an internal ban on private use of e-mail does not remove that protection; any access is an interference with fundamental rights that must have a legal basis. The article is paywalled.

The Data State Inspectorate (DVI) explains the data subject's right of access (Article 15 of the GDPR): the person must first contact the controller, which within one month (Article 12(3) of the GDPR, extendable by two months in complex cases) must provide specific, understandable information on the purposes of processing, the categories of data, the recipients, the retention periods and the source of the data. The DVI intervenes only if the controller fails to reply within a month, refuses or gives an incomplete reply, or the processing is manifestly unlawful.

The Data State Inspectorate (DVI) informs that, in connection with the CSDD personal data leak, an investigation has already been launched and information has been requested from CSDD, so affected persons do not need to file individual complaints. The investigation will assess the circumstances of the leak and the conduct of CSDD as controller; any decision will be addressed to CSDD. The DVI reminds that it does not decide on compensation – such disputes are to be resolved in court.

Under the Digital Services Act, the European Commission has designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms (each with over 45 million monthly users in the EU). By December 2026 they must meet additional requirements – assess and mitigate systemic risks (illegal content, child safety, fundamental rights, elections); the Commission gains supervisory powers in cooperation with the Irish and Dutch regulators.

BDO Latvia partner V. Briežkalns, citing the summer 2026 cyberattacks on AS "Latvijas valsts meži", AS "Olpha" and the CSDD (the last exposing data on roughly 1.2 million individuals and 200,000 legal entities), argues companies should plan not around whether an attack happens but around who pays for downtime, recovery and lost trust. CERT.LV logged 673 cyber incidents in Q2 2026; the piece lists five areas (downtime cost among them) where cyber risk becomes a governance and finance issue, including a reminder of companies' regulatory reporting duties.

The European Commission classified ChatGPT as a very large online search engine, and Reddit and Roblox as very large online platforms, under the Digital Services Act. The classification means these services now come under the DSA's stricter systemic-risk-management and transparency obligations.

The road traffic safety directorate CSDD says compensation for data stolen in the cyberattack will hinge on a Data State Inspectorate ruling on CSDD's liability for a GDPR breach. Claiming compensation now is deemed premature, and clients will be informed separately of next steps.

Justice Minister Edvards Smiltēns convened a meeting with state agencies and cybersecurity experts on rising cyber threats in the justice sector. He stressed that under the National Cybersecurity Law, managing risk and ensuring resilience of critical services is the responsibility of an organisation's leadership, not just IT staff. The Ministry committed to strengthening inter-agency cooperation and treating security audits as an ongoing process rather than a one-off exercise.

Deputy director of the Data State Inspectorate Lāsma Dilba said on "Rīta Panorāma" that the greatest risk to those affected by the CSDD cyberattack arises when fraudsters combine the stolen data with information from other public registers, such as the Land Register, enabling a precise personal profile. The inspectorate is assessing whether CSDD did all it could to protect the data.

Latvia has registered standard LVS EN 18286:2026 on an AI quality-management system for EU AI Act purposes, setting risk-, data- and incident-management requirements for organisations developing AI systems.

Sworn advocate Lauris Klagišs's office has published guidance on social media for drivers after the CSDD cyberattack, which exposed data on 1.2 million people and roughly 200,000 legal entities spanning 18 years. It stresses the importance of data subjects understanding their GDPR rights and possible next steps.

EU Court judge Ineta Ziemele said on "Rīta Panorāma" that all 1.2 million people whose data was stolen in the CSDD cyberattack already have grounds to claim compensation for moral damage, since the rights violation occurred regardless of whether the data has been misused yet. She stressed that responsible authorities, not individuals, should decide on such compensation.

The Russian-language version of the same story: EU Court judge Ineta Ziemele explains that the 1.2 million residents affected by the CSDD cyberattack already have a right to claim moral-damage compensation, since the violation occurred regardless of any later misuse of the data. She stresses the importance of data protection as a core EU value.

Latvia's Ombudsman states that insurers may not demand, and medical practitioners may not provide, a patient's complete medical history for evaluating an insurance claim. Only information directly relevant to the specific insured event may be shared, in line with the data-minimisation principle. The opinion addresses insurers' practices when handling clients' health data.

The Ombudsman's Office clarifies that an insurer may request, and a provider may release, only the health data directly needed to assess a specific insurance claim, not a patient's whole medical history.

The article (only the intro is visible) examines whether AI can be considered the "author" of a text or image, given its growing use in content creation.

The article (only the intro is visible) warns fraudsters use obtained personal data – name, ID number, address – to build convincing scams, and advises how to protect such data.

Latvia's Data State Inspectorate explains how data controllers must notify individuals of a personal data breach, citing the summer CSDD security incident that affected roughly 1.2 million people's data as an example. It states that for mass incidents public notification (website, media) can replace individual letters if individual contact would be disproportionately burdensome, and notices must describe affected data, risks and recommended action.

Following lawyers' calls, a ready-made request template asking CSDD about one's data status after the cyberattack is circulating publicly, though lawyers themselves disagree on whether mass requests help. Some think it will make CSDD feel the consequences more sharply, others warn it could overload the agency and delay the investigation.

It emerged the CSDD cyberattack exploited an application the agency managed itself, outside telecom operator Tet's security contract. The Economy Minister said Tet covered only network infrastructure, and a transition period had let systems run without mandatory safeguards. Both sides acknowledged the need for closer cybersecurity coordination.

The road safety agency CSDD has created a dedicated section on its website gathering current information about the cyberattack it suffered. The section covers several topics related to the incident and will be updated regularly, CSDD says. The move aims at more transparent communication about handling the fallout of the data-security incident.

An annual survey by “Bite Latvija” and the SKDS research centre, covering 750 active business leaders, found that 18% of companies have experienced cyberattacks, yet more than a third are not concerned about cyber risks.

Latvia's Ministry of Defence has drafted amendments to the National Cyber Security Law creating a legal framework for security researchers to access information systems to identify vulnerabilities, without unduly burdening systems or compromising security. The rules would cover essential and important service providers and critical infrastructure operators. The proposal follows a 2026 court case in which inventor Raimonds Skuruls was fined EUR 4,290 for reporting a vulnerability to CSDD; public consultation runs through the end of August.

The Defence Ministry has drafted amendments to the National Cybersecurity Law that would legalise the work of so-called "white hat hackers" who find vulnerabilities in information systems. Researchers would only be allowed to access data to the extent needed to verify a flaw, without disrupting the system. Organisations notified of a vulnerability would be obliged to inform the responsible authority and fix the problem.

PTAC reports a growing number of complaints drafted with AI tools that contain legally unfounded or mistaken arguments. The agency stresses that AI is not a legal adviser and bears no responsibility for the information it provides, urging consumers to verify AI suggestions against official sources, especially regarding deadlines and financial obligations.

The Data State Inspectorate explains the procedure to follow after a personal data breach — once notified by an organisation, the DVI establishes the circumstances and nature of the breach and the risks involved, and assesses the organisation's further obligations toward affected individuals.

DVI explains how it handles a personal-data-breach notification: it assesses the circumstances of the violation and the security measures the organisation had in place, not just the fact that an incident occurred. The authority stresses that DVI itself does not award compensation to affected individuals — claims for damages must be pursued in civil court with evidence of the harm suffered.

A cyberattack on CSDD exposed 18 years of payment data for 1.2 million residents and ~200,000 businesses. The PM sharply criticized CSDD for failing mandatory cybersecurity requirements, including missing two-factor authentication; the Data State Inspectorate must assess consequences by August 31. Possible foreign involvement is being investigated.

The President said that after the massive CSDD data breach affecting 1.2 million residents and ~200,000 businesses, the agency's leadership should not remain in office given the loss of public trust. He called the attack a serious national-security threat; State Police opened a criminal investigation.

Swedbank is urging customers to be cautious, as fraudsters are sending fake messages imitating the bank's data-verification requests in an attempt to steal clients' access credentials. The bank reminds customers never to share passwords or codes and to check the sender's address before responding.