DVI (Latvia) - Fine against employer (unknown)

DVI - Fine against employer (unknown)
Authority:	DVI (Latvia)
Jurisdiction:	Latvia
Relevant Law:	Article 6 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	Fine against employer (unknown)
National Case Number/Name:	Fine against employer (unknown)
European Case Law Identifier:	n/a
Appeal:	Pending appeal
Original Language(s):	Latvian
Original Source:	Datu valsts inspekcija (in LV)
Initial Contributor:	n/a

The Latvian DPA (Datu valsts inspekcija) has fined an employer €6,250 for unlawful processing of personal data further to a complaint. The DVI found that the employer had both disclosed data about the complainant's name and health to other employees, and had processed the complainant's data without an appropriate legal basis.

English Summary

Facts

The DVI received a complaint about an employer who had allegedly informed other employees of the complainant's name and state of health. Upon investigation, the DVI found that the personal data of the complainant had in fact been processed inappropriately, as there was no legal basis for the processing.

Dispute

Whether there was an unlawful processing of data by the employer?

Holding

The DVI held that the processing of the complainant's data was in fact unlawful, and fined the employer €6,250, taking into account that it was an isolated incident and that there was no evidence that the employer would do the same in the future.

Comment

The company has appealed the decision of the State Data Inspectorate in court, therefore the decision on the fine is not considered final.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Latvian original. Please refer to the Latvian original for more details.

The Data State Inspectorate imposes a fine of EUR 6250 on the employer for improper processing of personal data.

The Data State Inspectorate received a complaint about the employer's actions in informing other employees by sending them an e-mail containing information about the victim's name, surname and state of health (diagnosis of an infectious disease).

Investigating the circumstances of the incident, the Data State Inspectorate found that the personal data of the victim were processed inappropriately, as such processing was not necessary to achieve the employer's objectives and was not provided with an appropriate legal basis.

When imposing a fine, the Data State Inspectorate took into account that the incident was an isolated incident and no evidence was found that the company would do so systematically.

The company has appealed the decision of the State Data Inspectorate in court, therefore the decision on the fine is not considered final.