DVI (Latvia) - Cēsu novada Pašvaldības policijai: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Latvia |DPA-BG-Color= |DPAlogo=LogoLV.png |DPA_Abbrevation=DVI |DPA_With_Country=DVI (Latvia) |Case_Number_Name=Cēsu novada Pašvaldības pol...") |
mNo edit summary |
||
| Line 69: | Line 69: | ||
=== Facts === | === Facts === | ||
The data subject’s former spouse wished to ask for temporary protection against domestic violence. The spouse informed a police officer that the data subject had been subject to administrative sanctions and restrictive measures imposed by a court. | The data subject’s former spouse wished to ask for temporary protection against domestic violence. The spouse informed a police officer that the data subject had been subject to administrative sanctions and restrictive measures imposed by a court. | ||
The police officer used a police database to confirm these allegations. In addition, the police officer used the data subject´s identification number to check their criminal record. Finally, the police officer submitted to a court an application for temporary protection against domestic violence on behalf of the data subject´s spouse attaching the criminal record and evidences that the data subject held invalid identity documents. The police officer claimed to have processed personal data with the aim of preventing violence. | The police officer used a police database to confirm these allegations. In addition, the police officer used the data subject´s identification number to check their criminal record. Finally, the police officer submitted to a court an application for temporary protection against domestic violence on behalf of the data subject´s spouse attaching the criminal record and evidences that the data subject held invalid identity documents. The police officer claimed to have processed personal data with the aim of preventing violence. | ||
According to the police, a legal basis for this kind of processing was in principle [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], namely performance of a task carried out in the public interest. However, the police also acknowledged that the police officer exceeded the limits of their functions. | According to the police, a legal basis for this kind of processing was in principle [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], namely performance of a task carried out in the public interest. However, the police also acknowledged that the police officer exceeded the limits of their functions. | ||
=== Holding === | === Holding === | ||
In the Latvian DPA’s opinion, the controller was the police as such. The Latvian law establishes in details the content of an application for temporary protection against violence. Even if personal data as the ones at issue may be processed for such a purpose, in this specific case information was obtained, submitted to the court and transferred to all parties involved in the proceeding on the police officer’s own initiative and without previous authorisation by the police. The processing was therefore unlawful and violated Articles 5 and 6 GDPR. The police also violated [[Article 24 GDPR#1|Article 24(1) GDPR]], as it did not establish a procedure for police officers to deal with similar cases. | In the Latvian DPA’s opinion, the controller was the police as such. The Latvian law establishes in details the content of an application for temporary protection against violence. Even if personal data as the ones at issue may be processed for such a purpose, in this specific case information was obtained, submitted to the court and transferred to all parties involved in the proceeding on the police officer’s own initiative and without previous authorisation by the police. The processing was therefore unlawful and violated [[Article 5 GDPR|Articles 5]] and [[Article 6 GDPR|6 GDPR]]. The police also violated [[Article 24 GDPR#1|Article 24(1) GDPR]], as it did not establish a procedure for police officers to deal with similar cases. | ||
However, as the police officer acted in good faith to protect a natural person´s physical integrity, the DPA issued only a reprimand pursuant to [[Article 58 GDPR#2b|Article 58(2)(b) GDPR]]. | However, as the police officer acted in good faith to protect a natural person´s physical integrity, the DPA issued only a reprimand pursuant to [[Article 58 GDPR#2b|Article 58(2)(b) GDPR]]. | ||
Revision as of 08:23, 28 March 2023
| DVI - Cēsu novada Pašvaldības policijai | |
|---|---|
 | |
| Authority: | DVI (Latvia) |
| Jurisdiction: | Latvia |
| Relevant Law: | Article 5 GDPR Article 6 GDPR Article 24(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 18.08.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Cēsu novada Pašvaldības policijai |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Latvian |
| Original Source: | DVI (Latvia) (in LV) |
| Initial Contributor: | mg |
The Latvian DPA issued a reprimand against a police office for not having established appropriate procedures to deal with the processing of personal data in the context of an application for temporary protection against domestic violence.
English Summary
Facts
The data subject’s former spouse wished to ask for temporary protection against domestic violence. The spouse informed a police officer that the data subject had been subject to administrative sanctions and restrictive measures imposed by a court.
The police officer used a police database to confirm these allegations. In addition, the police officer used the data subject´s identification number to check their criminal record. Finally, the police officer submitted to a court an application for temporary protection against domestic violence on behalf of the data subject´s spouse attaching the criminal record and evidences that the data subject held invalid identity documents. The police officer claimed to have processed personal data with the aim of preventing violence.
According to the police, a legal basis for this kind of processing was in principle Article 6(1)(e) GDPR, namely performance of a task carried out in the public interest. However, the police also acknowledged that the police officer exceeded the limits of their functions.
Holding
In the Latvian DPA’s opinion, the controller was the police as such. The Latvian law establishes in details the content of an application for temporary protection against violence. Even if personal data as the ones at issue may be processed for such a purpose, in this specific case information was obtained, submitted to the court and transferred to all parties involved in the proceeding on the police officer’s own initiative and without previous authorisation by the police. The processing was therefore unlawful and violated Articles 5 and 6 GDPR. The police also violated Article 24(1) GDPR, as it did not establish a procedure for police officers to deal with similar cases.
However, as the police officer acted in good faith to protect a natural person´s physical integrity, the DPA issued only a reprimand pursuant to Article 58(2)(b) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Latvian original. Please refer to the Latvian original for more details.
Municipality of Gulbene region Expressed rebuke; Obligation imposed 22.12.2022 Take effect IK "Riga Communal Service" Fine EUR 500.00 02.12.2022 Appealed SIA "W&G" Fine EUR 500.00 30.11.2022 Take effect SIA "Deprus" Fine EUR 500.00 29.09.2022. Take effect SIA "TET" Fine EUR 1,200,000.00 09.09.2022. Appealed Individual Fine EUR 200.00 02.09.2022. Take effect Municipal police of Cēsis region Expressed rebuke; Obligation imposed 18.08.2022. Take effect Individual Fine EUR 200.00 16.08.2022. Take effect SIA "DEPO DIY" Fine EUR 17,495.00 Obligation imposed 07.07.2022. Take effect SIA "Vidzeme Hospital". Expressed rebuke 11.01.2022. Take effect Agency for International Youth Programs Expressed rebuke; Call for appropriate data processing LIMITED AVAILABILITY 25.01.2022 Take effect SIA "Solvers" Expressed rebuke 27.01.2022 Take effect SIA "Computer security technologies" Expressed rebuke 27.01.2022 Take effect SIA "SOAAR" Fine EUR 600.00 01.03.2022 Take effect SIA "Tērbatas ezītis miglā" Fine EUR 500.00 02.03.2022. Take effect Riga municipality SIA "Rīgas Satiksme" Expressed rebuke; Call for appropriate data processing 11.03.2022. Take effect SIA "8 LOUNGE" Fine EUR 500.00 29.03.2022 Take effect SIA "Your Move" Fine EUR 1464.13 21.04.2022. Take effect SIA "GelvoraSergel" Expressed rebuke 09.05.2022. Take effect
