DVI (Latvia) - SIA "SOAAR"
From GDPRhub
| DVI - SIA "SOAAR" | |
|---|---|
 | |
| Authority: | DVI (Latvia) |
| Jurisdiction: | Latvia |
| Relevant Law: | Article 58(1)(e) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 10.02.2023 |
| Published: | |
| Fine: | 800 EUR |
| Parties: | n/a |
| National Case Number/Name: | SIA "SOAAR" |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Latvian |
| Original Source: | DVI (Latvia) (in LV) |
| Initial Contributor: | mg |
The Latvian DPA fined a company €800 for its delay in providing access to personal data and information necessary to the performance of the DPA’s investigative tasks.
English Summary
Facts
The controller allegedly processed personal data - and specifically audio recordings containing the voice of their customers – in an unlawful way.
The Latvian DPA asked the controller to provide information concerning the processing in the context of an ex officio investigation. The controller first asked for the deadline to be extended and then stopped replying to the DPA.
Thus, the Latvian DPA opened a sanctioning procedure against the controller.
After that, the controller replied to the DPA’s request and provided the information.
Holding
The DPA noted how Article 58(1)(e) GDPR provides supervisory authorities with the power to obtain from controllers and processors access to all personal data and information necessary for the performance of its tasks.
The notification procedure followed by the DPA to request access to such information respected all the formal requirements under Latvian law.
In light of the above, the DPA decided to issue a €800 fine against the controller. In the determination of the amount of the sanction, the fact that the controller had been already reprimanded for similar circumstances was considered an aggravating factor. On the other hand, the fact that the controller eventually complied with the DPA’s request played a role as a mitigating factor.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Latvian original. Please refer to the Latvian original for more details.
Elijas iela 17, Riga, LV-1050, tel. 67223131, e-mail pasts@dvi.gov.lv, www.dvi.gov.lv
The decision
Riga,
on February 10, 2023
On the application of punishment
1. Authority (official) that makes the decision: Data State Inspections (hereinafter -
DVI) Legal advisor of the Supervision Department, Tatyana Lashchenkova (hereinafter – Official), according to
Article 5, Paragraph 1, Clause 2 of the Law on Personal Data Processing (hereinafter – FPDAL) and
Article 115, first part, point 4 of the Administrative Responsibility Law (hereinafter - AAL).
2. Place and date of administrative violation case review: DVI, Riga, Elijas
iela 17, on February 8, 2023 at 9:00 a.m.
3. Information about the participants in the process and their representatives and advocates (if any):
Person to be held responsible: Limited Liability Company "SOAAR" registrations
number 45403018166, legal address - "Mazplānlejas", Salas parish, Jēkabpils district, LV-5230
(hereinafter - SIA).
Taking into account the trends in the spread of the Covid-19 virus in recent months and the recommendations of the government
to the extent possible, organize all processes remotely in order to reduce the risk of infection, in accordance with the Covid-
19, the case of the first parts of Article 9 of the Law on the Management of the Spread of Infection was examined in a written process.
4. The actual and established facts of the commission of an administrative violation during the case review
statement of circumstances:
4.1. The official finds that in the administrative violation case materials (hereinafter - the case)
there is the DVI Official's report of January 10, 2023 [..] with attachments (hereinafter - the Report).
According to the information contained in the report, it can be established that the information at the disposal of DVI indicates SIA
possible processing (acquisition, storage) of personal data (voice) in the form of an audio recording. In this context
In 2021 and 2022, DVI repeatedly approached SIA, asking them to provide DVI for inspection
necessary information, and SIA had provided its explanations on July 6, 2022.
DVI, evaluating the explanations provided by SIA in connection with the information available to DVI,
based on Articles 55-58 of the General Data Protection Regulation (hereinafter - GDPR) and FPDAL
Articles 3-5, which stipulates that DVI has the right to obtain from the manager according to its competence and
processor's access to all personal data and all information necessary for its tasks
for carrying out, request and receive free of charge in the specified amount and form from private individuals, the state
the information, documents or it necessary for inspection by administrative institutions and officials
copies and other materials, including restricted access information and receive for inspection
necessary information, documents and other materials about the services provided to individuals,
1Regulation No. 2016/679 of the European Parliament and the Council of April 27, 2016 on the protection of natural persons in relation to
processing of personal data and free circulation of such data and repealing Directive 95/46/EC 2
On September 1, 2022, the 2022
September 1 letter [..] (hereinafter - Request No. 1), in which SIA was invited to provide in Request No. 1
the mentioned information until September 16, 2022. It is established that on September 16, 2022, SIA
had turned to DVI with a request to extend the deadline for submitting information, and DVI referring to
SIA's request on September 20, 2022, the deadline for submitting information was extended to DVI
3
for November 1, 2022. It is established that the information (response) from SIA within the specified period (up to
for November 1, 2022) was not received, nor was information received about non-response
reasons.
In compliance with the above, on November 22, 2022, DVI sent SIAeAdresi on November 22, 2022
letter [..] (hereinafter – Request No. 2), in which, referring to Request No. 1, SIA was repeatedly
invited to provide the information mentioned in Request No. 2 by December 12, 2022. It is found
that the information (answer) has not been received within the deadline specified in Request No. 2, nor has it been received
information on reasons for non-response.
4.2. The official finds that the case materials contain the Official's January 11, 2023
decision [..] on the initiation of the administrative violation process [..] in accordance with the Administrative Penalties
of the Law on Offenses in the Field of Administration, Public Order and Use of the State Language (further
– ASL) to the fourth part of Article 3 on the actions of SIA without providing information to DVI.
4.3. The official finds that the case materials contain a letter from DVI dated January 11, 2023 [..],
in which SIA was informed about the initiated administrative violation process, about the fact that the case will be examined
in a written process on February 8, 2023, and also invited to provide by February 2, 2023
explanations, submit evidence and submissions or requests of a different nature.
4.4. The official finds that the case materials contain the letter of SIA dated February 2, 2023 [..] 4
(hereinafter - Explanations), in which SIA explains that on November 22, 2022, the Office of Internal Security
and the Corruption Prevention and Combating Office carried out procedural actions in the company, as a result
due to justifiable reasons, on November 22, 2022, it was not possible for the company to receive what was sent
information and it was not possible to answer it, as well as even if the information was received on the mentioned date
received, it is no longer at the company's disposal and it is not available to the company for a considerable time
On November 22, 2022, the company's operations were effectively paralyzed.
5
4.5. The official finds that in the case materials there is a letter from SIA dated February 2, 2023 [..]
(hereinafter - the Letter), in which SIA provides the information specified in Request No. 1 and Request No. 2.
4.6. DVI finds that the case materials contain the Information Center of the Ministry of the Interior "Sodu
register's statement, from which it follows that with the decision of DVI of February 3, 2022 no. [..] For punishment
application in an administrative violation case [..] (hereinafter – Decision No. 1) SIA was called to
administrative responsibility for the administrative violation provided for in the fourth part of Article 3 of the ASL, namely
for not providing information to DVI.
4.7. According to Article 132 of the AAL, when considering an administrative violation case, it must be ascertained whether there is
an administrative offense has been committed, whether it was committed by the person held responsible or by this person
can be brought to administrative responsibility, or there are extenuating and aggravating circumstances, as well as
other circumstances that are important for the correct decision of the case should be clarified.
4.8. The fourth part of Article 3 of the ASL stipulates responsibility for failure to provide information, information
improper provision or provision of false information to the Data State Inspectorate or the Public
service regulatory commission to issue a warning or a fine to a legal entity - from
fifty-six to four thousand fine units.
2
3SIA letter of September 16, 2022 [..]
4DVI letter of September 20, 2022 [..]
5DVI was registered on February 3, 2023 with [..]
DVI was registered on February 7, 2023 [].. 3
4.9. Thus, in order to establish whether SIA has committed an administrative violation, which is intended
In the fourth part of Article 3 of the ASL, it is necessary to establish that the SIA did not provide the DVI at the request of the DVI
it did not provide the requested information, nor did it inform about the reasons for not providing the information.
4.10. The rights and powers of DVI are determined by Article 58 of GDPR and Article 5 of FPDAL.
In accordance with Article 58, Clause 1, Subsection "e" of GDPR, DVI has the authority to obtain from the controller and
processor's access to all personal data and all information necessary for its tasks
for performing Paragraph 3 of the first part of Article 5 of the FPDAL provides for the rights of DVI according to its competence
request and receive free of charge in the specified amount and form from private individuals, state administration
information, documents or their copies necessary for inspection by institutions and officials and
other materials, including restricted information.
DVI found that according to what is available in the Official Electronic Addresses Information System
information, SIA has an activated official electronic address.
The first part of Article 12 of the Official Electronic Address Law stipulates that if the official electronic address has been activated
electronic address account, state institution and private person communicate electronically and electronic
the document is sent using the official electronic address. [..] Considering the above, SIA must be
reachable and must receive its correspondence, which is sent to the official electronic address of SIA.
The first, second, third and fifth parts of Article 3 of the Notification Law stipulate that the notification of the document
the institution performs: 1) on site at the institution or by delivering through an employee or messenger assigned by it; 2)
using postal services; 3) using electronic communications; 4) publicly. If in the external normative
the act does not specify a specific way of notifying the document, the institution itself chooses a way that
ensure appropriate notification of the document to the addressee. The institution takes into account the addressee as much as possible
the specified method of notification of the document. The addressee is obliged to accept what is communicated by the institution
document. If there is a disagreement about the notification of the document, the institution has the obligation to prove
the fact of notification of the document. If the addressee claims that he did not receive the document, he this statement
justified by pointing to objective circumstances that, regardless of the addressee's will, were an obstacle
for receiving the document.
The first part of Article 9 of the Notification Law stipulates that the document is notified to the official
electronic address in the cases and procedures specified in the Official Electronic Address Law, if
the addressee has an activated official electronic address account. A document sent to the official
electronic address, shall be considered notified on the second working day after its sending.
Request No. 1 SIA was sent on September 1, 2022 to the official electronic address of SIA
and in accordance with the information contained in the DVI Electronic Document Accounting System (hereinafter - EDUS).
is accepted by the beneficiary (SIA) on September 1, 2022, in addition to that, a letter from DVI regarding the term
extension for providing information until November 1, 2022 was sent
on September 20 and was accepted by the beneficiary (SIA) on September 20, 2022, in accordance with the information provided by DVI SIA
information (answer) should be received by November 8, 2022 at the latest.
Request No. 2 SIA was sent on November 22, 2022 to the official electronic address of SIA
and according to the existing information of DVI EDUS, it was accepted by the recipient on November 22, 2022, while
The information (answer) provided by DVI SIA should be received, at the latest, on December 19, 2022. 7
4.11. DVI, evaluating SIA's explanations about the excuses for not providing information
reasons, does not agree with the arguments expressed by SIA for the following reasons.
Request No. 1 was sent to SIA on September 1, 2022, SIA has received it, reviewed it
arto and requested DVI to extend the deadline for providing information until November 1, 2022. DVI
referring to SIA's request, extended the deadline, thus providing SIA with all the conditions for SIA to be
the possibility to provide information within the specified period or inform DVI about non-provision of information
reasons for providing DVI with information about conditions and/or obstacles to providing information.
6 Reply letter by sending on November 1, 2022 as a simple mail
7 Reply letter by sending on December 12, 2022 as ordinary mail 4
The mentioned SIA had to be executed even before the events mentioned in the Explanations, therefore, SIA
The explanations state the arguments that SIA on November 22, 2022 due to objective reasons
did not have the opportunity to receive the information sent to the eAddress and provide an answer to it, does not correspond to the truth,
SIA received Request No. 1 as early as September 1, 2022, and with its active activities has requested DVI
extend the deadline for providing information.
In addition to the above, finding that the information has not been received within the specified period, observing the good
principles of management, in order to give SIA another opportunity to provide the information necessary for the inspection,
DVI sent SIA Request No. 2, in which, referring to what was mentioned in Request No. 1, it repeatedly invited
provide the necessary information for the inspection. In addition, DVI does not establish that the case materials contain
any evidence that on November 22, 2022 and later, SIA did not have the opportunity to receive
information and provide an answer.
4.12. Observing the above, checking the case materials, evaluating the circumstances of the case and those in the case
evidence, the Officer finds that SIA according to DVI Request No. 1 and Request No. 2,
did not provide the information requested by DVI, which was requested by SIA on the basis of Article 58 of GDPR
Paragraph "e" of Paragraph 1 and Paragraph 3 of the first part of Article 5 of the FPDAL, and also did not inform about
the reasons for not providing information, thus committing an administrative violation, the commission of which
administrative responsibility is provided for in the fourth part of Article 3 of the ASL.
4.13. The official finds that SIA is guilty of the administrative offense provided for in the fourth part of Article 3 of the ASL
the violation is proven by: Report with attachments, SIA Explanations.
5. Appropriated by the institution (Official), which examined the administrative violation case
fine:
5.1. According to Article 13 of the AAL, an administrative penalty is a means of influence, which is applied
to the person who committed the administrative violation in order to protect public order, restore
justice, punished for the offense committed, as well as deterring the perpetrator of the administrative offense
person and other persons from committing further administrative violations.
According to the second part of Article 19 of the AAL, when determining the type and measure of the administrative penalty, it is taken into account
the nature of the offense committed, the identity of the person to be held responsible (for a legal entity -
reputation), financial position, circumstances of the violation, extenuating circumstances and
aggravating circumstances
5.2. The official determines that the violation committed by the liable person (SIA) is
directed against the established management procedure.
In addition, the Official finds that SIA was previously (on February 3, 2022) already fined for ASL
The administrative violation provided for in the fourth part of Article 3 and the mentioned circumstance indicate that,
the previously applied penalty has not achieved the purpose of the penalty - the prevention of violations, and should be taken accordingly
taken into account when determining the type and measure of punishment.
According to Article 20 of the AAL on extenuating circumstances, the Official acknowledges that with the Letter
SIA has provided information on the questions asked in Request No. 1 and Request No. 2,
has thus stopped the illegal action.
Taking into account the established circumstances and the purpose of the administrative penalty, the person to be held liable
a person (SIA) shall be subject to the fine provided for in the framework of the sanction of the fourth part of Article 3 of the ASL under
average limits.
Taking into account the above, based on FPDAL Article 5, Part One, Clause 2, Article 23,
AAL Article 115, first part, point 4, Article 151, point 1, Article 157, second and third parts, Article 166
first part, Article 168, Article 262, Article 269, Official
decides: 5
to recognize SIA "SOAAR" as guilty of the administrative offense provided for in the fourth part of Article 3 of the ASL
committing a violation and punish with a fine of 160 (one hundred and sixty) EUR
in the amount of 800.00 (eight hundred euros).
The fine shall be paid in full no later than one month from the date of entry into force of this decision
the day of entry into any banking institution or after the expiration of the term of voluntary execution of the fine
this decision will immediately be transferred to a sworn bailiff for enforcement.
Details for paying a fine:
Beneficiary: State Treasury
Registration No.: 90000050138
Account no.: LV69TREL1060191019200
Beneficiary BIC code: TRELLV22
Notes: Indicate the date and number of this decision.
The fine applied in the process of the administrative violation will be reimbursed
procedural costs and damages to natural resources can be paid on the portal www.latvija.lv,
using the e-service Administrative fines check and payment.
Please note that, in accordance with Article 568 of the Civil Procedure Law, voluntary execution of the decision
after the enforcement document is submitted for enforcement, I will not be released from the obligation to compensate
execution costs to the bailiff.
The decision can be appealed by submitting a complaint to the director of DVI, Elijas iela 17, Riga, LV-1050, 10
within (ten) working days from the day of notification (receipt) of this decision.
Official T. Lashchenkova
