The purpose of the State Data Inspectorate is to protect human rights and fundamental freedoms in the field of data protection, to advise citizens and organisations, and to monitor the processing of personal data; therefore, citizens, in accordance with their rights under the General Data Protection Regulation, require the Data State Inspectorate to provide information on which persons processed their personal data, during which period and why.

Does the State Inspectorate have a “database” containing information on the processing of personal data by other persons?

Almost all organizations, using the available technical resources, maintain an information system, another simpler, for example, a system of archiving documents received and sent, Another example in Latvia is the population register managed by the Office for Citizenship and Migration, which collects information about all residents in Latvia. This means that there is no single universal database (system) that would contain information about everything and everyone, but that each organization chooses the most convenient and accessible data processing system.

As you know, in the context of the General Data Protection Regulation, the controller (hereinafter – public and private person) is the one who determines before starting the processing of personal data, which personal data will be processed, for what purposes personal data will be processed, what legal basis will apply and what means will be used to process personal data.

Consequently, in answering this question, the Inspectorate explains that it does not have a single database containing information on the processing of the data of a specific (data subject) by other authorities, companies or other natural persons (data processor).

The Inspectorate, like any other controller of personal data (public or private entity), can provide a person with information only on what personal data he has developed in his information systems, for what purpose and on what legal basis, or by connecting to the information systems of other institutions (such as the Registry for the verification of the address of the declared place of residence to the person who submitted the application to the institution).

Consequently, the State Data Inspectorate cannot be responsible for the processing of personal data carried out by other institutions, companies or individuals.

How to exercise your rights to obtain information about who processed my personal data and why:

Since 25 May 2018, with the direct application of the General Data Protection Regulation, each person has been granted greater control over the processing of their personal data, including the right to know who has processed their personal data and why.

Consequently, if a person knows or has reason to believe that a certain public and private person has processed the data of that person in its computer system or archive, in order to obtain confirmation and information on the processing of his personal data, its purposes (purposes) and to whom information on a person has been transferred, it is necessary to contact the specific public and private maintainer of the system / relevant information package with a request for information. These rights are provided for each person by the regulations.

According to Article 12.3 of the General Data Protection Regulation, a natural or legal person must reply to a request for personal information within one month.

If a person discovers that a natural or legal person does not respect the rights of the person referred to in Articles 15-22 of the General Data Protection Regulation, for example, does not respond to a request or has processed unjustified personal data, the person has the right to lodge a complaint with the Data Inspectorate.

The complaint must be accompanied by documents attesting to the unlawful processing of personal data and that the applicant has exercised his rights under the General Data Protection Regulation (e.g. a copy of the person’s request to the natural or legal person and, if the request is answered, a copy).

The State Data Inspectorate, on the other hand, examines a person’s complaint and exercises the powers conferred on it, for example, reproaches, prohibits the further processing of personal data or imposes an administrative sanction.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA LETTONIA DELLA LETTONIA