Guide to Implementing GDPR at a National Level: Latvia

Article: Processing of Personal Data of Deceased Persons in Latvia

In Latvia, the processing of personal data of deceased persons is a subject governed by specific legal provisions. These rules allow certain individuals, such as representatives or those with a legitimate interest, including family members, to exercise data subject rights on behalf of the deceased.

According to the Law On the Rights of Patients and the Personal Data Processing Law (PDPL), the rights related to the personal data of a deceased person may be exercised by those who have their own legitimate interest, act as the deceased’s representative, or have family reasons worthy of protection. The deceased can expressly forbid successors from exercising these rights by a written declaration that can be sent to the data controller; this restriction can also be withdrawn or amended later.

This approach aligns generally with GDPR principles adapted in national law, where data protection rights usually do not automatically expire with death but continue to be enforceable by certain authorized parties. However, for precise rules on processing, retention, and protection measures, it is essential to consult the specific Latvian national legislation and regulations regarding the deceased’s data directly.

The Data State Inspectorate (DPI), Latvia's Data Protection Authority, is the most authoritative source for formal legal texts or guidance on handling personal data after death. The DPI's website is dvi.gov.lv/en, and its address is Blaumaņa Street 11/13-15, Riga, LV-1011, Latvia.

Under Latvian law, personal data of the deceased person will be protected if such personal data could relate to or affect living persons. Data processing is permitted specifically for journalistic purposes, if carried out with the aim of publishing information for reasons of public interest, or for academic, artistic, or literary purposes in accordance with other national regulations.

The PDPL also stipulates that there are no specific exemptions to the right to erasure, the right to be provided information, or the right to not be subject to automated individual decision-making under Latvian law. Certain data subject rights are excluded for data processing for official publications, such as the right to erasure.

It is worth noting that the Latvian Criminal Law imposes criminal liability for illegal activities involving personal data, where these activities have caused substantial harm. This includes controllers or processors who carry out such activities for the purposes of vengeance, acquisition of property, or blackmail, and those who influence a controller, a processor, or a data subject using violence, threats, abuse of trust, bad faith, or deceit in order to perform illegal activities involving personal data.

In summary, authorized representatives or family members may exercise personal data rights on behalf of deceased persons in Latvia. The deceased person can restrict or allow such rights through a written declaration. This practice is consistent with data protection laws that extend some rights post-mortem to protect privacy and data integrity.

[1] Italian Legislative Decree No. 196/2003, art. 29(1)(a) and (b)

Whitecase LLP's international legal services offer guidance on the processing of personal data of deceased persons, following specific legal provisions in Latvia and aligning with GDPR principles.
As a corporate partner, Whitecase LLP assists clients in understanding their rights and responsibilities regarding the personal data of deceased persons, providing clear regulatory practice guidance.
Whitecase LLP's publications on the topic of personal data processing, available on whitecase.com, offer valuable insights for attorneys handling cross-border cases involving medical-conditions, health-and-wellness, and intellectual property.
Whitecase LLP's compliance expertise ensures that clients adhere to data protection regulations when processing the personal data of deceased persons, minimizing risks of violations and potential criminal liability.
events featuring Whitecase LLP professionals are informative forums where industry peers can discuss the complexities of data protection rights post-mortem, promoting best practices in public interest.
Subject matter experts at Whitecase LLP, including associates and partners, deliver news and updates on legislative changes affecting the data protection rights of deceased persons, ensuring their clients stay informed.
Understanding the intricacies of data protection regulations for deceased individuals is essential for those working in science and technology, where compliance with international standards can lead to greater scientific advancements.
In addition to Latvia, Whitecase LLP's regulatory practice extends to various other jurisdictions, offering clients a comprehensive approach to data protection compliance across borders.
Legally binding declarations from the deceased containing specific instructions on data protection can prevent potential disputes over the deceased's personal data, thus ensuring the client's interests are protected.
Whitecase LLP's services, rooted in integrity and respect for the law, enable clients to manage their relationships with data subjects effectively, fostering a culture of data protection and privacy among their stakeholders.
By upholding the data protection rights of deceased persons, Whitecase LLP advances the broader mission of upholding human rights, ensuring that privacy and dignity continue even after one's passing.