On November 28, 2024, the Data State Inspectorate (DVI) announced the conclusion of the joint inspections of supervisory authorities of the Baltic States on the adequacy of personal data processing in the short-term vehicle rental industry.

The DVI noted that the inspections were aimed at identifying and mitigating risks associated with personal data processing in the rapidly growing sector, focusing on businesses operating within the region and expanding the examination to companies limited to their domestic markets. The inspections revealed several violations, primarily related to a lack of transparency and inappropriate use of legal bases for processing personal data.

The DVI highlighted that companies struggled to provide clear information to data subjects and often relied on the same legal basis for all data processing activities, regardless of suitability. Additional concerns were raised about the volume of personal data requested, vague data storage terms, and the handling of biometric data, with companies typically not offering clear opt-out options.

In response, the supervisory authorities issued recommendations to promote responsible data processing, reinforcing their commitment to high standards of personal data protection across the Baltic States.

You can read the press release here and the report here, both only available in Latvian.