On August 28, 2024, the Data State Inspectorate (DVI) published a guide for organizations on correctly applying the performance of a contract as a legal basis for the processing of personal data.

When can the legal basis be applied?

The DVI explained that the performance of a contract can be applied as a legal basis if:

• a contract has been concluded with a person, and the data must be processed in order to fulfill the obligations specified in the contract;
• a contract has been concluded with a person, and the data must be processed in order to fulfill obligations to the organization; and
• the contract has not been concluded, but the person has asked to perform some actions, as a result of which the contract could be concluded.

How can the legal basis be applied?

The DVI clarified that the performance of a contract as a legal basis must be interpreted narrowly and it must be established that the contract cannot be executed or concluded without such processing and that there is no way to perform or enter into a contract that is less intrusive to other people's privacy.

The legal basis can also be applied where:

• the processing is reasonably foreseeable and necessary for the performance of the contractual relationship, even if it is not directly aimed at the performance of the basic obligation;
• compliance with warranty provisions is required; and
• the processing of personal data is regulated by regulatory acts as long as the processing specified in the regulatory act coincides with the processing necessary for the performance of the contract and does not conflict with the regulations.

Furthermore, the DVI explained how to properly apply the legal basis in a situation where no contract has been concluded between the parties, but a person submits a request to the organization in connection with the possible conclusion of a contract.

Additionally, the DVI highlights situations when the performance of the contract is not the appropriate legal basis, and other legal bases may be applicable, such as legitimate interests, legal obligation, or individual consent.

You can read the press release, only available in Latvian, here.