On November 29, 2024, the Data State Inspectorate (DVI) issued guidance on the methods of obtaining personal data, highlighting the importance of lawful data collection practices. The DVI noted that organizations need to have a valid legal basis for obtaining personal data, whether directly from individuals, from third parties, or through observation of actions. The DVI emphasized transparency in this process as organizations must clearly identify the source of data and its intended use to protect individuals' rights.

Furthermore, the DVI highlighted that data can be submitted by individuals and organizations must provide complete information about data processing at the time of collection. Alternatively, organizations may obtain data from other organizations based on legal grounds, ensuring that individuals are informed about this processing as well. Exceptions to the obligation to inform individuals include cases where the information is already available or where providing it would require disproportionate effort.

Additionally, the DVI stated that organizations may collect observed data through direct observation or measurement, often used for targeted advertising or security purposes. Inferred data, derived from analysis of existing data, allows organizations to predict behaviors or interests, which can facilitate automated decision-making and personalized services. Throughout these methods, the DVI mandated that compliance with data processing principles and legal requirements remains essential and organizations must always adhere to data protection principles and ensure that people feel safe about how their information is used.

You can read the press release, only available in Latvian, here.