On September 17, 2024, the Data State Inspectorate (DVI) published a guide on the processing of personal data after the termination of employment. The guide addresses concerns regarding the responsibility of former employers as data controllers, emphasizing that they must only continue processing personal data with a valid legal basis and delete any unnecessary data once employment ends. The DVI discussed issues such as the continued public availability of former employees' information on company websites, retention and deactivation of work emails, and handling of work-related correspondence that may include private communications.

The DVI highlighted that once an employment contract is terminated, personal data such as names, contact details, and positions must be removed from company websites as they no longer have a legal basis for processing. Employers can temporarily retain an ex-employee's work email to ensure smooth communication with clients, but they must specify the duration of this period in their internal policies.

Furthermore, the DVI reminded employers that private correspondence found on company devices or emails cannot be accessed or used for purposes unrelated to work.

The DVI also stressed that employees maintain their privacy rights even in work settings, and if an employer continues processing personal data without proper justification after the employment ends, individuals can request an explanation or file a complaint with the DVI.

You can read the press release, only available in Latvian, here.

Update: October 25, 2024

DVI publishes guide on termination of employment and personal data processing (part 2)

On September 26, 2024, the DVI published part two of the guide on the processing of personal data after the termination of employment, particularly with publications involving former employees. The DVI explained that employers commonly reference current employees in company publications to build brand image, but issues arise when these references remain after employment ends.

The DVI clarified that former employees have the right to request the deletion of their personal data; however, this right is not absolute and only applies to cases specified in the Data Regulation that are related to the purpose and legal basis of the specific data processing.

Furthermore, the DVI explained that a deletion request may be denied if the employer's legitimate interests outweigh the employee's interest in erasure. In addition, with regard to the employees of public institutions, the DVI confirmed that the preservation of such information and denial of the deletion request may be in the public interest.

Consequently, when evaluating the deletion request of the former employee, the DVI advised employers to consider the importance of the publication for the employer, the reasonable expectations of the data subject, and the principle of data minimization.

You can read the press release, only available in Latvian, here.