On November 1, 2024, the Data State Inspectorate (DVI) issued guidance addressing when criminal liability arises in cases of unlawful personal data processing. The DVI clarified that it deals with complaints about data processing that do not indicate criminal activities, whereby cases involving criminal offenses fall under the jurisdiction of the State Police.

The DVI explained that criminal liability regarding personal data is triggered if, in addition to the violation of data processing, one of the following conditions is met:

• the illegal action is committed for the purpose of revenge, greed, or blackmail; or
• if the illegal action caused significant damage.

If the above conditions are met, the State Police will then assess the case in light of the provisions of the Criminal Law.

Furthermore, the DVI emphasized that significant damage is considered to be if:

• property damage was caused, which was not less than the total amount of five minimum monthly wages, and other interests protected by law were threatened;
• incurred property damage, which was not less than the total amount of 10 minimum monthly wages; or
• other legally protected interests are significantly threatened.

However, the DVI noted that each case requires an individual assessment to determine if the damage is significant, taking into account the type of threat, its content, the characteristics of the person, and the attitude towards the violated interests.

You can read the press release, only available in Latvian, here.