DPA case Cēsu novada Pašvaldības policijai – Complaint Upheld (Latvia, 2022)

The data subject’s former spouse wished to ask for temporary protection against domestic violence. The spouse informed a police officer that the data subject had been subject to administrative sanctions and restrictive measures imposed by a court. The police officer used a police database to confirm these allegations. In addition, the police officer used the data subject´s identification number to check their criminal record. Finally, the police officer submitted to a court an application for temporary protection against domestic violence on behalf of the data subject´s spouse attaching the criminal record and evidence that the data subject held invalid identity documents. The police officer claimed to have processed personal data with the aim of preventing violence. According to the police, a legal basis for this kind of processing was in principle Article 6(1)(e) GDPR, namely performance of a task carried out in the public interest. However, the police also acknowledged that the police officer exceeded the limits of their functions. In the Latvian DPA’s opinion, the controller was the police as such. The Latvian law establishes in details the content of an application for temporary protection against violence. Even if personal data as the ones at issue may be processed for such a purpose, in this specific case information was obtained, submitted to the court and transferred to all parties involved in the proceeding on the police officer’s own initiative and without previous authorisation by the police. The processing was therefore unlawful and violated Articles 5 and 6 GDPR. The police also violated Article 24(1) GDPR, as it did not establish a procedure for police officers to deal with similar cases. However, as the police officer acted in good faith to protect a natural person´s physical integrity, the DPA issued only a reprimand pursuant to Article 58(2)(b) GDPR.