DPA case Nacionālajam veselības dienestam – Violation Found (Latvia, 2023)

A Latvian court requested the Latvian National Health Service to share some data concerning a minor. In such an order, the data subject was identified by name and surname and a numerical code, which turned out to be wrong. The National Health Service, the controller, identified a wrong data subject by means of the personal numerical code and disclosed their health data to the court. The Latvian DPA started an investigation against the controller. The DPA pointed out that Latvian law imposes the use of a unique identifier as the safest way to store and process personal data of citizens. This system is the safest and minimises mistakes such as the unlawful disclosure of health data of people other than the one whose data are requested by a public institution – in this case the court. However, the DPA also held that this system, taken alone, was not sufficient to avoid unlawful disclosures. In particular, the National Health Service should have relied on additional criteria, such as name and surname of the data subject - which was already known to them. The need of a double check became apparent in the case at issue, where matching the code with these additional pieces of information would have easily prevented the controller from disclosing sensitive data of another data subject. Therefore, the controller did not put in place technical and organisational measures to minimise risks of unauthorised disclosure and violated Articles 24(1) and 32(1)(b) GDPR. Processing was thus unlawful and infringed Articles 6(1)(a) and (f) and 9(2) GDPR. In light of the above, the DPA held proportionate to order the controller pursuant to Article 58(2)(d) GDPR to adapt its technical and organisational measures, without imposing a fine.