On 26 August 2019, the Director of the Data State Inspectorate of Latvia (DSI) imposed a financial penalty of 7000 euros against the online retailer, for non-compliance with the General Data Protection Regulation (GDPR), nonconformity with data subjects rights to erasure and non-cooperation with the supervisory authority.
The sanctions were applied to the retailer because the retailer failed to carry out the Controllers duty to execute the data subject request and did not cooperate with the DSI (Retailer did not provide DSI with requested information within the specified time period, nor did the retailer comply with an order issued by the DSI in accordance with GDPR Article 58(2)(c) and (g) and Article 23 of the Personal Data Processing Law).
The DSI initiated an investigation of the complaint about online retailer for non-compliance with the rights of the data subject in accordance with GDPR Article 17 – data subject right to obtain from the controller to erase his personal data without undue delay and the controller in compliance with GDPR have to response to the data subject request and erase personal data without undue delay.
Investigating the case DSI established that in 2018 claimant had repeatedly requested the retailer to delete all his personal data, including the claimants mobile phone number. The retailer did not comply with the data subject’s request to erase the data and continued to process the personal data (including claimants phone number) in question.
When determining the amount of the fine the Director of the DSI took into account the nature, gravity and duration of the infringement, the degree of cooperation with the supervisory authority, the number of data subjects affected, the total annual turnover of the preceding financial year of the retailer (GDPR Article 83(5)(b) and (e)).
The DSI informs that, in accordance with the Latvian Administrative Violations Code Article 288 and 289 the retailer has the right to appeal the decision of the Director of the DSI to the District (City) Court within ten working days from the day of receipt of the decision.
Read the full press release in Latvian here
For further information, please contact the Latvian DPA: firstname.lastname@example.org