Lawyer on CSDD data leak: sanctions needed, outdated rules must be reviewed

The publicly reported data leak at Latvia's Road Traffic Safety Directorate (CSDD) has raised questions not only about how people perceive their personal data ending up outside the agency, but also, according to sworn attorney Saulvedis Vārpiņš, about accountability and compliance with the law. He made the remarks on the TV24 programme “Naudas cena”.

Vārpiņš said such a situation should not go without sanctions, arguing that people need to be trained to follow the law, and this cannot be achieved through appeals alone — clear rules and order are required.

Why was the data kept so long?

The attorney said some questions about possible violations linked to CSDD cannot simply be dismissed as negligence. He said a particularly important question is why the data was stored for so long — reports have mentioned a period of around 18 years. Currently the storage period is set by Cabinet of Ministers regulations, but Vārpiņš said it must be assessed why such regulations still exist given that the General Data Protection Regulation requires a clear justification for how long data is retained.

He added that if data protection rules require that personal data storage be justified, then the compliance of the underlying legal acts themselves must also be assessed. He noted that this issue has already been discussed with CSDD, and the agency is currently working on amendments.

A broader regulatory problem

Vārpiņš stressed that the issue is not limited to a single case — the state should regularly review existing regulations rather than only adopting new ones. He said that in some countries, when new rules are adopted, authorities also go through a list of regulations that should be repealed. According to him, if regulation keeps growing without such review, bureaucracy only increases.