Duty LXD-0969
Processes personal data, in Latvia
Law on the Rights of Patients (Pacientu tiesību likums), research use of patient datasince 2 lines
Pacientu tiesību likums, s. 10(7) and s. 11(7) · Read the law's page
- Use patient data recorded in medical documents in research only if the information to be analysed cannot directly or indirectly identify the patient, or the patient has agreed in writing to the use of the information in that specific study (Patients' Rights Law s. 10(7)).
- Use information gained about a patient in a clinical study only with the consent of the patient, or of the person who consented to the patient's involvement, and only while the patient's anonymity is guaranteed (s. 11(7)).
Statistics Law (Statistikas likums), anonymisation and non-identifying release of statistical datasince 3 lines
Statistikas likums, s. 17(5), s. 19(1), s. 26(1) and s. 28(5) · Read the law's page
- The statistics authority must anonymise personal data obtained for official statistics immediately after obtaining, checking and linking them, unless they are still needed for official statistics, and must store identifying data separately and securely from other data (Statistics Law s. 17(5)).
- The statistics authority must release official statistics in a form that does not allow a private person or state institution to be identified directly or indirectly, except in the cases in section 25 (s. 19(1)).
- The statistics authority must give access for research work only to indirectly identifiable data that it can protect with suitable disclosure control methods (s. 26(1)), and must refuse access where the requester does not ensure suitable protection and disclosure control of those data (s. 28(5)).
GDPR Articles 12-21, Data Subject Rights as Applied in Latviasince 1 line
Regulation (EU) 2016/679, Arts. 12-21; Fizisko personu datu apstrādes likums, Art. 27(1) · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Latvia within one month of receipt.
GDPR Articles 33-34, Breach Notification in Latviasince 3 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the Data State Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Latvia, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
GDPR Chapter V, Cross-Border Transfer of Personal Data from Latviasince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Latvia outside the European Economic Area.
GDPR Articles 82-83 and DVI Enforcement in Latviasince 1 line
Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Personal Data Processing Law (Fizisko personu datu apstrādes likums)since 1 line
Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Latvia, including data collected by crawling.