Latvia

The statute of the Consumer Rights Protection Centre (Patērētāju tiesību aizsardzības centrs) gives the Centre the task of supervising AI systems in products, within its competence, in the areas of the Union harmonisation legislation listed in Annex I of the AI Act. It also gives the Centre the tasks of the single point of contact and the competent authority under the AI Act, in line with its competence and the Act's requirements.

Cabinet Regulation No. 478 of 12 August 2025 added the supervision task for AI systems in products. Cabinet Regulation No. 478 also added the single point of contact and competent authority tasks. Cabinet Regulation No. 478 was published in Latvijas Vēstnesis on 14 August 2025. Cabinet regulations enter into force on the day after promulgation unless the legal act sets another term, so an amending regulation published on 14 August 2025 with no term of its own applied from 15 August 2025.

Article 7 applies the AI use requirements of Regulation (EU) 2024/1689 to the financial market participants named in Articles 4 and 5 and to the savings and loan association named in Article 6(1), point 5, in accordance with Article 2 of the Regulation. Article 8(5) makes the Bank of Latvia (Latvijas Banka) the supervisor of those AI use requirements, in accordance with Article 74(6) of the Regulation.

Article 8(6) requires the Bank of Latvia to give the European Central Bank information obtained in that supervision that could be useful for the prudential supervision of a credit institution. Article 8(7) lets the Bank of Latvia set further requirements on the use of AI, and how they are to be met, in areas that directly applicable EU law does not regulate. Article 11(2), point 1 covers breaches of the prohibited AI practices in Article 5 of the Regulation.

Article 11(2), points 2 to 6 cover breaches of the obligations that Articles 16, 22, 23, 24 and 26 of the Regulation place on providers, authorised representatives, importers, distributors and deployers of high-risk AI systems. Article 11(2), point 10 covers breaches of the transparency duties of providers and deployers in Article 50 of the Regulation. Article 11(2), point 11 covers the duty to give the Bank of Latvia and notified bodies correct, complete and truthful information.

Article 10(3), point 5 lets the Bank of Latvia fine a legal person up to EUR 35,000,000 or up to 7 percent of total annual turnover, whichever is higher, for the breach in Article 11(2), point 1. Article 10(3), point 6 sets a fine for a legal person of up to EUR 15,000,000 or up to 3 percent of total annual turnover, whichever is higher, for the breaches in Article 11(2), points 2 to 10.

Under Article 10(6), a small enterprise, medium enterprise or start-up fined under Article 10(3), points 5 to 7 pays the lower of the two amounts. Article 10(4) lets the Bank of Latvia require the responsible person to stop the activity immediately and, for a natural person, impose a temporary ban on specified duties for up to two years. The Law takes effect on the day after its promulgation. The President promulgated the Law on 30 September 2025, so it took effect on 1 October 2025.

Article 13 of the Ombudsman Law (Tiesībsarga likums) gives the Ombudsman two tasks that concern artificial intelligence systems. Point 15 gives the Ombudsman the task of requesting and accessing the documentation of artificial intelligence systems that a review case needs.

Point 16 gives the Ombudsman the task of submitting to the market surveillance authority, within its competence, a reasoned request to have an artificial intelligence system tested by technical means, where the documentation the review case needs is not sufficient. Points 15 and 16 are in the text of the Ombudsman Law in force on 11 February 2026. Article 13 was amended by the law of 15 January 2026, which took effect on 11 February 2026.

Section 90.1 criminalizes the deliberate production or dissemination of knowingly false, discrediting information about a political organization (party), an association of political organizations, or a candidate for the Saeima, a municipal council, or the European Parliament, using deepfake technology, when committed during the pre-election campaign period or on election day; the maximum penalty is five years' deprivation of liberty, or alternatively short-term deprivation of liberty, probationary supervision, or community service.

Section 90.2 criminalizes the same conduct directed at a candidate for a state office the Saeima elects, appoints, or confirms, when committed during that process, carrying the same maximum penalty. Section 90.2 was added by a separate amending law adopted on 26 September 2024, which took effect on 22 October 2024.

Article 3.1 requires a clear and unambiguous indication where, during the campaign period, paid pre-election campaigning or campaign material uses an AI-generated likeness of a person or an event that does not correspond to reality, in an image, audio or video. Under Article 31.1(1), where a breach of Article 3.1 is found, the head of the Corruption Prevention and Combating Bureau decides to ban the further distribution of that AI-generated campaign material.

Before deciding, the Bureau obtains an expert opinion and assesses the usefulness, enforceability and proportionality of the decision. The decision can be appealed to the administrative district court, and filing the appeal does not suspend it. Article 3.1 is in the wording of the law of 24 October 2024, which took effect on 7 November 2024. Article 31.1 is in the same wording of the law of 24 October 2024.

A controller must notify the Data State Inspectorate (DVI) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Latvia, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Latvia's national supplement to the directly applicable General Data Protection Regulation (GDPR), establishing the Data State Inspectorate (DVI) as supervisory authority with GDPR Article 57-58 powers, national procedure for decisions, disputes and appeals, and data protection officer regulation. Beyond that institutional layer it also makes national choices on substance. Article 25(1) of the Law permits processing where at least one ground in GDPR Article 6(1) applies.

Articles 27 to 32 limit data subject rights in specific settings, such as scientific or historical research under Article 31. The Law has no transfer rules of its own, so the transfer rules of GDPR Chapter V apply directly.

Transferring personal data of a person in Latvia outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

General Data Protection Regulation (GDPR) Article 22 gives a person in Latvia the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Personal Data Processing Law adds no rule of its own on automated decisions.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply directly in Latvia: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller, generally within one month.

The Personal Data Processing Law adds national limits: its Article 27(1) removes the Article 15 access right where disclosure is barred by national-security, defence, public-security or criminal-law rules, or to protect the state's financial interests in tax enforcement, anti-money-laundering and counter-terrorist-financing work, or financial-market supervision. Articles 28 to 32 of the Law also set aside some of these rights in specific settings, such as official publication under Article 28.

The Data State Inspectorate (DVI) holds the General Data Protection Regulation (GDPR) Article 57-58 toolkit, investigative powers, corrective powers, and administrative fine authority up to the Article 83 tiers. DVI has issued fines under this authority: in the five years from 2018 to 2022 they ranged from EUR 200 to EUR 1.2 million and came to almost EUR 1.6 million in total.

For unlawful acts with personal data by a public-law legal person, and for its failure to meet controller or processor duties, Article 38 of the Personal Data Processing Law provides a warning or a fine on the official of up to 200 fine units. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Article 25(2) of the Personal Data Processing Law, confirmed at likumi.lv, restates General Data Protection Regulation (GDPR) Article 9's special-category list and its own biometric-data term mirroring GDPR Article 4(14)'s definition (processing necessary for unique identification). It carries no illustrative list, enumeration, or named example distinguishing facial recognition from voice data or any other biometric modality.

It permits the processing on a ground in GDPR Article 9(2), or where another normative act provides for it under GDPR Article 9(4), and does not narrow or widen the biometric category.

Section 241 makes arbitrary access to the resources of an automated data processing system a crime where it involves breaching the system's protective means, or is carried out without permission, or by using rights granted to another person, and in every case only where it causes substantial harm; the maximum penalty rises from two to four years where the access is for financial gain, and to seven years where committed by an organized group, causing serious consequences, or directed at a system processing state-security-related information.

Section 243 separately criminalizes unauthorized modification, damage, destruction, impairment, or concealment of information in such a system, or knowingly entering false information into it, at penalties up to three years, rising to seven for an organized group or serious consequences.

Section 244 criminalizes the unauthorized manufacture, adaptation, distribution, acquisition, transport, or storage of a tool, device, software, password, or access code intended to influence such a system's resources or to gain access to it for committing a crime, at penalties up to two years, rising to five for an organized group or serious consequences. The current wording of each of these sections took effect on a different day.

Article 21.1 permits reproducing a lawfully accessible work to carry out text and data mining, defined as any automated analytical technique used to analyze text and data digitally to derive information such as patterns, trends, and correlations. Copies made for that purpose may be kept only as long as needed for the mining.

A rights holder can prohibit this use by giving clear notice in an appropriate manner, and a prohibition on the online use of publicly accessible works must be given in machine-readable form, including through metadata. A separate exception at Article 21.2 covers a research organization or a cultural heritage institution mining lawfully accessible works for research purposes, without that opt-out, but Article 21.2(5) excludes computer programs from its scope.

A person or legal entity that has taken the initiative and risk of investment in creating a database, where its creation, verification, or presentation reflects a substantial qualitative or quantitative investment, is recognized as its maker and can prevent extraction, meaning the permanent or temporary transfer of the whole or a substantial part of its content to another medium, and re-utilization, meaning making that content available to the public by distributing, renting, or providing online or other transmission of it.

Repeated and systematic extraction or re-utilization of insubstantial parts is also barred where it conflicts with the database's normal use or unreasonably prejudices the maker's legitimate interests. The right runs fifteen years from the year following completion, restarting on a substantial new investment, and does not reach a lawful user's extraction or re-utilization of an insubstantial part for any purpose, nor extraction for text and data mining permitted under Articles 21.1 and 21.2. The Copyright Law took effect on 11 May 2000. The edition in force from that day already contained Articles 57 to 62.

The Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums (Financial Market Digital Operational Resilience and Use of Artificial Intelligence Law) was adopted by the Saeima on 11 September 2025, published in Latvijas Vēstnesis No. 188 on 30 September 2025 and took effect on 1 October 2025.

Its digital-operational-resilience half applies Regulation (EU) 2022/2554 (DORA) to the 24 classes of financial market participant that Article 4 lists, among them credit institutions, payment institutions, electronic money institutions, investment firms, insurance and reinsurance undertakings, trading venues and crypto-asset service providers.

Article 5 puts the entities that DORA Article 16 covers under the simplified framework, and Article 6(1) takes savings and loan associations, giro settlement institutions, small insurers and small alternative investment fund managers out of DORA while Article 6(3) lets Latvijas Banka set ICT risk-management, information-security and ICT-operations requirements for them.

Article 8 makes Latvijas Banka the supervisor of digital operational resilience under DORA Article 46, gives it the investigatory and sanctioning powers of DORA Article 50(2), and lets it set the methodology for assessing losses from major ICT-related incidents and the way major ICT-related incidents are reported.

A financial market participant covered by Articles 4 and 5 must inform Latvijas Banka of all material changes, including any circumstance that may adversely affect its further operation, and of changes in the information it has given the Bank.

Article 10(1) lets Latvijas Banka issue a warning or fine a legal person up to EUR 5,000,000 or 3 percent of total annual turnover, whichever is higher, and a natural person up to EUR 700,000, for breaching the Regulation (EU) 2022/2554 requirements that Article 11(1) lists. The Law also applies Regulation (EU) 2024/1689 (the AI Act) to the same participants in Article 7 and the provisions that follow it, which is a separate regime from DORA.

The Bank of Latvia's Regulations No. 409 (Latvijas Bankas noteikumi), issued under Article 6(3) of the Financial Market Digital Operational Resilience and Use of Artificial Intelligence Law, set ICT risk-management, information-security, ICT-operations and business-continuity requirements for the financial market participants that Regulation (EU) 2022/2554 (DORA) does not cover.

The regulations were adopted on 5 January 2026, published in Latvijas Vēstnesis No. 3 on 7 January 2026 and took effect on 15 January 2026.

They apply to small alternative investment fund managers, small insurers and reinsurers, micro, small and medium-sized insurance intermediaries, the persons in points 2, 3, 4, 6, 7, 9, 12, 13, 15 and 16 of Article 101(7) of the Financial Instrument Market Law, savings and loan associations, small private pension funds with no more than 15 plan members and giro settlement institutions.

A participant must put in place and document an ICT risk-management and control framework for which its management bears overall responsibility, and must draw up, document and implement an information security policy that protects the confidentiality, integrity and availability of data and services. A participant must carry out and document an ICT risk assessment at least once a year.

Cabinet Regulation No. 397 of 25 June 2025, Minimālās kiberdrošības prasības (Minimum Cybersecurity Requirements), sets the minimum cybersecurity requirements for an essential service provider, an important service provider and an owner or lawful possessor of ICT critical infrastructure under the National Cybersecurity Law. The regulation was adopted on 25 June 2025, published in Latvijas Vēstnesis No. 123 on 1 July 2025 and took effect on 2 July 2025.

Article 8 of the Electronic Communications Law has the Cabinet set the security requirements for public electronic communications networks and the equipment, software and outsourced services used in them, and point 1.6 of this regulation does so. It requires a subject to keep a set of cybersecurity governance documents made up of a cybersecurity policy, a catalogue of ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log.

The subject must review the cybersecurity policy at least once in three years, and must update the ICT-resource catalogue within one month of a change.

The subject must give each information system a confidentiality, integrity and availability security class of A, B or C. The cyber-risk-management and ICT-business-continuity plan must be reviewed and updated at least once a year by an essential service provider that holds a class A system and by an ICT critical infrastructure owner, at least once in two years by another essential service provider, and at least once in three years by an important service provider.

A subject must record each cyber incident in its incident log within 24 hours of detecting it. A subject must report a significant cyber incident to the competent cyber incident prevention institution on electronically signed early warning, initial report, progress report, intermediate report and final report forms, within the clocks of Article 34 of the Law.

A subject must give the staff and officials who use its systems an initial cybersecurity briefing within one month of their user account being registered and a routine briefing at least once a calendar year.

An owner or lawful possessor of ICT critical infrastructure may contract for the purchase of technical resources for a class A information system only if the supplier and the manufacturer meet the conditions of point 94, which for a legal person include registration in a NATO, EU or EFTA member state or a NATO Indo-Pacific partner state.

For a public electronic communications network that was in operation or being built when the regulation took effect, the supplier conditions of point 102 apply from 1 January 2030. The technical risk-management requirements apply to a DNS, cloud-computing, data-centre, content-delivery-network, managed-service, online-marketplace, online-search-engine, social-network or trust-service provider only so far as they do not conflict with Commission Implementing Regulation (EU) 2024/2690.

The regulation repealed Cabinet Regulation No. 94 of 28 February 2023 on security requirements for public electronic communications networks.

Article 27 requires a subject (an essential service provider under Article 20, an important service provider under Article 21, or an owner or lawful possessor of ICT critical infrastructure) to take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems it uses, and to prevent or minimise the impact of a cyber incident on its service recipients and on other services.

Article 21(1)(2)(l)-(n) names an online marketplace, an online search engine and a social media platform provider expressly among the medium-or-large digital providers this duty reaches as important entities.

Article 28 additionally requires the subject to draft a cyber-risk-management and ICT-business-continuity plan and to train staff on it, with the plan's required content set by the Cabinet under Article 28(2) and the minimum cybersecurity requirements the subject's systems must meet set by Cabinet Regulation No. 397 of 25 June 2025; Article 25 requires the subject's head to appoint a cybersecurity manager (kiberdrošības pārvaldnieks) within three months of the subject's status notification or of the National Cybersecurity Centre's decision on its status under Article 22(5), and Article 26.1, inserted by the law of 4 June 2026, bars a person convicted of a listed intentional crime from holding privileged access to the subject's ICT systems unless rehabilitated or cleared, and requires the subject to decide individually on employing such a person.

Article 3(3) applies the Law to a financial entity covered by Regulation (EU) 2022/2554 (DORA) that is an essential service provider only insofar as that Regulation or other law sets no other requirements on cybersecurity, risk management, incident reporting and supervision. Article 3(4) disapplies the Law's requirements, including supervision, for a subject covered by an equivalent sector-specific EU regime, to the extent that regime's requirements are at least equivalent in effect.

The law of 4 June 2026 amending the National Cybersecurity Law was adopted by the Saeima on 4 June 2026, promulgated on 17 June 2026 and took effect the day after promulgation, 18 June 2026. Transitional provision 15 sets 1 October 2026 as the day its amendment of Article 20(11), which adds a company, foundation or association significant to national security, takes effect.

Article 39 requires any person who discovers a vulnerability in a subject's information system or electronic communications network to report it to the competent cyber incident prevention institution within five working days, and lets that person report anonymously and have their identity kept confidential.

Once the institution has assessed a report as substantiated and relayed it, Article 40 requires the affected subject to take the actions necessary to remediate the vulnerability within the institution's own deadline, capped at 90 days from receiving the information and extendable to 180 days on the subject's request for objective reasons, reporting progress to the institution as it goes. This is a subject-facing remediation clock rather than only a state-run coordination function.

Article 46(5), however, defines a fine-triggering 'material non-compliance' with a closed three-item list (failing to take appropriate measures, repeatedly refusing supervisory information requests, and a late or false significant-incident notification) that does not name a missed Article 40 deadline, so whether that specific failure draws the Article 46 fine, rather than only the non-monetary corrective and suspension powers Article 45 gives generally, is not settled by the text and is recorded as an open question here rather than as a penalty figure.

Article 34 requires a subject to notify the competent cyber incident prevention institution immediately of any cyber incident and to follow its instructions.

For a significant cyber incident, the subject must submit an early warning within 24 hours of becoming aware, an initial report within 72 hours (24 hours for a trust service provider), and, within one month of the initial report, a final report (or, if unresolved, a progress report followed by a final report once resolved); where relevant, the subject must also inform affected service recipients of protective measures and, after coordinating with the institution, of the incident itself.

This is NIS2 Article 23's own clock. Although the Law commenced 1 September 2024, its transitional provisions delayed Article 34's paragraphs two through five, the notification clock itself, until 1 July 2025.

For most private-sector and civilian public-sector subjects the competent cyber incident prevention institution is the Institute of Mathematics and Computer Science of the University of Latvia, and the Military Intelligence and Security Service holds the same role for the Ministry of Defence, its subordinate bodies and the National Armed Forces. A missed or knowingly false notification is one of Article 46(5)'s three enumerated grounds for a material non-compliance fine.

Article 9(1) of the Information Society Services Law bans using automatic calling systems that work without human participation, electronic mail or fax machines, through which individual contact with the recipient is possible, to send a commercial notice unless the recipient has given free and unambiguous consent beforehand.

Article 9(2) lets a service provider that obtained recipients' e-mail addresses in its commercial transactions use them for further commercial notices about its similar goods or services if the recipient did not object at the outset and every later notice gives a clear free-of-charge chance to refuse further use of the address.

Article 9(3) allows other communication through publicly available electronic communications services to send a commercial notice if the recipient has given free and unambiguous consent beforehand, apart from the cases in paragraphs 1 and 2.

Article 9(4) bans sending a commercial notice by electronic mail or other communication through publicly available electronic communications services with an invalid e-mail address, or an invalid telephone or fax number to which the recipient could send a request to stop the communication, or disregarding the recipient's refusal of further notices. Article 9(5) treats each prohibited commercial notice sent as a separate violation.

Article 9(6) applies the bans and restrictions in paragraphs 1, 2 and 3 to commercial notices sent to natural persons.

Article 8(1) requires a commercial notice to meet the general requirements of the Advertising Law, to be clearly recognizable as a commercial notice, to make clear the person on whose behalf it is distributed, to state the offer and the terms of receiving the service precisely, to make discounts, bonuses and prizes and the terms of receiving them clear, to make promotional contests, lotteries and games and their participation terms clear and easy to find, and to give the recipient the chance to refuse further commercial notices.

Article 13(6) obliges the supervisory authority to check compliance with article 9 where one recipient has received at least 10 commercial notices from one provider within a year and has complained to the authority. Article 12(1) has the Consumer Rights Protection Centre (Patērētāju tiesību aizsardzības centrs), the State Data Inspectorate (Datu valsts inspekcija) and other supervisory and control authorities supervise the circulation of information society services within their competence.

Article 13(1) lets a supervisory authority that finds a violation of the Law require the information needed and order the service provider to end the violation or take specific action to remedy it, within a time limit it sets. Article 9 is in the wording of the law of 10 November 2005, as amended by the law of 12 June 2009, which took effect on 1 July 2009. The law of 10 November 2005 took effect on 14 December 2005.

Article 7.1(1) of the Information Society Services Law (Informācijas sabiedrības pakalpojumu likums) allows storing information in a subscriber's or user's terminal equipment, or gaining access to information stored there, only where the subscriber or user has consented after receiving clear and comprehensive information about the purpose of that processing, in accordance with the personal data protection law the provision names.

Article 7.1(2) removes the need for that consent where storing or accessing the information is necessary to ensure the circulation of information in an electronic communications network, or for an intermediary service provider to supply the service the subscriber or user requested. Article 7.1 is in the wording of the law of 19 May 2011, as amended by the law of 23 May 2024, which took effect on 21 June 2024. The law of 19 May 2011 took effect on 8 June 2011.

Article 12(1) has the Consumer Rights Protection Centre (Patērētāju tiesību aizsardzības centrs), the State Data Inspectorate (Datu valsts inspekcija) and other supervisory and control authorities supervise the circulation of information society services within their competence.

Article 13(1) lets a supervisory authority that finds a violation of the Law require the information needed and order the service provider to end the violation or take specific action to remedy it, within a time limit it sets.

Article 94(1) of the Electronic Communications Law (Elektronisko sakaru likums) obliges an electronic communications merchant not to disclose, without the end user's consent, information about the end user or about the electronic communications or value-added services the end user has received, except where the institutions and authorities the Law names need the information for the functions that law sets and for the purposes it sets.

Article 94(2) prohibits an electronic communications merchant from disclosing, without the end user's consent, information that is transmitted or has been transmitted in providing electronic communications services to the end user, except where the authorities the Law names need it for the functions that law sets and for the purposes it sets. The Law was adopted on 14 July 2022 and took effect on 29 July 2022.

Article 56.1(1) of the Copyright Act defines an online content-sharing service provider as an information society service provider whose main purpose, or one of whose main purposes, is to store and give the public access to a large number of works or related-rights subject matter uploaded by its users, which it organizes and promotes for profit. Article 56.2(1) requires the provider to obtain the rights holder's authorization for giving the public access to a work uploaded by a user.

Article 56.2(3) makes the provider liable for infringement without authorization unless it proves it made its utmost efforts to obtain authorization, made its utmost efforts to keep unavailable works for which rights holders supplied relevant and necessary information, and acted at once on a substantiated notice to disable access or remove the work and prevent re-upload.

Article 56.2(5) bars the provider from denying access to user uploads whose use does not infringe copyright, including works used under the limitations on economic rights. Article 56.2(7) states that the rules of the article create no general monitoring duty for the provider.

Article 56.3 lets a new provider that has been available in the European Union for under three years with annual turnover under EUR 10 million show only its utmost efforts to obtain authorization and prompt action on a substantiated notice, and adds the duty to prevent re-upload once its average monthly unique visitors exceed five million.

Article 56.4 requires the provider to set an effective and quick procedure to handle users' complaints about disabled access or removal at once and free of charge, with a person reviewing the decision to disable access or remove a work. Article 56.5 requires the provider to give rights holders on request information about its cooperation measures and about the use of works under licences, and to tell users in its terms of service about their options to use works under the limitations on rights.

Article 71.1 of the Copyright Act has the National Electronic Mass Media Council, acting as supervisory authority under the Information Society Services Act, protect rights holders online, including by restricting access to websites that make works public without the rights holder's consent.

Article 71.4(1) requires the Council, after receiving a rights holder's application, to ask the content provider or hosting service provider to submit within seven days documents proving its right to make the works public on the website. Article 71.4(3) has the Council decide that the content provider or hosting service provider must stop making the works public within seven days if it does not stop, does not submit the documents, or cannot be reached.

Article 71.5(1) lets the Council decide to restrict access to a website in Latvia if the unlawful publication has not stopped and no documents proving the right to publish were submitted in time, and it finds that the website obviously infringes copyright or related rights. Article 71.6 allows an appeal against the Council's decisions to the Administrative District Court, and the appeal does not suspend them.

Article 20(1) of the Information Society Services Act provides a warning or a fine for a hosting service provider that fails to restore content or access to it at once under Article 4(7) of Regulation (EU) 2021/784 where restoration is no longer possible, up to 300 fine units for a natural person and up to 3,000 for a legal person.

Article 20(2) provides a warning or a fine up to 400 fine units for a natural person and up to 4,000 for a legal person for not preserving removed or disabled terrorist content and related data for the period set in Article 6 of the Regulation. Article 20(3) applies the same penalties for failing to maintain the technical and organizational safeguards Article 6 of the Regulation requires for preserved content and data.

Article 20(4) applies the same penalties for failing, or failing in good time, to give an investigating authority, a prosecutor, a contact point or Europol the information on terrorist content linked to an imminent threat to life that Article 14(5) of the Regulation requires.

Article 20(5) provides a fine of up to 4 percent of the hosting service provider's total turnover in the previous business year for systematically or persistently failing to remove terrorist content or disable access to it in all Member States within the set time. Article 21 has the State Police conduct administrative violation proceedings for the violations in Article 20.

Article 19.1(1) of the Information Society Services Act makes the Consumer Rights Protection Centre (Patērētāju tiesību aizsardzības centrs) the competent authority under Article 49(1) of the Digital Services Act and the digital services coordinator under Article 49(2). Article 19.1(2) subjects the coordinator to the independence requirements of Article 50 of the Digital Services Act and has it decide independently.

Article 19.2(1) has the Centre perform all the coordinator's tasks and supervise intermediary service providers' compliance with the duties in sections 1 to 4 of Chapter III of the Digital Services Act, unless the European Commission has started proceedings for the same breach against a very large online platform or search engine. Article 19.3(1) lets the coordinator carry out inspections under Article 51(1)(b) of the Digital Services Act without a court's permission.

Article 19.4(1) lets the coordinator propose that a provider ensure compliance by a set deadline or give a written commitment to end the breach. Article 19.4(2) requires the provider to tell the coordinator, at once and within three working days of the end of the deadline, that it has acted on the proposal, with supporting evidence.

Article 19.4(3) lets the coordinator, on finding a breach, order the provider to end it at once or within a set time and impose a fine and a periodic penalty payment. Article 19.5(1) and (2) let the provider give a written commitment to remedy the breach within a set period of no more than three months, unless the nature of the measures justifies a longer one, and the commitment takes effect when the coordinator confirms it.

Article 19.6(1) lets the coordinator fine a provider for breach of the Digital Services Act up to 6 percent of its annual worldwide turnover in the previous financial year, and impose a periodic penalty payment of up to 5 percent of average daily turnover or income for each day. Article 19.6(2) lets the coordinator fine up to 1 percent of annual worldwide turnover for supplying incorrect, incomplete or misleading information, failing to answer or correct it, and refusing an inspection.

Article 19.7(1) lets the coordinator, where recipients may suffer serious harm and urgent action is needed, adopt the decision to end the breach as an interim measure. Article 19.8(1) allows an appeal against the coordinator's decision to the Administrative District Court, which does not suspend the decision except for fines and periodic penalty payments.

The Act of 23 May 2024, in force from 21 June 2024, removed Chapter IV of the Information Society Services Act, with Articles 10 and 11 on the liability and duties of intermediary service providers.

The Act "Par atbildību par preces un pakalpojuma trūkumiem" (Liability for Defects in Goods and Services) includes, according to its informative reference, legal norms that derive from Directives 85/374/EEC and 1999/34/EC. Section 1 regulates liability for damage done to a person's life, health or property by defects in goods or services. Section 2 leaves untouched the injured person's right to claim compensation under other laws.

Section 3(1) applies the Act to any movable corporeal thing, including one that is part of another movable or immovable thing, and to electricity and gas. Section 3(2) applies the Act to services whose result is that the provider makes a new corporeal thing or improves or alters an existing one or its properties, and to services that have a direct or indirect effect on a person's life or health.

Section 5(1) makes the producer of the goods or the provider of the service liable to compensate the injured person for the damage that defects cause to life, health or property. Section 5(2) makes the producer or service provider liable also where the person bought the goods from a distributor. Section 5(3) forbids reducing or excluding in advance the liability of the producer or service provider for damage to life, health or property. Section 5(4) makes an agreement contrary to section 5 void.

Section 6(1) defines the producer as a natural or legal person who makes the goods or a component, or presents itself as the producer by putting its name, trade mark or another distinguishing mark on the goods, their packaging or their technical documentation. Section 6(2) treats a person who imports goods in the course of its business to put them into circulation in the European Union (the importer) as equal to the producer for liability.

Section 6(3) makes the distributor or any other person who sold or distributed the goods liable where the producer or importer cannot be identified, unless that person gave timely information on the producer, the importer or its own supplier. Section 7(1) treats goods as defective if the safety that a person is entitled to expect is not guaranteed, taking all circumstances into account.

Section 7(2) treats a service as defective if the safety that a person is entitled to expect from it is not guaranteed, taking all circumstances into account. Section 9 makes two or more persons liable for the same damage jointly and severally. Section 10 determines compensation for damage to life or health under the Civil Law.

Section 11(1) allows a claim for damage to property only if another thing than the defective one was damaged, that thing is intended for personal use or consumption and the injured person used it that way, and the damage exceeded 500 euro when it was done. Section 11(2) puts on the injured person the burden of proving the damage, the defect and the causal link between them.

Section 12 allows the producer or service provider to be freed from liability in full or in part where both the defect and the fault of the injured person or another person caused the damage. Section 13(1) frees the producer from liability if it proves that it did not put the goods into circulation. Section 13(1) also frees the producer if it proves that there is reason to believe the defect arose after the goods were put into circulation.

Section 13(1) also frees the producer if it proves that the goods were not made for sale or other distribution for profit, nor made or distributed in the course of business. Section 13(1) also frees the producer if it proves that the state of science and technology when the goods were put into circulation was not advanced enough to allow the defect to be discovered.

Section 13(1) also frees the producer if it proves that the defect arose because the producer complied with requirements set by the State or a municipality. Section 13(3) frees the maker of a component if it proves that the defect is linked to the design of the thing the component was built into or to the instructions of the producer or service provider.

Section 14(1) requires a claim for compensation to be brought within three years from the day the injured person learned, or had reason to know, of the defect, the damage and the person liable to compensate. Section 14(2) bars a claim once ten years have passed from the day the producer put the goods into circulation or the provider gave the service. The Act was adopted by the Saeima on 20 June 2000 and entered into force on 19 July 2000.

Article 24(9) bans distributing audio and audiovisual works depicting physical or psychological violence, bloody or horror scenes, drug use or sexual acts, or containing coarse or indecent language, between 7:00 and 22:00.

Article 24(10) requires an electronic mass medium not observing that watershed for content that could harm a minor's physical, mental, or moral development to instead provide restricted access control, preceded by an acoustic warning signal and marked with a visual symbol describing the content's potentially harmful nature. Article 23(4) imposes the equivalent restricted-access-control duty on an on-demand catalogue offering such content.

Article 24(10.1) bars commercial use of a minor's personal data obtained through that access control, except where necessary to provide the service itself with the data subject's consent.

In the Electronic Mass Media Law, a video-sharing platform service is a service or separable part of one that carries no editorial responsibility, whose essential functionality is mainly to offer the general public programmes and user-generated videos, and whose organization the provider determines, including by automatic means or algorithms.

A video-sharing platform provider must take appropriate measures to protect the public from content and user-generated video or audio commercial communications that could harm minors' physical, mental, or moral development, that could incite violence or hatred, or that constitute a listed criminal offence.

It must publish its own publicly accessible code of conduct addressing commercial communications aimed at or capable of negatively affecting the psychological or physical development of minors, including in children's programming.

A press publisher holds an exclusive right to reproduce and make available online its press publications, defined as a journalistic compilation published under one title in a periodical or regularly updated edition, exercised against an information-society service provider. The right does not reach private or non-commercial use, hyperlinks, or the use of single words or very short extracts.

It cannot be invoked to prohibit use of works the publisher included under a simple licence, or whose copyright or related-rights term has expired, and runs for two years after the press publication is made public. An author whose work is included in a press publication has a right to a proportionate share of the revenue the publisher earns from this online use.

Article 21.1 permits reproducing a lawfully accessible work, including a press publication or its fragments, to carry out text and data mining. Copies made for that purpose may be kept only as long as needed for the mining. A rights holder, including a press publisher, can prohibit this use by giving clear notice in an appropriate manner.

A prohibition on the online use of publicly accessible works must be given in machine-readable form, including through metadata, which is the opt-out an aggregator's automated indexing must honor. A separate exception at Article 21.2 covers a research organization or a cultural heritage institution mining lawfully accessible works for scientific research, without that opt-out.