The European Parliament and Council Regulation (EU) 2016/679 on the protection of persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), application of which is commenced on 25 May 2018, stipulates new measures for the Competition Council of Latvia (hereinafter – the CC) as the data controller, which processes personal data during its activities, as well as rights of data subjects.
Definitions and concepts of the General Data Protection Regulation:
Data controller – a public authority, which determines the purposes and means of data processing. Personal data – information, which refers to an identified or identifiable person. Data processing – set of activities, implemented by the data controller with personal data (acquisition, structuring, storage, sending, disposal etc.). Data pseudonymization - data processing, as a result of which personal data cannot be linked to a specific data subject anymore.
While processing personal data, the CC observes binding basic principles of data processing – lawfulness, integrity, transparency, purpose restriction, data minimization, precision, storage restriction, confidentiality, accountability. Appropriate physical, technical and administrative procedures are applied, which ensure security of personal data held by the authority.
1. Who is the data controller?
Brīvības Street 55, Riga, LV-1010
phone: 67282865, fax 67242141
2. What data is processed?
Personal data is information on a person, which allows to identify this person. In the framework of its activities, the CC processes data of persons (job applicants for a position in the authority, representatives, officials and employees of market participants, third parties involved in administrative cases, cooperation partners and employees of the CC). The CC processes the following categories of personal data - name, surname, personal identity number, birth data, address, contact information, education, incl. certificates and courses, language proficiency, workplace, held position etc.
3. For what purposes and on what basis personal data is processed?
In accordance with the State Administration Structure Law, the CC is granted the competence in the state administration, is assigned the required resources and has its own staff. Considering the aforesaid, the CC has determined appropriate purposes of data processing for implementation of its respective legal interests.
According to the objective stipulated in section 2 of the Competition Law (hereinafter – the CL), the CC ensures free, fair and equal competition in the public interests. For achieving this objective, the CC fulfils the tasks specified in section 6 of the CL and exercises the rights granted under section 7 of the CL, investigating infringements of the CL, the Advertising Law and the Unfair Retail Trade Practices Prohibition Law (URTPPL). To ensure efficient application of the law by conducting investigation of initiated cases, detection of infringements and holding the infringers liable, the CC, exercising the investigation powers stipulated in section 9(5) of the CL and cooperating with other authorities, can obtain a set of information containing personal data, which is significant for proving an infringement.
The CC processes personal data, ensuring recruitment of persons or organizing internship for these persons. Upon applying for announced vacancies, the CC requests the applicant's consent for processing of data provided in the applicant's CV and application letter. If a candidate has indicated contact information of feedback provider, the CC processes this information. Processing of data during the selection procedure is required to assess conformity of each candidate to the vacancy.
The CC concludes agreements with persons for ensuring its economically - administrative activity and procurement of required services. The CC also processes personal data to supervise performance of such agreements and make respective payments.
While exercising the function of public information, the CC processes personal data upon consent received from the data subject.
All personal data is applied the status of restricted access information (hereinafter – RAI) and it can be accessed and processed only for the appropriate purpose or objective by authorised officials of the CC, for example, officials who require such information for investigation under the CL or decision-making while selecting an applicant for a vacancy. Technical and organizational measures implemented by the CC, as well as the established RAI policy ensures secure processing of received data, including its accumulation, storage and confidentiality, preventing unauthorized obtaining of this information by third parties. In the published versions of decisions adopted by the CC according to the CL, names and surnames of persons are pseudonymized, replacing this data with randomly selected combinations of letters.
4. For how long the data processed according to the CL is stored?
Specific personal data is stored by the CC only as far as it is necessary for implementation of specific data processing purposes.
The personal data (incl. electronic data) obtained during investigation activities (in inspections) is processed until the legal basis stipulated by the CL for processing (incl. storage of data) ceases, and this data is destroyed after coming into final force of decision adopted by the decision-making body of the CC, unless there is any legal basis for further storage of this data, for example, a claim on compensation of damage caused as a result of infringement of CL or an application to the European Court of Human Rights (ECHR) against Latvia concerning an alleged infringement of human rights.
Personal data of job applicants is stored for a period not exceeding 3 months after the end of competition. The CC as the employer stores applicant's data, if it is necessary for protection of lawful rights of the CC, for example, in the case of challenging the selection process.
Personal data that is related to ensuring of the economic activity of the CC is processed until fulfilment of the agreement and is stored for archiving purposes for 10 years after expiration of the agreement period.
5. What are the rights of data subject during processing of obtained personal data according to the CL?
When the CC obtains voluminous information (incl. personal data) while conducting the procedural activities mentioned in section 9(5) of the CL, the market participant, its representative and employee is informed about the rights to identify and request the CC to separate personal data that does not refer to the case, for example, data that contains correspondence with a lawyer or qualifies as private correspondence, which does not contain any evidence for detection of infringement. The CC does not perform further accumulation and analysis of this data and ensures deletion of this data at the request of the data subject, if this data does not affect integrity of other evidence.
According to sections 26(6) and (7) of the CL, during the course of the final stage of case investigation (when the CC has already made a notice on facts obtained for decision-making), the CC acquaints the process participants (incl. third parties within the meaning of section 28 of the Administrative Procedure Law (APL)) with the case materials that concern them. In this case restricted access information of one person is not disclosed to another person (participant of administrative process).
Participants of administrative process are also entitled to inform the CC on any changes to, for example, their contact information, requesting the CC to ensure further communication, using the updated contact information.
While ensuring publicity of activities of the CC, employees of the authority make photos and shoot videos at events organized by the CC (for example, conferences, seminars, lectures, meeting) only upon consent of the data subject. The CC respects any request by the data subject, not to take photos or shoot videos of him or her, and not to publish his or her images.
The CC examines each application or complaint of data subject concerning the rights granted to the data subject in the General Data Protection Regulation, observing the principle of proportionality, implements any possible measures to ensure the rights of the data subject and responds adequately to the application.
6. Who personal data is disclosed to?
Data transfer to third parties takes place according to the law or any other legal basis. According to the obligation imposed by regulatory enactments on state administration authority, the CC is entitled to disclose and transfer personal data to other authorities of the Republic of Latvia and authorities abroad without receiving consent of the data subject, for example, to courts, state administration authorities (the State Control, the Ministry of Finance, the SRS, the CPCB, the Data State Inspectorate, banks etc.). According to provisions of the CL, the existing personal data can be transferred by the CC to competition protection institutions of other EU Member States, the European Commission, the ECHR etc.).
7. How to ask a question concerning data processing?
If the data subject (person) has any questions, proposals or suggestions in relation to processing and protection of personal data carried out by the CC, the data subject may ask a question to the CC by sending an e-mail to firstname.lastname@example.org with an indication To the Data Protection Specialist.
The data subject shall indicate own name, surname, address or e-mail address for receiving a response and for further communication.
8. How to submit a complaint on inappropriate data processing?
If a data subject has any questions or complaints in relation to processing of its personal data, which is carried out by the CC, the data subject shall report the CC. If the problem cannot be solved within the CC, the data subject is entitled to submit an application or complaint to the Data State Inspectorate (DSI), which is a competent authority in the area of data processing.
9. Does a data subject have to submit data to the CC for application of the CL and what are consequences of refusal to provide such data?
An obligation to provide information to the CC, incl. personal data, is stated in section 9(5) of the CL, whereas section 94 of the CL stipulates sanctions for refusal to provide information – a fine from 50 to 1,400 euros (for persons).