Latvia

Private individual

300 €

GDPR enforcement action by Data State Inspectorate (DSI) on 2026-09-03.

Rank · Sector

#341

of 369 in Individuals and Private Associations

Rank · Latvia

#11

of 11

Rank · All fines

#3,218

of 3,275

Case details

Authority: Data State Inspectorate (DSI)
Date: 2026-09-03
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Latvian DPA has imposed a fine of EUR 300 on a private individual. The individual who was fined is a pharmacy assistant and therefore had access to the national e-health system. They used this access to view the patient records and prescriptions of three data subjects on about 40 occasions. This access took place between August 2025 to March 2026. For two of the data subjects, the individual was asked by a parent to help obtain pharmaceuticals; the investigation was therefore terminated in relation to these individuals. However, regarding the third data subject, no legal basis for accessing the records could be found.

Open original source Links to the regulator's original publication or another source.