Expert says CSDD data leak victims need not await DVI ruling

People affected by the cyberattack and subsequent data leak at Latvia’s Road Traffic Safety Directorate, known as CSDD, may seek compensation before the Data State Inspectorate, or DVI, completes its investigation, LSM reported, citing Viktorija Soņeca, a researcher at the University of Latvia’s Faculty of Law and an expert in European Union law.

CSDD had previously urged people not to rush their compensation claims and to await the DVI’s conclusions, although some people have already submitted claims to the directorate.

Soņeca said a DVI decision could later provide additional support for a compensation claim, but it is not a mandatory condition for filing one. The DVI investigation and an individual claim for damages are parallel legal avenues. Even if the DVI establishes a violation, that would not automatically lead to compensation being paid.

People should first contact CSDD to establish whether their data were leaked in the incident, what information was involved, how long it had been stored and on what legal basis. They must then assess whether they suffered financial or non-financial harm and whether it can be directly linked to the specific data leak.

The fact that personal data were leaked is not, by itself, enough to obtain compensation, Soņeca said. Claimants must substantiate the specific harm they suffered and the causal link to the incident.

Financial harm could include specific expenses incurred in response to the leak. Non-financial harm could include anxiety and emotional distress, but claimants must also prove the connection to the CSDD incident.

There is no single compensation amount for everyone whose data were leaked, Soņeca said. Each person must describe and prove the harm caused to them with evidence. Compensation could be financial or non-financial, while in some cases another form of redress, such as a public apology, could be considered.

People who believe they have suffered harm linked to the CSDD data leak should first contact CSDD about compensation.