When processing personal data, the Competition Council (hereinafter – CC), as a manager, complies with the law and existing regulations in the Republic of Latvia, the European Parliament and Council Regulation (EU) 2016/679 on the protection of persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – Regulation), and other regulatory enactments in the field of privacy and personal data processing.
When processing personal data, the Competition Council observes the basic principles of data processing that are binding on it - legality, integrity, transparency, purpose limitation, data minimization, accuracy, storage restriction, confidentiality, and accountability. Appropriate physical, technical and administrative procedures are applied to the processing of data, which ensures the security of personal data held by the institution.
The CC respects Your privacy and undertakes to protect it according to this Privacy Policy. Ensuring transparency during the data processing, hereinafter the information on purposes, legal basis of data processing, and the processed data is described below.
Who is the data controller?
Competition Council
Brīvības Street 55, Riga, LV-1010
phone: 67282865, fax 67242141
e-mail: pasts@kp.gov.lv
What data is processed?
Personal data is information on a person, which allows to identify this person. In the framework of its activities, the Competition Council processes data of persons (job applicants for a position in the authority, representatives, officials, and employees of market participants, third parties involved in administrative cases, cooperation partners and employees of the CC). The CC processes the following categories of personal data - name, surname, personal identity number, birth data, address, contact information, education, including certificates and courses, language proficiency, workplace, held position, trade union membership, country of residence, citizenship, voice recordings etc.
For what purposes and on what basis personal data is processed?
In accordance with the State Administration Structure Law, the CC is granted the competence in the state administration, is assigned the required resources, and has its own staff. Considering the aforesaid, the CC has determined appropriate purposes of data processing for implementation of its respective legal interests.
According to the objective stipulated in section 2 of the Competition Law (hereinafter – the CL), the CC ensures free, fair, and equal competition in the public interests. For achieving this objective, the CC fulfils the tasks specified in section 6 of the CL and exercises the rights granted under section 7 of the CL, investigating infringements of the CL, the Advertising Law, and the Unfair Retail Trade Practices Prohibition Law (URTPPL). To ensure efficient application of the law by conducting investigation of initiated cases, detection of infringements and holding the infringers liable, the Competition Council, exercising the investigation powers stipulated in section 9 (5) of the CL and cooperating with other authorities, can obtain a set of information containing personal data, which is significant for proving an infringement. The legal basis is Article 6 (1) subparagraph (c) of the Regulation (processing is necessary for the performance of a legal obligation incumbent on the controller) and subparagraph (e) (performance of public administration tasks in the public interest or in the exercise of official authority legally conferred on the controller). An audio recording may be made to record oral explanations and attached to the minutes of the negotiations (Article 6 (1) (e) subparagraph of the Regulation).
The Competition Council processes personal data, ensuring recruitment of persons or organizing internship for these persons. Upon applying for announced vacancies, the Competition Council requests the applicant's consent for processing of data provided by the applicant (Article 6 (1) (a) of the Regulation). Processing of data during the selection procedure is required to assess conformity of each candidate to the vacancy. The processing of your personal data as a tenderer is required to fulfil a legal obligation of the Competition Council (Article 6 (1) (c) of the Regulation). When organizing and conducting negotiations, the Competition Council may make an audio recording to record the legal course of the proceedings (Article 6 (1) (f) of the Regulation). If a candidate has indicated contact information of feedback provider, the CC processes this information, the Competition Council shall process it in accordance with the legal basis specified in Article 6 (1) (a) of the Regulation.
The Competition Council concludes agreements with persons for ensuring its economically - administrative activity and procurement of required services. The Competition Council also processes personal data to supervise performance of such agreements and make respective payments (Article 6 (1) (b) of the Regulation).
The Competition Council, ensuring the observance of the principle of good governance, ensures that the public is regularly informed about the activities and development of the institution and advised and educated in the field of application of regulatory enactments related to the activities of the Competition Council. Therefore, in accordance with the principles specified in the State Administration Structure Law and the tasks specified in the CL, the Competition Council also organizes informative events (seminars, press conferences, etc.), which are reflected on the Competition Council's website and social media. The legal basis of the Competition Council is the legal obligation to inform the public about the performance of the tasks of the Competition Council and other issues of protection, preservation, and development of competition (Article 6 (1) (c) of the Regulation). The Competition Council also processes personal data (image and voice recordings), the legal basis of which is the data subject's consent to the processing (Article 6 (1) (a) of the Regulation). Prior to the event and in this privacy policy, the person is informed that personal data will be processed and that the person, by participating in the event, gives oral or written consent that his or her personal data will be used for the stated purpose.
When the event takes place in presence, informative signs are placed at the entrance of the event, which indicates that the event is photographed, filmed, or video streamed, respectively photos and videos of the person can be placed on the Competition Council's website, social networks and media. When the event takes place remotely online, the participants of the event will be informed orally about the above-mentioned circumstances, i.e., the processing of the relevant personal data (information obligation under Article 13 of the Regulation).
All personal data is applied the status of restricted access information (hereinafter – RAI) and it can be accessed and processed only for the appropriate purpose or objective by authorised officials of the CC, for example, officials who require such information for investigation under the CL or decision-making while selecting an applicant for a vacancy. Technical and organizational measures implemented by the CC, as well as the established RAI policy ensures secure processing of received data, including its accumulation, storage, and confidentiality, preventing unauthorized obtaining of this information by third parties. In the published versions of decisions adopted by the CC according to the CL, names and surnames of persons are pseudonymized, replacing this data with randomly selected combinations of letters.
For how long the data processed according to the CL is stored?
Specific personal data is stored by the CC only as far as it is necessary for implementation of specific data processing purposes.
The personal data (incl. electronic data) obtained during investigation activities (in inspections) is processed until the legal basis stipulated by the CL for processing (incl. storage of data) ceases, and this data is destroyed after coming into final force of decision adopted by the decision-making body of the CC, unless there is any legal basis for further storage of this data, for example, a claim on compensation of damage caused as a result of infringement of CL or an application to the European Court of Human Rights (ECHR) against Latvia concerning an alleged infringement of human rights.
Personal data of job applicants is stored for a period of two years in order to ensure the legal interests of the CC. The CC as the employer stores applicant's data, if it is necessary for protection of lawful rights of the CC, for example, in the case of challenging the selection process.
Personal data that is related to ensuring of the economic activity of the CC is processed until fulfilment of the agreement and is stored for archiving purposes for 10 years after expiration of the agreement period.
What are the rights of data subject during processing of obtained personal data according to the CL?
When the CC obtains voluminous information (incl. personal data) while conducting the procedural activities mentioned in section 9(5) of the CL, the market participant, its representative and employee is informed about the rights to identify and request the CC to separate personal data that does not refer to the case, for example, data that contains correspondence with a lawyer or qualifies as private correspondence, which does not contain any evidence for detection of infringement. The CC does not perform further accumulation and analysis of this data and ensures deletion of this data at the request of the data subject if this data does not affect integrity of other evidence.
According to sections 26(6) and (7) of the CL, during the final stage of case investigation (when the CC has already made a notice on facts obtained for decision-making), the CC acquaints the process participants (incl. third parties within the meaning of section 28 of the Administrative Procedure Law (APL)) with the case materials that concern them. In this case restricted access information of one person is not disclosed to another person (participant of administrative process).
Participants of administrative process are also entitled to inform the CC on any changes to, for example, their contact information, requesting the CC to ensure further communication, using the updated contact information.
While ensuring publicity of activities of the CC, employees of the authority make photos and shoot videos at events organized by the CC (for example, conferences, seminars, lectures, meeting) only upon consent of the data subject. The CC respects any request by the data subject, not to take photos or shoot videos of him or her, and not to publish his or her images. If your data is processed based on oral or written consent, you have the right to withdraw your consent at any time and in the same way as the consent has been given, in which case further processing based on the prior consent will no longer take place. However, the withdrawal of your consent does not affect the processing carried out during the period in which your consent was valid.
The CC examines each application or complaint of data subject concerning the rights granted to the data subject in the Regulation, observing the principle of proportionality, implements any possible measures to ensure the rights of the data subject and responds adequately to the application.
Who personal data is disclosed to?
Data transfer to third parties takes place according to the law or any other legal basis. According to the obligation imposed by regulatory enactments on state administration authority, the CC is entitled to disclose and transfer personal data to other authorities of the Republic of Latvia and authorities abroad without receiving consent of the data subject, for example, to courts, state administration authorities (the State Control, the Ministry of Finance, the SRS, the CPCB, the Data State Inspectorate, banks etc.). According to provisions of the CL, the existing personal data can be transferred by the CC to competition protection institutions of other EU Member States, the European Commission, the ECHR etc.).
How to ask a question concerning data processing?
If the data subject (person) has any questions, proposals or suggestions in relation to processing and protection of personal data carried out by the CC, the data subject may ask a question to the CC by sending an e-mail to vanda.zalcmane@kp.gov.lv or by submitting a written application to the Competition Council with an indication To the Data Protection Specialist.
The Data Protection Specialist of the Competition Council does not provide general consultations to other persons on the compliance of personal data processing with the Regulation and the Personal Data Processing Law but performs the tasks referred to in Article 39 of the Regulation. The data subject shall indicate own name, surname, address or e-mail address for receiving a response and for further communication.
How to submit a complaint on inappropriate data processing?
If a data subject has any questions or complaints in relation to the processing of its personal data, which is carried out by the CC, the data subject shall submit a request for the exercise of his or her rights in writing. The Competition Council accepts documents by post, electronic mail (documents signed with a secure electronic signature) or using the public administration service portal Latvija.lv. If the problem cannot be solved within the CC, the data subject is entitled to submit an application or complaint to the Data State Inspectorate (DSI), which is a competent authority in the area of data processing.
Does a data subject have to submit data to the CC for application of the CL and what are the consequences of refusal to provide such data?
An obligation to provide information to the CC, incl. personal data is stated in section 9(5) of the CL, whereas section 94 of the CL stipulates sanctions for refusal to provide information – a fine from 50 to 1,400 euros (for persons).
Amendments to the Privacy Policy of the CC
The CC shall revise and improve the Privacy Policy on regular basis. This Privacy Policy is updated on 30 January 2023.