Lawyer: assessing moral damages after CSDD data leak will be difficult

Following the August cyberattack on Latvia's Road Traffic Safety Directorate (CSDD), in which data belonging to about 1.2 million individuals and roughly 200,000 legal entities was stolen, many are asking how the harm caused to them can be assessed. Speaking on the TV24 programme "Naudas cena," sworn advocate Saulvedis Vārpiņš explained that the leak itself does not automatically entitle a person to a specific compensation amount.

Three conditions that must be proven

According to Vārpiņš, claiming compensation for moral damage first requires establishing that a violation occurred, such as a failure to meet data protection requirements. Second, a causal link must be shown between that violation and the harm suffered by the person, for example insomnia or other distress. Third, and most difficult, is determining how severe the harm is and translating it into a monetary figure, since the range of possible outcomes is very wide.

The lawyer also referenced the law on compensation for damage caused by state administration bodies, which provides for various forms of redress, from an apology to financial compensation. For lesser harm, compensation could reach up to 7,000 euros, while more serious harm could bring up to 10,000 euros. However, he stressed it is currently very difficult to predict how claims related specifically to the CSDD case will be assessed. Vārpiņš also recalled an earlier case in which a person sought 3,900 euros over data misuse, but the case ended with an apology instead.

Awaiting a ruling from the Data State Inspectorate

CSDD Communications Department head Mārtiņš Mālmeisters said the directorate has received about 2,500 compensation requests, with claimed amounts most often around 10,000 euros. He noted that any payout will depend on a decision from the Data State Inspectorate establishing CSDD's responsibility for violating data protection regulation requirements, and that seeking compensation at this stage is premature.

The incident has triggered a service investigation ordered by the Transport Ministry, which will also examine CSDD's cybersecurity contract with Tet, as well as a Prosecutor General's Office review and a criminal case opened by the State Police. Both the CSDD board and council have since stepped down.