Ministry: Compensation for CSDD clients hinges on Data Inspection ruling

The Transport Ministry has stated that the investigation into the cyberattack on the Road Traffic Safety Directorate (CSDD) is still ongoing, and the decisive factor for client compensation will be a ruling from the State Data Inspectorate (DVI). That ruling would determine whether CSDD failed to meet requirements under the General Data Protection Regulation. Under the regulation, an individual may receive compensation if it is established that the agency did not fulfill its legal obligations and that this failure caused harm to the person.

The ministry emphasized that requesting compensation at this stage is premature, and clients will be informed separately about further steps. Meanwhile, CSDD continues to evaluate additional measures that could reduce potential harm to affected individuals. The public will be updated on decisions taken and subsequent actions.

Inspection review may take time

DVI previously said it cannot specify exactly how long its review of CSDD will take. Latvian law requires that a decision in an administrative process be issued within six months of a case being opened, though this deadline can be extended to one year for objective reasons. High-priority cases are typically resolved within four to nine months.

Background on the breach

In early August, a cyberattack on CSDD resulted in the theft of data belonging to roughly 1.2 million individuals and about 200,000 legal entities, gathered from payments made to the directorate over the past 18 years. Following calls for resignations, both CSDD's board and council decided to step down. Transport Minister Rihards Kozlovskis has ordered an expedited internal service investigation, which will also examine CSDD's cybersecurity contract with telecom operator Tet. The Prosecutor General's Office has opened a review, and the State Police have launched a criminal investigation into the cyberattack.