Rights requests and unauthorised disclosure

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: handle requests and incidents while protecting confidentiality. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. Reports may contain information about reporters, persons concerned and bystanders. The GDPR, Latvian data-processing law and special reporting rules govern processing. Distinguish lawful handling from unjustified collection, sharing and retention.

Access rights do not automatically disclose the whole report. Assess GDPR rights, others’ protection and sections 11–12. Notify the supervisor without undue delay and where feasible within 72 hours of awareness, unless risk is unlikely. Individual communication has a separate high-risk assessment.

Apply the following rule: Sections 11–12 protect the identities of reporters and persons concerned. The GDPR requires necessity-based retention. Adopt a specific document schedule considering archiving, procedural and sectoral duties. The Whistleblowing Law contains no universal five-year period for all reports. Assess attachments, exports and copies too.

2. Practical Implementation & Procedure

Record the request or incident, contain harm and involve competent privacy staff. Assess particular rights and notification conditions. Document reasons, risk and timing; a generic confidentiality label is insufficient. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A file goes to the wrong recipient. The team restricts access, assesses risk and decides on DVI and individual notification under the conditions. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does accidental disclosure remove the assessment need? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. An accident may be a breach. Assess risk, duties and timing and document containment.

One mistake to avoid is: hiding an incident because it was unintentional.

Now apply the national rule to a second decision. The system deletes every file five years after receipt. Is this a universal Latvian rule?

No. Define purpose, applicable procedural and archiving duties, starting event and review. Protect exports and attachments too. Completed examination does not automatically mean immediate deletion; indefinite unnecessary retention is also impermissible. Document exceptions and regular review.