The Latvian Data Protection Authority (DVI) has published clarifications on the processing of personal data, including license plates, in the context of using paid parking lots equipped with automatic reading systems.

A license plate, associated with an image of a vehicle, does not constitute personal data if it is not linked to an identifiable natural person. It becomes personal data when the parking operator associates it with the owner or holder of the vehicle, for example to recover an unpaid fee, in accordance with the definition in Article 4 of the GDPR. The processing of this data does not systematically require the consent of the driver. It may be based on the performance of a contract for the provision of the parking service, or on the legitimate interests of the controller for the protection of property and persons, pursuant to Article 6 of the GDPR.

The operator must inform drivers before any data collection, via visible signage at the entrance of the parking lot. This must at least mention video surveillance or automatic license plate reading, the purpose, the identity and contact details of the controller, as well as a reference to more complete information. The latter, detailing the legal basis, retention period and data subject rights, may be accessible via a QR code. The retention period of the data must be limited to the strict necessity of the processing, in accordance with Article 5 of the GDPR. In case of non-payment or dispute, the data may be retained longer in order to justify a claim.