The National Data Inspectorate of Latvia (DVI) has published guidelines on the legality of refusing to provide a service when a customer does not provide certain personal data.

A service provider may refuse to provide a service if the requested data are objectively necessary for its performance, for example an address for delivery. Refusal is also justified if the data collection meets a legal obligation to identify the customer. However, the provider must be able to justify the purpose and legal basis of each data collected, in accordance with the minimisation principle set out in Article 5, paragraph 1, point c) of the GDPR. Collection cannot be motivated by mere convenience or system constraints. The customer must be informed whether the provision of data is mandatory or not and of the consequences of refusal, pursuant to Article 13, paragraph 2, point e) of the GDPR.

The authority illustrates its statements by specifying that a sports club cannot require a personal identification code and address of a customer for a prepaid monthly subscription by invoking accounting obligations, as the Latvian accounting law does not systematically impose the collection of this information. The provider must demonstrate how the service is impossible to provide without these specific data. Furthermore, access to a main service cannot be conditioned on consent for secondary purposes, such as commercial prospecting, as such consent would not be considered freely given within the meaning of Article 7, paragraph 4 of the GDPR.