The National Data Protection Inspectorate of Latvia (DVI) has clarified the conditions for compensation for damage resulting from a personal data breach.

The authority recalls that a person wishing to obtain compensation for damage is not required to wait for a prior decision from the supervisory authority establishing a breach, as these two procedures are distinct. A data protection breach does not automatically give rise to a right to compensation, its purpose being to compensate for actual harm suffered and not to sanction the data controller, as emphasized by the Court of Justice of the European Union. The assessment of damage depends on the nature of the data; the leakage of general data, such as a name and an email address, is generally not considered to have a high impact if it does not reveal sensitive information. The total number of affected individuals does not increase the individual impact but may influence the prioritization of the case by the authority. To obtain compensation, the data subject must prove the specific damage suffered as well as the causal link with the breach.