Privacy Policy

Data Controller's Identity and Contact Information
 

Office of Citizenship and Migration Affairs
Registration No. 90000050138
Čiekurkalna 1.līnija 1, K-3, Riga, LV–1026
pasts@pmlp.gov.lv

The purpose of the Privacy Policy of the Office of Citizenship and Migration Affairs (hereinafter – the Office) is to provide you with information about the purposes the Office processes personal data, the categories of personal data, the legal basis for personal data processing, retention periods, recipients of personal data, as well as to inform you of your rights and obligations.

The Office processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – the GDPR) requirements.

The Office's Privacy Policy applies to any natural person whose personal data is processed by the Office, regardless of whether the personal data is obtained from the data subject (in paper form, electronically, by telephone) or from other sources.

Contact information for the Office's Data Protection Officer: DAS@pmlp.gov.lv. The Data Protection Officer does not provide general consultations on compliance of personal data processing with the GDPR and the Personal Data Processing Law, but performs the tasks specified in Article 39 of the GDPR, as well as provides general information about the personal data processing carried out by the Office.

Purpose of Personal Data Processing, Legal Basis, Data Types and Data Collection Sources

Personal data is processed for the following purposes:

1. To create, maintain and develop the state information systems under the Office's management, the Office shall process such types of personal data as specified in the regulatory act on the operation of the relevant information system and received from you as the data subject, state and local government institutions, and information systems under the management of these institutions, natural and legal persons who are required by law to provide information for integration in the information systems managed by the Office.

• Register of Natural Persons (Law on the Register of Natural Persons, Regulation of the Cabinet of Ministers No. 372“Regulations Regarding the Amount of Information to be Included in the Register of Natural Persons” of 15 June 2021, Regulation of the Cabinet of Ministers No. 412 “Procedures for the Inclusion and Updating of Information in the Register of Natural Persons” of 22 June 2021)
• Register of Residence Permits (Immigration Law, Regulation of the Cabinet of Ministers No. 564 “Regulations Regarding Residence Permits” of 21 June 2010)
• Register of Work Permits (Immigration Law, Regulation of the Cabinet of Ministers No. 55 “Regulations Regarding Employment of Foreigners” of 28 January 2014)
• Register of Invitations (Immigration Law, Regulation of the Cabinet of Ministers No. 564 “Regulations Regarding Residence Permits” of 21 June 2010)
• National Visa Information System (Immigration Law, Regulation of the Cabinet of Ministers No. 676 “Visa Regulations” of 30 August 2011)
• Information System of Personal Identification Documents (Personal Identification Documents Law, Regulation of the Cabinet of Ministers No. 601 “Regulations on the Information System of Personal Identification Documents” of 3 October 2017)
• Register of Returned Foreigners and Entry Bans (Immigration Law, Regulation of the Cabinet of Ministers No. 122 “Regulations Regarding the Register of Returned Foreigners and Entry Bans” of 5 March 2013)
• Acquiring and Loss of Citizenship Information System (Citizenship Law, Regulation of the Cabinet of Ministers No. 98 “Regulations on the Acquiring and Loss of Citizenship Information System” of 7 March 2023)
• Register of Asylum Seekers (Asylum Law, Regulation of the Cabinet of Ministers No. 456 “Regulations Regarding the Register of Asylum Seekers” of 12 July 2016)
• Electoral Register (Electoral Register Law)
• Archive of Electronic Documents (Regulation of the Cabinet of Ministers No. 528 of 09 August 2016 “Regulations on the Archive of Electronic Documents of the Office of Citizenship and Migration Affairs”)

2. To review applications, complaints, requests, issue administrative acts, undertake actual actions and provide services, the Office shall process names, surnames, personal identity numbers, contact information, as well as personal data at the Office's disposal or obtained from other institutions or state information systems that is necessary for the performance of the respective task under the procedures specified in regulatory enactments.
3. To conduct competitive recruitment process, evaluate a candidate's suitability for a position and establish employment or civil service relationships, the Office shall process the information provided in the application (name, surname, personal identification number, contact information, etc.), as well as personal data to evaluate the candidate's suitability for the specified position under the requirements of the Labour Law and the State Civil Service Law.
4. To provide up-to-date information about the Office's services, ensure and improve the quality of the Office's information telephone service, as well as to review complaints about the institution's actions, the Office shall record telephone conversations on the information telephone 67209400 and process your voice and provided information (name, surname, description of the situation).
5. To ensure your safety and that of the Office's personnel, protect property, as well as improve the quality of services provided by the Office in person, the Office shall conduct video surveillance in the customer service halls of the Office's territorial departments and process your visual image, appearance, behaviour, actions, voice (if video surveillance with voice recording function is available), location and time.
6. The Office's website uses cookies (for more information - General Privacy Policy of the Unified Website Platform).
7. The Office does not perform profiling of personal data.

Legal basis for personal data processing

The Office may process your data:

1. to comply with a legal obligation applicable to the controller (Article 6(1)(c) of the GDPR);
2. to perform a task carried out in the public interest or to exercise of official powers legally vested in the controller (Article 6(1)(e) of the GDPR);
3. to comply with the legitimate interests of the Office or a third party (Article 6(1)(f) of the GDPR).

Retention of personal data

The Office stores your personal data as long as at least one of the following conditions exists:

1. as long as the Office has an obligation specified in regulatory enactments to store the relevant personal data;
2. as long as a legal obligation applicable to the Office is being fulfilled (for example, reviewing an application, issuing an administrative act, providing a reply, etc.);
3. as long as the retention of personal data is necessary for the realisation of the legitimate interests of the Office, the data subject or a third party (for example, filing a claim in court, etc.).

Recipients of personal data

The Office transfers your personal data only to the recipients having the right to receive personal data in the cases specified in regulatory enactments:

1. the Office employees processing personal data for the performance of their officialduties;
2. the personal data processor (Information Centre of the Ministry of the Interior);
3. state and municipal institutions, law enforcement authorities, security institutions, insolvency administrators, sworn notaries, bailiffs, and other third parties who require your personal data under the Office's control for the performance of functions and tasks specified in regulatory enactments;
4. natural persons, based on a motivated written submission, in the manner and to the extent specified in regulatory enactments.

Transfer of personal data to third countries

The Office may transfer your personal data to third countries (outside the European Union or European Economic Area) or international organisations only in cases where there is a legal basis for such transfer and if it is stipulated by Latvian or international regulations or international agreements concluded between Latvia and the said third country or international organisation.

Personal data security

When processing your personal data, the Office employs various technical and organisational measures, including ensuring compliance with the requirements set out in the regulatory acts regarding information system security (the Law on State Information Systems and the regulations of the Cabinet of the Ministers issued on the basis thereof).

Your rights

You have the following rights regarding personal data protection:

1. Right to access your data – when exercising your right to access data, you need to specify a particular time period and the data you wish to obtain. You have the right to request information from the Office about your data held by the Office, purposes of data processing, how the Office obtained it and to whom it was transferred, retention period, and to receive a copy of your data. The request can be fulfilled more quickly if the time period specified is as short as possible and the request for information about your data is formulated in as much detail as possible.
2. Right to rectification of data – if you need to clarify or rectify your personal data held by the Office, you must clearly indicate which data needs to be rectified and provide updated information. If the data was not obtained from you, it is necessary to provide justification as to why the information being rectified is considered inaccurate, to facilitate a faster and more appropriate assessment of accuracy.
3. Right to erasure of data – for the Office to erase your data, you must specify exactly which personal data needs to be erased and provide justification for this request.
4. Right to restrict processing – if you are uncertain whether the Office is processing data appropriately, you may request restriction of the processing of the specific data. The request for restriction of data processing must indicate why, in your opinion, this processing needs to be restricted.
5. Right to object to processing – in certain cases, you may have the right to object to processing due to your individual circumstances. In the request, it is important to indicate your individual circumstances due to which you object to the processing.

If you wish to submit a request regarding the processing of your personal data by the Office, please contact the Office by sending:

1. a hand-signed application by post to the Office’s legal address: Čiekurkalna 1.līnija 1, Rīga, LV–1026;
2. an electronically signed (with a secure electronic signature) application to the email address pasts@pmlp.gov.lv;
3. electronically, using the official electronic address.

Your request will be reviewed without undue delay, and a reply regarding the fulfilment or non-fulfilment of the request will be provided no later than one month from the date of receipt. In cases where the fulfilment of the request takes the Office longer, the Office has the right to extend its fulfilment for another two months, and you will be informed thereof within one month.

The Office informs that some of your rights may be restricted if the Office has an obligation to process and store personal data to fulfil its legal obligations, and the Office also has the right not to fulfil your request:

1. if it is not formulated comprehensibly;
2. if the Office is unable to identify you;
3. if the Office has already provided an answer to such a request;
4. if the volume of the requested information is disproportionate;
5. if your request is unfounded (not applicable to the Office, no explanations have been provided as to why the request should be fulfilled);
6. if regulatory acts stipulate that the Office is not authorised to provide you with such information.

If you believe that the Office has processed your data inappropriately, you have the right to submit a complaint to the data protection supervisory authority regarding the data processing carried out by the Office:

Data State Inspectorate,
Elijas iela 17, Riga, LV-1050
pasts@dvi.gov.lv
https://www.dvi.gov.lv/lv
67223131

Basic information about SIS

• The Schengen Information System (SIS) is the most widely used and largest information sharing system in the field of security and border management in Europe. As there are no internal borders between Schengen countries in Europe, SIS substitutes border control and is the most successful cooperation tool for border, immigration, police, customs and judicial authorities in the EU and Schengen associated countries. Competent national authorities (including the State Border Guard) can enter and view alerts on people and objects in a single shared database.
• The country that enters an alert and related data in SIS is the "data owner". This means that only this country is permitted and able to update and delete the alert.

• The second generation of SIS (SIS II) with additional functions such as the ability to add fingerprints and photographs to alerts was introduced in 2013. Since March 2023 DNA profiles of persons declared missing or DNA of their parents, grandparents or siblings have been stored in SIS to confirm identity.
• The system administrator functions regarding the Latvian national part of SIS (NSIS) are performed by the Information Centre of the Ministry of the Interior. It ensures the technical operation of NSIS and monitors compliance with the technical requirements set out in the regulatory acts governing the operation of SIS.

SIS legal framework

• Regulation (EU) 2018/1860 on the use of the Schengen Information System for the return of third-country nationals illegally staying in the Member States;
• Regulation (EU) 2018/1861 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks;
• Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters.

In the Republic of Latvia, the procedure for maintaining and using SIS is determined by:

• Law on the Operation of the Schengen Information System (adopted 14.06.2007)
• Procedures for the Entering, Correction and Deletion of Alerts in the Schengen Information System, as well as Ensuring Accessibility of Supplementary Information between the SIRENE Bureau of Latvia and Procedures for the Exchange of Supplementary Information of Institutions and Authorities (Cabinet Regulation No. 639 of 18.09.2007);
• Procedures for the Request and Issue of Information Regarding a Data Subject that is Kept in the Schengen Information System and the SIRENE Information System (Cabinet Regulation No. 622 of 11.09.2007).

SIS operational objectives and purposes of personal data processing

• to ensure the security of the Schengen area without carrying out checks within internal borders;
• to strengthen public order within the territories of the Schengen area states;
• to help combat terrorism, cross-border crime and illegal migration;
• to serve as a cooperation instrument for border, immigration, police, customs and judicial authorities in the EU and Schengen associated countries;
• to search for criminals, missing persons, third-country nationals who are denied residence in Schengen area countries, persons whose actual place of residence needs to be ascertained for judicial purposes, persons and objects that are of operational interest, as well as to identify offenders by fingerprints and palm prints;
• to prevent the abduction or disappearance of persons, including children, and to protect vulnerable persons (adults or children) from being unlawfully taken abroad.

Data subjects

(persons on whom alerts are entered in SIS)

• third-country nationals who are subject to return decisions;
• third-country nationals who are not entitled to enter into or stay in the Schengen area;
• persons wanted for arrest;
• missing persons;
• vulnerable persons whose travel must be prevented;
• children at risk of being abducted by their own parents, relatives or guardians;
• persons sought to assist with judicial proceedings (for example, witnesses in criminal proceedings);
• persons and objects being the subject to discreet, inquiry or specific checks:
• unknown wanted persons (fingerprints and palm prints found at the scenes of terrorist acts or other serious crimes);

Data categories

• identification data of the wanted person (at least name and surname; year of birth);
• photographs of the wanted person*;
• fingerprints and/or palm prints of the wanted person*;
• information about objects associated with the wanted person, for example, about the vehicle used by the wanted person;
• description or copy of the wanted person's identification document;
• dactyloscopic data (fingerprints and/or palm prints*) found at crime scenes;
• DNA profile of the wanted person or their family members* (only in cases of missing persons who need protection);
• European Arrest Warrant (EAW) (if the person is wanted for arrest);
• data on persons who have been victims of identity misuse.

Other data entered in SIS alerts:

• reference to the decision that forms the basis for the alert;
• action to be taken.

*Biometric data are used to facilitate identification and avoid misidentification.

Access to SIS data

Access to the information included in the SIS according to their competence specified in the laws and regulations governing the operation of the SIS is available to the authorities specified in Article 14 of the Schengen Information System Operation Law, including the State Border Guard.

SIS data retention period

Data included in SIS may be stored in the system only for as long as necessary to achieve the purpose of the specific alert. As soon as this is achieved, the data are immediately deleted.

More details about SIS data retention can be found here:

https://home-affairs.ec.europa.eu/policies/schengen-borders-and-visa/schengen-information-system/questions-and-answers_lv

Data subject rights with regard to SIS:

• the right to access personal data retained in SIS;
• the right to rectify inaccurate personal data or delete unlawfully stored personal data;
• the right to bring an action before courts or competent authorities to rectify or delete personal data or to receive compensation for any losses incurred as a result of violations of data protection legislation.

How to exercise your rights?

The data subject can exercise the right of access and receive information about further actions related to the rights to rectification and deletion of data by submitting a written application (signed by hand or with a secure electronic signature) to the State Police (SIRENE Latvian National Unit[1], Rīgā, Čiekurkalna 1.līnijā 1, korpuss 4, telephone 67219053, e-mail: ssp@vp.gov.lv), or at the police unit of applicant's place of residence, or at diplomatic or consular representations of the Republic of Latvia.

Contact information for diplomatic or consular representations of the Republic of Latvia is available here: https://www.mfa.gov.lv/lv

The written request must include:

• information about the applicant: name(s), surname, date of birth, personal identity number (if any), place of birth, nationality, type of identification document (if any), number, name of issuing authority, date of issue and expiry date;
• the scope of information requested (information about the data subject, information about recipients of the data subject's personal data);
• the method of receiving information (by personally visiting a State Police institution or representation, or by sending information to the specified address);

When submitting a request in person, the data subject must confirm one's identity by presenting one's identification document. If the request is submitted by an authorised person, they must present a notarially certified authorisation confirming the right to receive information about the data subject, or a document confirming the rights of parents, adopters, guardians or trustees.

Obtaining information is free of charge. A response is provided within 1 month.

Individuals may submit their requests in Latvian and English. Request templates are available on the official website of the State Police: https://www.vp.gov.lv/lv/sengenas-informacijas-sistema

If the State Police SIRENE Bureau of Latvia refuses to provide information, rectify or delete data in their response, the data subject has the right to submit a complaint to the national supervisory authority of the Member State. Applications to the Data State Inspectorate may be submitted in Latvian and English.

Contact information: Data State Inspectorate

dvi.gov.lv

E-mail pasts@dvi.gov.lv

Address: Elijas iela 17, Rīga, Latvia, LV-1050

Additional information, as well as application and complaint templates (in Latvian and English) are available on Data State Inspectorate's official website: https://www.dvi.gov.lv/lv/sengenas-informacijas-sistema

[1] SIRENE Bureau of Latvia:

• ensures the exchange of information between law enforcement authorities of Member States regarding persons or objects for which an alert has been entered in the Schengen Information System;
• ensures the issuance of wanted notices for criminals in international search systems;
• ensures the quality and legal validity of alerts to be entered in SIS – compliance with the requirements of the Schengen acquis;
• coordinates search measures in Latvia for criminals wanted by foreign law enforcement authorities and for missing persons.
• is the only institution in the country authorised to examine applications from natural persons and provide responses regarding the maintenance of the applicant's data in the SIS and SIRENE information system (a data processing system for processing additional information and alert messages).

Basic information about VIS

• The Visa Information System (VIS) is designed for data exchange between Schengen Member States regarding short-term visa applications and related decisions. VIS records information, including biometric data, about third-country nationals who submit applications for Schengen visas;
• Visa applications and visas issued, refused, extended, annulled and cancelled by the competent Latvian authorities are registered in the national visa information system (NVIS);
• Personal data with biometric data submitted with a visa application are processed and stored in the central VIS system.

VIS legal framework

• Council Decision establishing the Visa Information System (VIS) 2004/512/EC;
• Regulation No. 767/2008 of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation);
• Regulation (EC) No. 810/2009 of the European Parliament and of the Council establishing a Community Code on Visas (Visa Code).

In the Republic of Latvia, the procedures for using VIS and NVIS are determined by Cabinet Regulation No. 676 "Visa Regulations" of 30 August 2011  (Visa Regulations), which have been issued in accordance with Section 3, Paragraph three, Section 12, Paragraph one, Clause 3, Section 13, Paragraphs three and four of the Immigration Law.

VIS operational objectives and purposes of personal data processing

• to examine visa applications and related decisions;
• to verify the identity of the visa holder and/or the validity of the visa when carrying out checks at external borders and within Member States;
• to verify whether the conditions for lawful entry into and stay in the territory of the Member States are fulfilled and to identify persons who do not or no longer fulfil these conditions, including identifying persons who have no documents or have fraudulently obtained documents (combating illegal immigration);
• to prevent "visa shopping";
• to prevent the use of counterfeit documents and attempts to provide false information;
• to protect travellers from identity theft;
• to determine the Member State responsible for examining an asylum application;
• to facilitate data exchange between Schengen countries on visa applications;
• to help prevent, detect and investigate terrorist threats and other serious criminal offences.

Personal data stored in VIS may be transmitted to a third country or international organisation in accordance with Article 31 of the VIS Regulation and to the Schengen Agreement Member States in accordance with Council Decision (EU) 2017/1908.

Data subjects

Persons whose data are processed in the VIS system.

Data categories

• alphanumeric data on the applicant, visas requested, visas issued, visas refused;
• annulled, revoked or extended visas;
• photograph *;
• fingerprints data*;
• links to previous visa applications and the application files of persons travelling together;
• information about the inviter.

The scope of information to be included in the NVIS is determined by Article 53 of the Visa Regulations.

*The use of biometric data to verify the identity of the visa holder allows for faster, more accurate and more secure checks.

Authorities responsible for data processing

1. Office of Citizenship and Migration Affairs (controller of the National Visa Information System (NVIS)):

contact information: pmlp.gov.lv, e-mail: pasts@pmlp.gov.lv

more information: https://www.pmlp.gov.lv/lv/vizas-ielugumi-un-uzaicinajumi

2. State Border Guard

Officials of the State Border Guard issue single-entry uniform visas and visas with limited territorial validity at the border crossing points specified in Annex 1 of Cabinet Regulation No. 676 "Visa Regulations" of 30 August 2011. Officials of the State Border Guard issue visas marked "Diplomatic Visa" or "Service Visa" only upon request from the Consular Department.

contact information: rs.gov.lv, e-mail: pasts@rs.gov.lv

Access to VIS data

• State Border Guard officials have the right to access information when it is necessary to verify a person's identity, to check authenticity of a visa, or to verify whether a person meets the requirements for entry and/or stay in any of the Schengen countries.
• Asylum authorities have access to information if they need to determine which EU/EEA country is responsible for examining an asylum application.
• Other national authorities and Europol may request access to information in special circumstances to prevent, detect and investigate terrorist offences and serious criminal offences.

VIS data retention period

Data in the VIS is stored for no longer than five years.

This period begins:

a) on the expiry date of the visa, if a visa has been issued;

b) on the day when the visa's new validity period ends, if the visa has been extended;

c) on the day when the application file was created in the VIS, if the application has been withdrawn, closed or discontinued;

d) on the day when the visa authority has taken a decision, if the visa has been refused, annulled or revoked.

Data subject rights regarding the VIS:

• the right to receive information about oneself and about the Member State that has transmitted this data to the VIS;
• the right to receive information about the recipients of personal data, unless the disclosure of this information is prohibited by law in the fields of national security, defence and criminal law;
• the right to request that their personal data be supplemented or corrected, as well as to suspend their processing or have them destroyed if the personal data are incomplete, outdated, false, illegally obtained or no longer necessary for the purpose of collection;
• the right to lodge a complaint with the national supervisory authority or to bring an action in court.

How to exercise your rights?

The data subject has the right to exercise their data subject rights in accordance with the General Data Protection Regulation: the right to access their personal data, request rectification of personal data, object to processing, the right to restrict the processing of personal data and, in certain cases, request the erasure of personal data. When the data subject contacts the NVIS controller with an application (in Latvian or English):

The data subject may contact the Office of Citizenship and Migration Affairs regarding matters concerning data rectification, as well as complaints about personal data processing. The Office of Citizenship and Migration Affairs' contact information is available on the website www.pmlp.gov.lv, as well as via e-mail: pasts@pmlp.gov.lv or in person:  Čiekurkalna 1. līnija 1, k-3, LV-1026, Rīga.

Office of Citizenship and Migration Affairs communicates with the data subject using the contact information provided by the data subject (telephone number, email address, e-address).

If the data controller has not provided a satisfactory response, the data subject has the option to submit a complaint to the Member State's national supervisory authority. Complaint templates (in Latvian and English) are available on the official website of the Data State Inspectorate.

Contact information: Data State Inspectorate, on the website www.dvi.gov.lv, pasts@dvi.gov.lv, Address: Elijas iela 17, Rīga, Latvia, LV-1050

In accordance with Article 40(1) and (2) of the VIS Regulation, each data subject has the right to lodge a claim with the competent authorities or courts of the respective Member State if the data subject believes that the Member State has refused to implement their rights.