Republic of Latvia Cabinet Regulation No. 546 Adopted 12 September 2017

Regulations Regarding the Official Electronic Address Information System

Issued pursuant to
Section 7, Paragraph three, Section 8, Paragraph five,
Section 11, Paragraph four, Section 14,
Paragraph two and Section 16, Paragraph two
of the Law on the Official Electronic Address

I. General Provisions

1. The Regulation prescribes:

1.1. the security and technical requirements for the Official Electronic Address (hereinafter - the e-address) Information System, as well as the requirements for interfaces and their use;

1.2. the procedures by which the institutions that register or maintain information regarding users of e-address accounts (hereinafter - the register institutions) provide the information necessary for the creation of the e-address to the E-address Information System manager, as well as the amount of the information to be provided;

1.3. the procedures for creating or cancelling the e-address and activating or deactivating an e-address account, as well as the procedures for deleting the relevant information from the E-address Catalogue;

1.4. the amount of the information to be included in the E-address Catalogue, and the procedures for the circulation of such information;

1.5. the storage volume and period of electronic communication, electronic documents (hereinafter - the messages) and metadata thereof sent to the e-address, as well as the action of the E-address Information System manager if the storage volume of the messages and metadata thereof has been exceeded, or the period for storage thereof has expired;

1.6. the procedures for using the E-address Information System.

II. Security and Technical Requirements for the E-address Information System

2. The E-address Information System shall be an enhanced security system.

3. The E-address Information System manager shall:

3.1. ensure the possibility to perform data transmission to and from the E-address Information System by using the public data transmission network and complying with the following requirements:

3.1.1. identify itself in the data transmission channel by using a certificate issued in X.509 standard form, and ensure protection thereof;

3.1.2. ensure access to data transmission in the data transmission channel only to an identified and authorised user of the e-address account;

3.1.3. ensure encryption of the data transmission channel;

3.2. ensure availability of the E-address Information System to the following extent:

3.2.1. during working days from 8:30 to 17:00 - 99 % a month;

3.2.2. at all other times - 97 % a month.

4. The E-address Information System manager shall provide consultative support for the use of the e-address account during its working hours.

5. The E-address Information System manager shall post information on changes to the availability of the E-address Information System and planned interruptions in the operation thereof two working days prior to the planned interruption, but in the case of unplanned interruptions - at the moment of occurrence thereof.

6. The E-address Information System shall conduct the following activities after a message enters the E-address Information System:

6.1. verify the recipient of the message - whether it has an activated e-address account. If the specified recipient does not have an activated e-address account in the E-address Information System at the moment of receipt of the message, further processing of the message shall not be performed, and the message shall be deleted;

6.2. automatically supplement the message which has been subjected to the verification referred to in Sub-paragraph 6.1 of this Regulation and the processing of which may be continued without altering the content thereof with the features by certifying the following:

6.2.1. the date and time of receipt of the message in the E-address Information System;

6.2.2. the identities of the sender and recipient of the message;

6.2.3. the information which ensures the possibility to verify that the content of the message has not been changed after supplementation of features;

6.3. ensure the possibility for the sender of the message to obtain information regarding at least the following statuses of the message processing:

6.3.1. the recipient of the message does not have an activated e-address account;

6.3.2. the message has been processed and registered in the E-address Information System;

6.3.3. the message has been delivered to the recipient of the message;

6.4. ensure the possibility for the recipient of the message to obtain information regarding delivery of a new message to the e-address account;

6.5. register the following information regarding any activities with the message:

6.5.1. the date and time when an activity with the message has been conducted;

6.5.2. the performer of the activity;

6.5.3. the information regarding the conducted activity;

6.6. ensure protection of the message against unauthorised unidentified access, alteration or destruction, and access control of this message by denying access outside the access control mechanism.

7. The E-address Information System shall register any activities conducted by all users of the E-address Information System in the E-address Information System.

8. The E-address Information System manager and the users of e-address accounts referred to in Sub-paragraph 9.3 of this Regulation shall meet the following conditions of the data transmission channels:

8.1. encrypt or use appropriate transport layer protection when transmitting personal data electronically;

8.2. use strong encryption algorithms and secure keys;

8.3. manage encryption keys;

8.4. adequately protect all passwords and encryption keys.

III. Requirements for Access to the E-address Information System and Use of Application Programming Interface

9. The E-address Information System shall ensure access to the e-address account and the E-address Catalogue in the following ways:

9.1. by using the functionality of the website (www.latvija.lv) to a natural person, a person not registered in the registers, or a natural person who represents a legal entity registered in the registers of the Enterprise Register (hereinafter - the register) identified in the E-address Information System in accordance with Section 9 of the Law on the Official Electronic Address;

9.2. by using the functionality of the common service management system of State and Municipal Unified Customer Service Centres to a user of the e-address account identified in the E-address Information System - a State institution;

9.3. by using a software interface of the E-address Information System (hereinafter - the application programming interface) available in the infrastructure of the State information system integrator (hereinafter - the SISI) administrated by the State Regional Development Agency to a user of the e-address account identified in the E-address Information System - a State institution or a legal entity registered in the registers.

10. The E-address Information System shall ensure that the e-address account of a legal entity registered in the register may be accessed by all natural persons identified in the E-address Information System whose right to represent the relevant legal entity is registered in the registers without restricting the right to access the e-address account according to the scope of the right of representation (individually or jointly) or to which the right has been granted in accordance with Paragraph 17 of this Regulation.

11. The E-address Information System shall obtain the following current information from the Enterprise Register:

11.1. regarding natural persons (a legal entity registered in the registers, including a private person to whom a State administration function has been delegated, whose right to represent the legal entity registered in the registers has been registered in the Enterprise Register) - the given name(s), surname, personal identity number, right of representation;

11.2. regarding the head or official of a State institution (the Saeima, the Chancery of the President, court, prosecutor's office, direct administration institutions, derived public persons, indirect administration institutions, and other State authorities) who implements general administrative management thereof (if any) - the given name(s), surname, personal identity number, position.

12. The application programming interface shall ensure a possibility to conduct at least the following activities:

12.1. a possibility to organise exchange of messages and automatic sending of message from the information system of a user of the e-address account to the E-address Information System;

12.2. access to the E-address Catalogue in the information system of a user of the e-address account;

12.3. availability of the information referred to in Sub-paragraphs 6.3 and 6.4 of this Regulation.

13. The users of the e-address accounts referred to in Sub-paragraph 9.3 of this Regulation shall log on, identify themselves, and use the application programming interface in accordance with the laws and regulations regarding the State information system integrator. The E-address Information System manager shall publish the established procedures and support documentation for integration of the application programming interface on the SISI website (www.viss.gov.lv).

14. The users of the e-address accounts referred to in Sub-paragraph 9.3 of this Regulation shall be responsible for compliance with the security and technical requirements of their information system, storage of messages, as well as compliance with the laws and regulations regarding security of the State information systems and information technologies. The E-address Information System manager shall not be responsible for any possible losses to third parties, for loss of information, or for data becoming available to third parties which arises from activities of the information system of the users of the e-address accounts referred to in Sub-paragraph 9.3 of this Regulation.

IV. Procedures for Managing E-address and Its Account

15. The E-address Information System shall create an e-address and activate an e-address account in the following cases:

15.1. a natural person or a person not registered in the registers has electronically signed up for creation of an e-address in the E-address Information System in accordance with Section 9 of the Law on the Official Electronic Address via the State administration service portal (www.latvija.lv), and at the moment of signing up:

15.1.1. the condition referred to in Section 11, Paragraph three of the Law on the Official Electronic Address has not been met;

15.1.2. this person does not have an already created e-address;

15.2. for a legal entity registered in the registers after the end of the transition period specified in Paragraph 3 of the Transitional Provisions of the Law on the Official Electronic Address automatically if at the moment of creation of the e-address:

15.2.1. it has not been excluded from the registers;

15.2.2. it does not have an already created e-address;

15.3. for a State institution automatically if at the moment of creation of the e-address:

15.3.1. it has not been excluded from the List of Public Persons and Entities, the Insolvency Register, or the Register of Enforcement Cases;

15.3.2. it does not have an already created e-address.

16. The E-address Information System shall create one e-address and activate one e-address account:

16.1. for a natural person if it is concurrently a reserve soldier or a person not registered in the registers;

16.2. for a legal entity registered in the registers if it is concurrently a private person to whom a State administration function has been delegated.

17. The E-address Information System shall ensure a possibility for the user of the e-address account referred to in Sub-paragraph 9.1 of this Regulation to use the following management functions for the access rights of the E-address Information System:

17.1. to specify another natural person to whom the right to access the e-address account is to be granted in order to conduct the following activities:

17.1.1. to view messages of a natural person or a person not registered in the registers;

17.1.2. to view, send or delete messages of a legal entity registered in the registers;

17.2. to change or revoke the right granted to another user specified in the e-address account.

18. State institutions shall manage their users of the e-address account in accordance with the laws and regulations regarding the State information system integrator. The E-address Information System manager shall publish the abovementioned laws and regulations on the SISI website (www.viss.gov.lv).

19. The E-address Information System shall ensure a possibility for the user of the e-account address referred to in Sub-paragraph 9.1 of this Regulation to specify an electronic mail address in the e-address account to which an informative notification of the receipt of a message in the e-address account will be sent. The E-address Information System manager shall not be responsible for the failure to receive such messages to the specified electronic mail address if delivery of the notification fails for the reasons beyond control of the E-address Information System manager.

20. The E-address Information System shall make the following changes in the status of an e-address account of a natural person or a person not registered in the registers:

20.1. deactivate the e-address account if the natural person or the person not registered in the registers has requested it electronically by using functionality available in the e-address account:

20.2. deactivate the e-address account within five working days from the moment the E-address Information System manager has received an application of the natural person or the person not registered in the registers, if it is not possible to exercise it in accordance with the procedures specified in Sub-paragraph 20.1 of this Regulation;

20.3. deactivate the e-address account in the case specified in Section 11, Paragraph three of the Law on the Official Electronic Address if the Prisons Administration has provided information regarding such persons in accordance with Sub-paragraph 28.4 of this Regulation;

20.4. re-activate the e-address account if the natural person or the person not registered in the registers has requested it electronically by using functionality available in the e-address account.

21. Change of the status of the e-address account shall not be admissible more than once every 24 hours.

22. If the e-address account has been deactivated, the user of the e-address account referred to in Sub-paragraph 9.1 of this Regulation may access its messages in the e-address account for five years from the day of the receipt thereof.

23. The E-address Information System shall cancel an e-address in the cases specified in Section 11, Paragraph one of the Law on the Official Electronic Address and automatically deactivate also the e-address account. If an e-address has been cancelled, a legal successor of the user of the relevant e-address account may access the content of the e-address account referred to in Sub-paragraph 9.1 of this Regulation for five years from the day of receipt of the messages.

24. Exchange of messages to or from the deactivated e-address account shall not be available.

25. After cancellation of the e-address and deactivation of the e-address account the E-address Information System manager shall store historical data thereof.

V. Procedures for Keeping the E-address Catalogue

26. At least the following information regarding an e-address shall be collected in the E-address Catalogue:

26.1. the element of the e-address (identifier);

26.2. the given name(s), surname or the name of the user of the e-address account;

26.3. the type of the user of the e-address account;

26.4. the status of the e-address and account thereof.

27. The register institutions shall provide structured and current information regarding e-addresses to be created and cancelled, as well as information which determines changes in the status of an e-address account for the E-address Catalogue by using the software interface of the E-address Information System.

28. The register institutions shall provide the following information:

28.1. the Office of Citizenship and Migration Affairs regarding a natural person - the given name(s), surname, personal identity number, date of birth, and information regarding the date of registering the fact of death;

28.2. the Enterprise Register:

28.2.1. regarding a legal entity registered in the registers and a State institution (a private person to whom a State administration function has been delegated) - the name, registration number, information regarding the fact of exclusion from the registers;

28.2.2. regarding a State institution (the Saeima, the Chancery of the President, courts, prosecutor's offices, direct administration institutions, derived public persons, indirect administration institutions and other State authorities) - the name, registration number, type, information regarding the fact of exclusion from the List of Public Persons and Entities;

28.2.3. regarding an administrator of insolvency proceedings - the given name(s), surname, number of administrator's certificate assigned by the Insolvency Administration, information regarding the fact of exclusion from the Insolvency Register;

28.3. the Court Administration regarding a sworn bailiff - the given name(s), surname, registration number, and information regarding the fact of exclusion from the Register of Enforcement Cases;

28.4. the Prisons Administration regarding a natural person who has an activated e-address account - information that the natural person is imprisoned, except for the information regarding a natural person who serves the deprivation of liberty sentence in an open prison.

29. The entities referred to in Sub-paragraphs 9.2 and 9.3 of this Regulation, as well as the register institutions shall cooperate with the E-address Information System manager in accordance with the laws and regulations regarding the use of the State information system integrator without concluding a mutual agreement.

VI. Conditions of the Storage of Messages and Their Metadata

30. The E-address Information System shall store the following:

30.1. the messages - for five years without amount restrictions from the day of receipt of communications in the E-address Information System if the type of access referred to in Sub-paragraph 9.1 of this Regulation is used;

30.2. the information referred to in Sub-paragraph 6.2 of this Regulation - consistently, without amount restrictions;

30.3. the information referred to in Sub-paragraph 6.5 and Paragraph 7 of this Regulation - in accordance with the laws and regulations regarding the conformity of information and communications technologies systems with the minimum security requirements.

31. The E-address Information System shall delete messages from the e-address account after five years from the day of receipt of communications. If messages have been deleted by the user of the e-address account itself, the system shall ensure a possibility to restore the messages deleted by the user of the e-address account within 30 days from the moment of deletion thereof. The E-address Information System shall not allow the user of the e-address account to delete unread messages, unless five years have passed from the day of receipt of communications.

32. If the user of the e-address account is a legal entity registered in the registers, the right to delete messages may only be exercised by the persons entitled to represent the legal entity registered in the registers who have a separate right of representation to conduct the activities specified in Sub-paragraph 17.1.2 of this Regulation.

33. The E-address Information System shall ensure a possibility for the user of the e-address account referred to in Sub-paragraph 9.1 of this Regulation to identify messages the storage period of which is due, as well as ensure a possibility to download messages onto the end device of the user of the e-address account.

VII. Procedures for Using the E-address Information System

34. Any user of an e-address account has an obligation to, immediately but not later than 24 hours after identification of an event, inform the E-address Information System manager of any event when the user of the e-address account identifies a security risk or a security threat has occurred which may affect security and normal operation of the E-address Information System.

35. The E-address Information System manager shall not be responsible for any losses caused to the user of the e-address account due to unavailability of the E-address Information System.

36. The user of the e-address account shall be responsible for all activities conducted in its e-address account. The user of the e-address account shall be responsible for saving a message prior to the end of the period for storage thereof if it deems this appropriate.

37. The user of the E-address Information System shall not be allowed to conduct activities against security, stability and speed of operation of the E-address Information System. The user of the E-address Information System shall comply with the regulations regarding the use of the E-address Information System.

VIII. Closing Provisions

38. For a legal subject registered in the registers during the transition period specified in Paragraph 3 of the Transitional Provisions of the Law on the Official Electronic Address the E-address Information System shall create an e-mail address and activate an e-address account if the natural person who represents the legal entity registered in the registers has electronically signed up for the creation of an e-address via the State administration service portal (www.latvija.lv) and at the moment of signing up it has not been excluded from the List of Public Persons and Entities, the Insolvency Register or the Register of Enforcement Cases, or it does not have an already created e-address.

39. If the entities have concluded an agreement in accordance with the Cabinet Instruction No. 9 of 24 July 2012, Procedures for the Handling of Electronic Documents in the Integration Environment of the Systems for the Management of Public Administration Documents, and the type of access referred to in Sub-paragraph 9.3 of this Regulation is used as an application programming interface, the agreement shall be deemed repealed starting from 1 June 2018.

40. This Regulation shall be applicable to sworn bailiffs, insolvency administrators and judicial authorities starting from 1 January 2020.

41. This Regulation shall come into force on 1 March 2018.

Prime Minister Māris Kučinskis

Minister for Environmental Protection
and Regional Development Kaspars Gerhards

---

Translation © 2018 Valsts valodas centrs (State Language Centre)