Republic of Latvia Cabinet Regulation No. 620 Adopted 6 October 2020

Regulations Regarding the Qualification of a Data Protection Officer

Issued pursuant to
Section 18, Paragraph five
and Section 19, Paragraph three
of the Personal Data Processing Law

I. General Provision

1. The Regulation prescribes:

1.1. the procedures by which a person who wishes to take an examination for the qualification of a data protection officer (hereinafter - the applicant) shall apply to take the qualification examination of a data protection officer (hereinafter - the examination);

1.2. the content of the examination;

1.3. the procedures for the course and evaluation of the examination;

1.4. the requirements for the maintenance of the professional qualification;

1.5. the procedures for maintaining the list of data protection officers.

II. Content, Organisation, and Course of the Examination

2. The knowledge and skills of the applicant in the following fields shall be examined in the examination:

2.1. the theoretical basis and legal framework of personal data protection in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter - the General Data Protection Regulation) and the Personal Data Processing Law:

2.1.1. the concepts of personal data protection;

2.1.2. the territorial and material scope of the General Data Protection Regulation;

2.1.3. the principles relating to processing of personal data;

2.1.4. the legal grounds for the processing of personal data;

2.1.5. the rights of a data subject and the obligation of informing the data subject;

2.1.6. the controller and the processor, and also the requirements for ensuring the conformity of the personal data protection;

2.1.7. the transfer of personal data to third countries or international organisations;

2.1.8. the supervisory authority and the consistency mechanism;

2.1.9. the judicial remedies;

2.2. the liability of the controller and personal data protection:

2.2.1. the technical solutions for the processing of personal data;

2.2.2. the maintenance system of information safety and the management thereof;

2.2.3. the risk analysis, management, and audit of the processing of personal data;

2.2.4. the impact of innovative technologies on aspects of personal data protection and the impact assessment on data protection;

2.2.5. the personal data breach;

2.2.6. data protection by design and by default;

2.3. the legal framework for the protection of personal data and case law:

2.3.1. the sectoral legal framework in matters of personal data protection and the interaction thereof with the conditions of the General Data Protection Regulation;

2.3.2. the legal acts of the European Union and other international law governing personal data protection and the impact thereof on the national regulatory framework of Latvia;

2.3.3. case law in the field of personal data protection.

3. The Data State Inspectorate (hereinafter - the Inspectorate) shall, not later than two months before the date of the examination, announce the application for the examination by publishing a notification in the official gazette Latvijas Vēstnesis and the website of the Inspectorate. The notification shall specify the time of the examination, the deadline for the application, and also the procedures for the payment and submission of documents. The deadline for applying for the examination may not be less than one calendar month. The venue for the examination shall be announced by publishing the information on the website of the Inspectorate two calendar weeks before the day of the examination.

4. In order to apply for the examination, the applicant shall submit an application to the Inspectorate. The following shall be indicated in the application:

4.1. the given name, surname;

4.2. the personal identity number;

4.3. the electronic mail address;

4.4. the telephone number, if the applicant wishes to indicate this as an additional means of communication;

4.5. information that payment has been made for taking of the examination or a document certifying payment or a copy thereof (uncertified) shall be attached.

5. The applicant shall pay for taking of the examination in accordance with the amount specified in the laws and regulations regarding the price list of paid services of the Inspectorate and the procedures for payment. The applicant has the right to withdraw his or her application in writing before the end of the application deadline stipulated by the Inspectorate and to receive back the money paid for taking of the examination.

6. The Inspectorate shall assess the application referred to in Paragraph 4 of this Regulation and the documents appended thereto and shall send a notification regarding a permit to take the examination or a refusal for taking of the examination to the applicant electronically within two weeks after receipt of the application. If the Inspectorate detects deficiencies in the application referred to in Paragraph 4 of this Regulation, it shall specify a time limit for the applicant to rectify the deficiencies.

7. The Inspectorate shall send to the applicant a refusal for taking of the examination and shall refund the money paid if any of the following reasons exist:

7.1. the applicant has missed the specified deadline for the application;

7.2. the applicant has not paid in full for taking of the examination;

7.3. the information referred to in Paragraph 4 of this Regulation has not been provided.

8. Upon arrival at the examination, the applicant shall present a personal identification document to a representative of the Inspectorate. The representative of the Inspectorate shall assign a unique identification code to each applicant prior to the examination.

9. Prior to the examination, the representative of the Inspectorate shall inform the applicants of the procedures for the examination.

10. If the applicant misses the beginning of the examination, he or she has the right to take the examination with the permission of the representative of the Inspectorate but the time for the execution thereof shall not be extended. Such authorisation is not granted if one of the applicants has already completed the examination and left the examination room.

11. If, for justifiable reasons, the applicant does not come to the examination, he or she has the right to take it at the next announced time of the examination and the payment for taking of the examination need not be made for a second time. The applicant shall inform the Inspectorate of his or her absence and the reasons thereof until the beginning of the examination, but, if it is not possible, not later than within one month after the date of the examination. The Director of the Inspectorate shall decide whether the reasons for the absence are to be found justified on the basis of a written application from the applicant to which the documents certifying the justifying circumstances have been appended. The decision of the Director of the Inspectorate may be appealed in accordance with the procedures laid down in the Administrative Procedure Law.

12. If the reasons due to which the applicant has not arrived for an examination are not recognised as justifying or the applicant has not notified the Inspectorate of the absence and the reasons thereof within the time period referred to in Paragraph 11 of this Regulation, the money paid for the taking of the examination is not repaid.

13. During the examination the applicants who are taking the examination and the representatives of the Inspectorate may be present in the room where it is being held (hereinafter - the examination room).

14. The examination proceedings shall be recorded in minutes by a representative of the Inspectorate. The minutes of the examination shall be signed by the representatives of the Inspectorate present at the relevant examination. The following shall be indicated in the minutes:

14.1. the date and venue of the examination proceedings;

14.2. the representatives of the Inspectorate present at the relevant examination;

14.3. the starting and finishing time of the first and second parts of the examination;

14.4. the applicants who miss the start of the first or second part of the examination, and also the time when they have arrived;

14.5. the applicant who leaves the examination room during the first or second part of the examination, and also the time when the applicant leaves the examination room and returns to it;

14.6. the time when the last applicant has handed in the examination sheet of the first and second part of the examination;

14.7. the number of applicants;

14.8. other events related to the examination proceedings.

15. The Inspectorate shall prepare the examination questions and tasks.

16. The examination has two parts:

16.1. in the first part the applicant shall provide written answers to 60 test questions divided into three sections in conformity with the fields referred to in Paragraph 2 of this Regulation - 30 questions regarding the field referred to in Sub-paragraph 2.1 of this Regulation, 20 questions regarding the field referred to in Sub-paragraph 2.2 of this Regulation, and 10 questions regarding the field referred to in Sub-paragraph 2.3 of this Regulation;

16.2. in the second part the applicant shall address two practical tasks in writing.

17. The examination shall take place in one day. The duration of one part of the examination is two hours.

18. The applicant shall take the first and second parts of the examination by using an examination sheet. The identification code referred to in Paragraph 8 of this Regulation shall be indicated on the examination sheet.

19. The applicant is prohibited to use the texts of laws and regulations, legal literature, means of communication (for example, telecommunication means, electronic notebooks), and other aids during the examination. In the second part of the examination it is permitted to use the ancillary materials issued by the Inspectorate.

20. The applicant is prohibited from speaking and disturbing other applicants during the examination, and also from leaving the examination room without the permission of a representative of the Inspectorate.

21. If the applicant does not comply with the prohibitions referred to in Paragraph 19 of this Regulation, a representative of the Inspectorate shall make a note regarding the warning expressed in the minutes and on the examination sheet of the applicant and remove the relevant applicant from the examination room. If the applicant does not comply with the prohibitions referred to in Paragraph 20 of this Regulation, a representative of the Inspectorate shall express a warning and make a note regarding the warning expressed in the minutes and on the examination sheet of the applicant. If the applicant repeats the violation following the receipt of a warning, a representative of the Inspectorate shall make a note regarding the warning expressed in the minutes and on the examination sheet of the applicant and remove the relevant applicant from the examination room. After removal of the applicant from the examination room, a representative of the Inspectorate shall prohibit the applicant from taking part in the subsequent taking of the examination and shall make a note in the minutes that the examination has not been passed.

22. It shall be permitted to temporarily leave the examination room during the examination proceedings upon receipt of the permit of a representative of the Inspectorate. A representative of the Inspectorate shall allow only one applicant to leave the examination room at a time. In such case, the applicant shall hand over his or her examination sheet to the representative of the Inspectorate and the representative of the Inspectorate shall note the fact and time of absence on it. The time for the execution of the examination shall not be extended for the applicant.

23. At the end of the time of preparation of the answers or after completing the preparation of the answers prior to the specified time, the applicant shall hand over the examination sheet to a representative of the Inspectorate.

24. After handing over the examination sheet, the applicant shall leave the examination room.

III. Examination Evaluation Commission

25. The knowledge of applicants in the examination shall be evaluated by an Examination Evaluation Commission established by an order of the Director of the Inspectorate (hereinafter - the Commission). The Commission shall consist of at least three members. The members of the Commission may be persons with knowledge and practical experience in personal data protection.

26. The members of the Commission shall be responsible for the confidentiality of the contents of the examination.

IV. Procedures for the Evaluation and Notification of the Results

27. The Commission shall not evaluate the examination work or a part thereof and shall not make a record on the examination sheet or in the minutes if it detects one of the following circumstances:

27.1. the applicant has indicated the given name, surname, or other identifying data (except for the identification code referred to in Paragraph 8 of this Regulation) on the examination sheet;

27.2. the answers on the examination sheet have been provided by writing them in pencil;

27.3. the handwriting of the applicant is illegible;

27.4. the examination sheet contains a notice made by a Commission member present at the relevant part of the examination indicating that the applicant has committed the violation referred to in Paragraph 19 of this Regulation or two of the violations referred to in Paragraph 20 of this Regulation.

28. The first part of the examination has been passed if the correct response rate is at least 80 % and the proportion of the correct answers provided within each section is not less than 30 %. The Commission shall not assess the second part of the examination if a negative evaluation has been received in the first part of the examination.

29. The answers of the second part of the examination shall be evaluated in the 10 point grading system according to the examination criteria (Annex 1).

30. Each member of the Commission shall assess the answers of the applicant to all questions of the second part of the examination, the evaluation of each answer shall be recorded on the evaluation sheet of the second part of the examination (Annex 2), and, if necessary, a brief justification for the evaluation shall be attached. After evaluating all the answers, a member of the Commission shall record the total evaluation of all the answers which is obtained by adding up the answer evaluations for the second part of tasks and dividing it by the total number of questions for both tasks. The arithmetic result obtained, if necessary, shall be rounded to an integer (a decimal number followed by the decimal point "5" or greater than "5" is rounded up) and the examination sheet shall be signed. If the arithmetic result obtained does not reach four points, it shall not be rounded and in such case the result shall be one, two, or three points respectively (unsatisfactory evaluation).

31. The second part of the examination has been passed if, after distribution of the total amount of evaluations awarded by all members of the Commission (who participate in the evaluation of the examination), the applicant has received at least seven points. The arithmetic result obtained, if necessary, shall be rounded to an integer (a decimal number followed by the decimal point "5" or greater than "5" is rounded up).

32. The evaluation of the Commission shall be indicated in the minutes. The evaluation sheet completed by each member of the Commission shall be appended to the minutes.

33. The Chairperson of the Commission shall, within 10 working days after the end of the examination, submit to the Director of the Inspectorate the minutes signed by the Commission regarding the examination results of the applicants.

34. The Director of the Inspectorate, on the basis of a report submitted by the Commission, shall take a decision within five working days on the inclusion of the applicant in the list of data protection officers (hereinafter - the list), if the applicant has successfully passed the examination or on the refusal to include the applicant in the list if he or she has not passed the examination.

35. The Inspectorate shall send the decision referred to in Paragraph 34 of this Regulation to the applicant to the electronic mail address indicated in his or her application within five working days after taking of the decision.

36. If the applicant has not passed the examination, he or she is entitled to reapply for the taking of the examination. The number of examinations is not limited.

V. Procedures for Maintaining the List

37. The Inspectorate shall update the list on its website without delay but not later than within five working days after taking of the decision on the inclusion of a data protection officer in the list.

38. The Inspectorate shall take the decision on the making of amendments to the list or on the refusal to make amendments to the list within 15 working days after receipt of the notification of a data protection officer regarding the errors detected and the amendments to the information which has been included on him or her in the list.

39. The Inspectorate has the right to request documents or their copies from a data protection officer which certify the facts specified in the notification referred to in Paragraph 38 of this Regulation.

VI. Requirements for the Maintenance of Professional Qualification

40. In order to maintain a qualification, a data protection officer as a trainer or a training participant shall participate in measures for raising a qualification (hereinafter - the training) in the field of personal data protection or in another field which is related to the performance of the duties of a data protection officer (not less than 36 academic hours within three years after being included in the list or taking of the decision referred to in Sub-paragraph 50.1 of this Regulation of which not less than 18 academic hours are in the field of personal data protection).

41. A data protection officer may participate as a trainer or a training participant in the training activities of the Inspectorate, the training organisers referred to in Paragraph 42 of this Regulation, other institutions or legal persons, other State data supervisory authorities or training institutions, professional organisations of data protection officers or international data protection organisations, if such training is organised in the field of personal data protection or in another field related to the performance of the duties of a data protection officer.

42. Training in the field of personal data protection in Latvia shall be organised by the Inspectorate or training organisers. The trainer shall have the knowledge and practical work experience of at least the last four years in the field of personal data protection.

43. The training organiser referred to in Paragraph 42 of this Regulation shall submit to the Inspectorate a statement regarding the organisation of training in Latvia not later than two months before commencing the training. Documents certifying the qualifications and experience of trainers and the training programme shall be appended to the notification.

44. The Inspectorate shall evaluate the notification referred to in Paragraph 43 of this Regulation and, within one month, shall take the decision on the conformity of the intended training with the measures for raising the qualification in the field of personal data protection.

45. The Inspectorate shall publish on its website the information at its disposal on:

45.1. training in the field of personal data protection in Latvia which, in accordance with Paragraph 44 of this Regulation, should be recognised as a measure for raising the qualification of a data protection officer, indicating the number of academic hours which are allocated for the attendance thereof;

45.2. the data supervisory authorities of other countries, professional organisations of data protection officers, and international data protection organisations the training organised by which should be recognised as a measure for the raising of the qualification of a data protection officer in the field of personal data protection;

45.3. other training organised in foreign countries in the field of personal data protection, and also training organised in Latvia or in foreign countries in areas related to the performance of the duties of a data protection officer.

46. A data protection officer shall, not later than three years and two months from the date of the decision on the inclusion of a data protection officer in the list or the decision on the recognition of the maintenance of a qualification, submit to the Inspectorate an application for the recognition of the maintenance of the qualification of a data protection officer (Annex 3). The documents available to the data protection officer which certify the duration of all the training activities attended and the successful completion thereof, the information on the training organiser, the orientation and subject of the training, the programme, the target audience of the training, a statement regarding the relevant number of academic hours obtained by participating as a trainer or as a training participant in a measure for raising the professional qualification shall be appended to the application.

47. The Inspectorate shall evaluate the conformity of the training referred to in the application for the recognition of the maintenance of the qualification of a data protection officer for the fields in which the maintenance of the qualification of a data protection officer is required, information on the training organiser, the information on the duration of the training attended, participating as a trainer or as a training participant, the number of academic hours to be determined for training, and the information on successful completion of the test if such was intended at the end of the training.

48. One academic hour shall be determined for the training for each astronomical hour (60 minutes) if the training meets the following criteria:

48.1. the training organiser - the Inspectorate, an accredited educational institution of Latvia or other countries, a public administration institution, a legal person, an association of persons or a foundation, a professional organisation of data protection officers of Latvia or other countries, or an international data protection organisation;

48.2. the orientation and subject of the training - training for an audience with previous knowledge, the subject of the training attended is related to the protection of personal data or another field related to the performance of the duties of a data protection officer.

49. Academic hours shall be determined in double amounts for the training for which the final test has been completed, if such was intended at the end of the training, and also if the data protection officer participates in the training as a trainer (lecturer, rapporteur at a conference).

50. The Inspectorate shall, within one month after receipt of the information referred to in Paragraph 46 of this Regulation, take one of the following decisions:

50.1. to fully recognise the training as a measure for raising the qualification of a data protection officer, determining the number of academic hours, and to recognise the maintenance of the qualification of a data protection officer;

50.2. to refuse to recognise the training as a measure for raising the qualification of a data protection officer and to exclude the data protection officer from the list;

50.3. to partly recognise the training as the raising of the qualification of a data protection officer and the maintenance of the qualification of a data protection officer, determining the duty of the data protection officer to participate in the number of academic hours specified in the training, if the duration of the training attended by a data protection officer is at least 18 academic hours but less than 36 academic hours.

51. The data protection officer shall, not later than four months from the date of taking of the decision referred to in Sub-paragraph 50.3 of this Regulation, re-submit to the Inspectorate an application for the recognition of the maintenance of the qualification of the data protection officer (Annex 3).

52. The Inspectorate shall, within 15 working days, evaluate the re-submitted application for the recognition of the maintenance of the qualification of a data protection officer and take the decision referred to in Sub-paragraph 50.1 or 50.2 of this Regulation.

53. If a data protection officer has been excluded from the list, he or she may re-take the examination.

VII. Closing Provisions

54. If a data protection officer has been included in the list prior to the date of the coming into force of this Regulation, the requirements for the maintenance of the professional qualification provided for in this Regulation shall be applicable thereto counting a period of three years from the date of the coming into force of this Regulation.

55. The Regulation shall come into force on 9 October 2020.

Prime Minister A. K. Kariņš

Deputy Prime Minister,
Minister for Justice J. Bordāns

 

Annex 1
Cabinet Regulation No. 620
6 October 2020

Evaluation Criteria of the Second Part of the Qualification Examination of a Data Protection Officer

No.	Evaluation	Explanation, evaluation criteria	Level of acquisition
1.	10	Excellent understanding of the laws and regulations required in the professional activity of officers. Excellent skills to use the acquired knowledge independently. Ability to work as an expert of the sector	With distinction
2.	9	Complete understanding of the laws and regulations required in the professional activity of officers. Skills acquired to use the acquired knowledge independently	Excellent
3.	8	Sufficient understanding of the laws and regulations required in the professional activity of officers. Is able to use the acquired knowledge and skills in standard situations but an insufficient understanding of some complex issues has been identified	Very good
4.	7	The laws and regulations required in the professional activity of officers have been acquired, skills to use the acquired knowledge independently have been acquired but some minor deficiencies have also been identified in solving of the most complex issues	Good
5.	6	Satisfactory understanding of the laws and regulations required in the professional activity of officers, skills to use the acquired knowledge independently have been acquired but an insufficient level of understanding of individual issues and the inability to use the acquired knowledge to address individual issues have been identified	Almost good
6.	5	Overall a satisfactory understanding of the laws and regulations required in the professional activity of officers, partial skills to use the acquired knowledge independently have been acquired but significant deficiencies in the ability to use acquired knowledge in practice have been identified	Satisfactory
7.	4	Superficial knowledge of the laws and regulations required in the professional activity of officers has been acquired, but there is no ability to use the acquired knowledge and skills	Almost satisfactory
8.	3	Superficial knowledge of the laws and regulations most frequently used in the professional activity of officers has been acquired but there are no skills to use these practically	Poor
9.	2	Very poor knowledge of the laws and regulations most frequently used in the professional activity of officers and there are no skills to use these practically	Very poor
10.	1	No understanding of the laws and regulations most frequently used in the professional activity of officers. No knowledge and skills required in the professional activity of officers	Unsatisfactory

Deputy Prime Minister,
Minister for Justice J. Bordāns

 

Annex 2
Cabinet Regulation No. 620
6 October 2020

Evaluation Sheet for the Second Part of the Qualification Examination of a Data Protection Officer

Date of taking the examination

Applicant identification code

Notes

Question number	Task 1	Task 2	Notes
Total evaluation (1-10)

Member of the Commission
	(given name, surname, signature)

Deputy Prime Minister,
Minister for Justice J. Bordāns

 

Annex 3
Cabinet Regulation No. 620
6 October 2020

To the Data State Inspectorate

Application for the Recognition of the Maintenance of Professional Qualification

I. General Information

Given name, surname of the data protection officer

Telephone number of the data protection officer

E-mail address

II. Information on Measures for Raising the Professional Qualification

No.	Training type and name	Training organiser	The place and time of the training	The orientation and subject of the training	The target audience of the training	Duration of the training (academic hours)	Certification that the final test has been successfully passed or he or she has participated in the training as a trainer	Attached document or other source of information certifying the duration, place of the training, issues to be examined, and the participation of an officer in the measure

I certify that the information provided on the measures to raise the professional qualification is true.

(signature of the officer)		(date)

Deputy Prime Minister,
Minister for Justice J. Bordāns

---

Translation © 2021 Valsts valodas centrs (State Language Centre)