VPNs with servers in Latvia

Article 101 lists, for internet access, the end-user identifier, the external IP address or port number assigned to a connection, the user it was assigned to, and connection start and end times, where the operator processes them. A merchant need take no extra steps to obtain data its equipment does not generate (art. 99(3)). Whether a VPN operator is such a merchant is not established.

On 9 June 2022 the President returned the bill to the Saeima, saying articles 99–101 conflicted with EU law and with article 96 of the Constitution. The Saeima adopted it on 14 July 2022 and asked the Cabinet for a bill by the end of that year aligning those rules. Meanwhile data go to the bodies in article 99(1) and (2) under the procedural laws, where necessary and justified (transitional provision 18).

Under article 112 of the Electronic Communications Law, the National Electronic Mass Media Council, assessing information from state institutions, may decide to restrict access to websites available in Latvia that distribute content endangering or capable of endangering state security or public order and security, and to deny access to the site’s domain name or IP address.

It may also order a site to stop promoting or selling equipment or access rights for programmes not on the list of programmes rebroadcast in Latvia, giving three days, and may restrict access to the site if the order is ignored.

The Criminal Law punishes acts directed at triggering national, ethnic, racial or religious hatred or enmity with up to three years’ deprivation of liberty, or probationary supervision, community service or a fine (s. 78(1)). The intentional public distribution of fictions known to be untrue and defamatory, in print or orally, is punished by probationary supervision, community service or a fine, with a heavier range for defamation in the mass media (s. 157).

Retained data identifying the end-user behind an IP address go to the bodies listed in article 99(1), and to the State Police in administrative cases of physical or emotional violence against a child in the electronic environment (art. 99(2)).

Only the head of an institution or an official the head authorises may request retained data; the request states its legal basis, scope and reply deadline; and the merchant must log each request and reply, naming the employee who prepared it (Cabinet Regulation 583 of 20 September 2022, points 2, 4 and 5). A request from the Competition Council or the Consumer Rights Protection Centre must enclose a judge’s decision (point 6).

Replies are due in thirty days for data stored over six months earlier and ten days otherwise, or within three hours or one hour in urgent cases (point 11). The order of the rows is the security score, and a server’s location is not a recommendation.