"Technically and legally unregulated, non-functional. In my opinion, it is incorrect to launch something like this now," says jurist Lauris Klāgišs about the new mobile application of the State Revenue Service (SRS) "Mans VID." In his opinion, the SRS undermines trust in itself as a state institution by offering the application in test mode, where the security of personal sensitive data is not guaranteed. Currently, the application lacks a "privacy policy," writes tv3.lv.
Jurist Lauris Klāgišs is also a certified data protection specialist. In a phone conversation with the portal "tv3.lv" he stated that immediately after the launch of the new application "Mans VID" last week, he began receiving calls from clients, friends, and acquaintances. People were asking for the lawyer's opinion on the new application.
"Several people drew my attention and asked me to check whether personal data protection is being complied with. People also reported that the application does not work for everyone," Klāgišs explains.
Recall that the SRS presented the new application "Mans VID" last Wednesday, February 18. The service positioned it as a more convenient way to upload medical and educational receipts for annual declarations in the electronic declaration system (EDS). The new application also allows users to work with the tax book for wages, for example, marking tax benefits.
To personally test the new application and since he uses the EDS system in everyday life, Klāgišs also downloaded "Mans VID" on his phone. He immediately noted that the new SRS application indeed does not contain a "privacy policy," as required by the General Data Protection Regulation, which aims to ensure the protection of residents' data in European Union countries. The regulation stipulates that the principles of personal data protection apply in any information technology infrastructure — from websites to mobile applications.
"The new SRS application involves the processing of personal data — medical and educational receipts, invoices. This is sensitive information about financial and health status, so the user of the application has the right to know: how, who, and for what purpose will process and store such information," Klāgišs explains the security risks.
The "privacy policy" of the "Mans VID" application, as the lawyer found out, is not available either in the application itself or in the "Privacy Policy" section on the SRS website.
The State Revenue Service categorically denies to the portal "tv3.lv" that the new application violates data protection regulations. The service explains that information on the processing of personal data when using the mobile application "Mans VID" is publicly available on the SRS website. It is also noted that the principles of data processing in the mobile application are the same as when working in the EDS system.
In an email response to the portal "tv3.lv," the service emphasizes that all data processed in the application are processed in accordance with the General Data Protection Regulation, user data is not shared with third parties, and is stored in the secure infrastructure of the SRS.
The portal "tv3.lv" and Klāgišs himself tried to find the "privacy policy" of "Mans VID" on the service's website, but it turned out to be not easy. After several minutes of searching, they managed to find the section "Processing of Personal Data in the SRS," where the new application "Mans VID" is mentioned at the end.
The lawyer believes that by placing important information deep within the website, the SRS violates individuals' rights to data protection. "How can a person who may not be very well versed in the internet find this information?" Klāgišs rhetorically asks. "I believe this is a serious violation. Information about data processing should be easily accessible and placed exactly where the data is processed — that is, in the application," the lawyer concludes. As a positive example, he cites the application "e-paraksts," where information about data processing is conveniently located in the "Settings/Privacy Policy" section.
Klāgišs personally does not intend to use the new application "Mans VID" to submit receipts and invoices to the EDS system and does not recommend others to do so. His caution is related both to data processing and the fact that the application is launched in test mode. He fears that due to a system error, uploaded receipts may become publicly available, appear as belonging to another user, or not upload at all without notification.
These concerns are heightened by the fact that he has still not been able to log into the application using "e-paraksts" for authentication. Furthermore, on the morning of February 24, it was not possible to log into the application using "SmartID." "Who can guarantee that there will be no data leak in such a situation?" the lawyer questions.
"I personally do not understand why the SRS launched such an application in test mode in such a hurry. Usually, applications are tested in a closed environment, for example, among 3000 SRS employees, not among a million residents. Errors are acceptable in a test environment, and should we, the residents, be guinea pigs..." Klāgišs says.
In response to the question of why the application is offered to residents in test mode, the SRS indicates that this is done to allow users to try out the functionality in advance and provide feedback. The service also confirms that problems have been identified in some cases when logging in using e-signature, and specialists are working on resolving them.
At the same time, the service emphasizes that the test mode does not affect the security of document submission in any way. If a document fails to upload, the application informs the user. It is also impossible to submit a document without user confirmation. "Documents do not get lost, and the user can submit them again," the SRS assures, adding that trust and data security are a priority in the service's work.
The development of the "Mans VID" application cost the service 13,818 euros excluding value-added tax.
