Last April I stood on the second-floor landing of a 1960s khruschevka in Āgenskalns, waiting for a friend and staring at an A4 sheet taped to the wall. Nine names, apartment numbers, amounts owed to the association — one of them €1,840, underlined twice in red. Someone on the board had printed the list at work, bolded the worst debts, and taped it where every visitor, courier and neighbor could read it.
"Finally somebody is doing something," said a woman coming down the stairs with grocery bags. Maybe. But is it legal?
That question comes up in almost every board meeting I've sat in on, in Riga and in Tallinn. So here is the practical version, without legal-department hedging.
Yes, GDPR applies to your association
An OSMD or korteriühistu is, in GDPR terms, a data controller. You collect names, contact details, bank account numbers, payment histories, sometimes camera footage. That triggers Regulation (EU) 2016/679, whether the association has eight apartments or eighty. There is no registration and no fee, but there are real obligations: you need a lawful basis for processing (Article 6), you must tell people what you collect (Article 13), you must answer access requests within a month (Article 15), and your manager or software provider needs a written data processing agreement (Article 28).
In day-to-day operation, most boards handle all of this without problems. Billing runs, minutes are stored, life goes on. The trouble concentrates in exactly two spots: the printed debt list and the camera above the entrance.
The debt list: show the apartment, not the surname
Processing debt data internally is fine. The association must track who owes what — that's legitimate interest plus the basic duty to manage the building. Publishing it on a stairwell wall is a different legal question.
The test is necessity. Does a full name add anything the neighbors need? The debtor already knows they owe. What the building needs to know is which apartment is behind, and an apartment number does that job completely. Latvia's data protection authority (Datu valsts inspekcija) has taken this position in its practice: public debt lists with names are generally disproportionate, while apartment number plus amount achieves the same pressure without exposing people. The Estonian Data Protection Inspectorate (AKI) reads it the same way for korteriühistud.
There's a practical argument too, and honestly it's the one that convinces boards. Paper lists age badly. The list I saw in Āgenskalns was four weeks old — the woman in apartment 12 had paid in full on the 3rd and was still publicly shamed on the 15th. A name list shames people who have already paid. An apartment list pressures the debt itself.
One real exception: if the association has taken the matter to court, judgments are public, and referencing an open enforcement case is legitimate.
What actually works taped to a wall:
- Apartment 24 — €310.42 outstanding as of 01.09.2026. Please settle with the board.
- A date line, so nobody gets marked for a debt they've already covered.
- A contact line for payment plans. The list's job is to start conversations, not end friendships.
That version costs you nothing legally and, in my experience, collects money at roughly the same rate.
Cameras: allowed, with conditions
Video surveillance in common areas is permitted under legitimate interest — protecting shared property. But "permitted" comes with a checklist that inspection authorities actually verify:
- Signage at every entrance. "The staircase is under video surveillance for property protection. Administrator: [name, email]." A camera without a sign is the single most common finding in staircase-camera cases.
- Retention limits. Keep footage only as long as needed to catch incidents. Fourteen to thirty days with automatic overwrite is the normal range in the Baltics. Start at fourteen; extend only if fourteen proved too short for a real incident.
- View direction. Entrance, staircase, bicycle room — fine. A camera angled at the neighbor's bedroom window or across the public sidewalk is a different processing purpose, and not a lawful one.
- No audio. Microphones record conversations, which are confidential communications. Mute the mic.
- Access control. One or two named people — usually the chair and the manager — keep the footage. Not the board group chat.
That last point deserves a story. A korteriühistu in Tartu had a bike stolen from the stairwell last year. The chairman exported the clip and sent it to all forty-eight members so everyone could "help identify the thief." The problem: the clip also showed visitors, a courier, and a neighbor's teenage kid at 23:40 — personal data of people who never agreed to be distributed to the whole house. That's a personal data breach with a reporting obligation, created by the person trying to help. Footage goes to the police on request. Nobody else.
Your manager is a processor, not a black box
Most associations outsource billing to an apsaimniekotājs or a software service. Under Article 28, that provider is a data processor, and the relationship needs a written processing agreement: what data, for which purposes, how long stored, and what happens at contract end — the member database gets returned or deleted, not forgotten on an old server.
Two checks worth doing this month: does your contract have that clause, and do you know where your member list actually lives? I've seen associations where the full owner register sits in an Excel file on a former board member's personal laptop, three board changes ago. Find your copies. Reduce them.
"What data do you have on me?"
Sooner or later — usually after a conflict — someone sends the association an access request. A member, a tenant, sometimes a former owner. The law gives you one month, extendable by two for genuinely complex cases. You must state which data you hold, where it came from, who has received it, and how long you keep it.
This feels intimidating and isn't. The prepared version is a one-page data register: member list, bank details, payment history, cameras, minutes — with a retention note for each. Article 30 has an exemption for organizations under 250 employees, but debt processing is exactly the kind of processing that authorities consider risky, so keep the register anyway. Thirty minutes of work, and the access request becomes a five-minute answer instead of a panicked search through inboxes.
And a reality check on enforcement: nobody is going to fine a twelve-apartment OSMD millions. What Datu valsts inspekcija and AKI actually do is order compliance, sometimes warn. The real cost of getting this wrong is the neighbor conflict — the person whose name you taped to the wall lives upstairs from you for the next decade.
The board-meeting checklist
Pin this next to the coffee pot:
- Debt lists show apartment number, amount, date — never names.
- Cameras have signs, 14–30 day retention, no audio, restricted access.
- Footage goes only to police, never to the residents' group chat.
- The manager contract has a data processing agreement with a deletion clause.
- A one-page data register exists, and someone knows where it is.
None of this costs money. All of it takes one meeting. And when the next dispute lands on the board, your answer is documented, boring, and legally solid — which is exactly what a volunteer board wants its answers to be.
