Can Your Apartment Association Name and Shame Debtors? A GDPR Reality Check for Latvia and Estonia
Last October I sat in on a board meeting of a small OSMD in Āgenskalns. Nine apartments, a brick building from the 1930s, heating bills pinned to a cork board next to the mailboxes. The chairwoman — a retired math teacher, I'll call her Ilga — had printed a fresh list: names, apartment numbers, amounts owed, three rows highlighted in yellow marker.
"They'll pay once the whole building sees it," she said.
I had to tell her that, legally, the whole building should not see it. She looked genuinely offended. And I get it. If someone owes the building money, surely the rest of us have a right to know who's dragging everyone down?
That instinct is exactly where the trouble starts.
You're a data controller, whether you like it or not
Every apartment association in Latvia and Estonia is quietly running a small personal-data operation. Owners' names and contact details. Land register extracts. Meter readings tied to specific households. Bank account references for direct debits. Sometimes footage from a camera above the front door.
Under the GDPR, that makes the association a data controller — the same legal category a bank or a telecom sits in. Size changes nothing here. Plenty of board members genuinely believe the opposite: "we're nine people, the GDPR can't possibly apply to us." That myth is worth killing now. National carve-outs for small organizations soften some paperwork duties, but never the core principles: you need a legal basis for each thing you store, you have to be able to explain it, and you can't keep data forever.
The theoretical fine ceiling is absurd for an association our size — penalties scale up to 4% of annual turnover — yet the realistic outcome for a nine-apartment OSMD is an inspection, an order to fix things, and, if you ignore the order, a fine. Annoying, survivable, avoidable.
What you almost certainly don't need: a formal data protection officer. What you absolutely do need: one board member who knows what the association keeps and why. If that person is you, keep reading.
The debtor list: what Ilga got wrong
Publishing a person's name next to their debt, in a stairwell any stranger walks through, is the single most common privacy problem in Baltic apartment management. Latvia's data protection authority, Datu valsts inspekcija, has heard the justification so many times that its position is nearly folklore: a debt owed to the building does not give the building permission to broadcast who owes it.
The reasoning is proportionality. The association has quieter tools — a reminder, then a formal warning, then a debt collector — that recover the money without exposing one person's financial situation to every neighbor, courier and teenager with a phone camera.
What actually works, in descending order of safety:
- Hand the debtor a reminder in a sealed envelope. Most cases end here, honestly.
- Publish only the aggregate: "together, our neighbors owe €4,120." A total names nobody.
- If the association's statute or management contract genuinely requires disclosure to owners, then a list by apartment number, without names, posted in a closed area only owners can reach, for weeks — not months.
Here's the detail that stung Ilga most. Two of her highlighted debts dated back to 2019. In both Latvia and Estonia, the general limitation period for payment claims is three years. Those debts were likely time-barred — effectively uncollectible — yet the personal data about them had been sitting in a shared folder since the winter when we all still bought face masks. Hoarding data you can no longer act on is precisely what the GDPR calls excessive.
Estonia settled the argument in 2019
Estonian lawmakers got tired of this fight and amended their Apartment Associations Act: an association may disclose the summed-up total of its members' debts, and nothing more. Naming a specific debtor publicly requires that person's written consent. Without it, the claim goes to a debt collector or a court — and handing it to those parties is what the law explicitly allows instead.
The practical effect is boring and wonderful. Estonian boards stopped arguing about yellow highlighters years ago. In Latvia, where no such explicit OSMD rule exists, boards are left to reason it out for themselves — which is why the three-step ladder above matters more on this side of the border.
That camera above the front door
Half the associations I visit in Riga have one. Maybe a third of those put up a sign that actually satisfies the law: that the entrance is being monitored, by whom, and for what purpose — in Latvian, visible before a person steps inside. A camera with no sign isn't protecting the building. It's breaking the law on the building's behalf.
Two rules of thumb beyond the sign. Retention: recordings exist so an incident can be reviewed, and keeping them around 30 days is a common defensible practice; keeping them a year is hoarding. Access: the chair watches footage when something happened — not whichever kids hang out by the entrance. I once saw a stairwell camera aimed squarely at one neighbor's bike rack, the result of a dispute between him and the board member who installed it. That's not protecting property. That's surveilling a grudge, and it will look excellent in a complaint to the regulator.
The month-long clock
Sooner or later a letter lands: a former owner wants to know everything the association holds about them. The GDPR gives you one month to answer, in plain language — what you store, why, who receives it, for how long. It's an hour of copying files, provided you actually know where the files are.
Three requests worth preparing for in advance: a copy of personal data; a demand to delete records of an ancient debt; and the classic "where did you get my phone number?" The answer, usually, is the land register or the previous owner — both a legal basis, so no, you don't need anyone's consent to bill them for their own apartment.
Four things to do this week
- Pick your data person. One name, written down.
- Print a one-page privacy notice — what the association collects, on what basis, for how long — and pin it in the stairwell next to the heating bills.
- Audit the front-door camera: is there a sign, who can watch the footage, when does it get deleted?
- Empty the archive. If a paper trail can no longer help collect anything — time-barred debt, closed utility account — shred it.
Then close that folder for another six months.
Back to Ilga
Her list went into the shredder. In its place: a plain letter to each debtor with a payment schedule, no names anywhere. Two of the three accounts were paid in full before spring. The third debtor even showed up at the annual meeting, because he lives there.
Turns out shame wasn't the missing ingredient. A specific, dated, human plan was.
