[co-authors: Daivis Švirinas and Irma Kirklytė, Sorainen]

Lithuania

In this chapter:

Q1/ Applicable legislation

(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?

Old legislation has been updated.

———

(b) Relevant legislation includes:

• The Law on Legal Protection of Personal Data (“Data Protection Law”)
  • Date in force: 16 July 2018
  • Link: see here

———

(c) What is the status of national pre-GDPR data protection law?

The relevant pre-GDPR legislation has been revised.

———

Q2/ Personal data of deceased persons

Does national law make specific rules regarding the processing of personal data of deceased persons?

There are no specific rules governing this issue.

———

Q3/ Legal bases for processing

(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?

There are no specific rules governing this issue.

———

(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?

There are no specific rules governing this issue.

———

(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?

There are no specific rules governing this issue.

———

(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?

There are no specific additional criteria governing this issue.

———

Q4/ Consent of children

At what age can a child give their consent to processing in relation to ISS?

14 years of age.

———

Q5/ Processing of sensitive personal data

(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?

All sensitive personal data can be processed if the data subject’s valid consent has been obtained.

———

b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:

(i) Employment, social security and/or social protection law

There are no specific rules on processing this category of data.

(ii) Substantial public interest

There are no specific rules on processing this category of data.

(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services

There are no specific rules on processing this category of data.

(iv) Public interest in the area of public health

There are no specific rules on processing this category of data.

(v) Archiving purposes, scientific or historical research purposes or statistical purposes

There are no specific rules on processing this category of data.

———

(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?

There are no specific rules on processing this category of data.

———

Q6/ Data relating to criminal offences or convictions

Under what conditions does national law permit the processing of personal data relating to criminal convictions?

It is forbidden to process the personal data of candidates and employees relating to convictions and offences committed by the candidate or employee, unless such personal data are necessary to verify that a person meets the requirements of law and/or to comply with legislation for the purpose of performing work or other duties.

———

Q7/ Exemptions

(a) Does national law specify exemptions to a data subject’s right to erasure?

There are no specific exemptions to the right to erasure.

———

(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?

There are no specific exemptions to the right to be provided information.

———

(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?

There are no specific exemptions to the right to not be subject to automated individual decision-making.

———

Q8/ Restrictions on data subjects’ rights

Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?

There are no additional restrictions on data subjects’ rights.

———

Q9/ Joint controllership

Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?

There are no additional rules on apportionment of liability between joint controllers.

———

Q10/ Processor

In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?

There are no additional pieces of legislation.

———

Q11/ Impact Assessments

Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?

The DPA has specified that an Impact Assessment must be undertaken in the following cases:

• processing of personal data for the purposes of scientific or historical research where personal data are processed without the consent of the individual or the processing is carried out by linking or matching data sets;
• processing the personal data of minors;
• processing national identification numbers;
• processing of personal data being carried out on a large scale, where personal data is not obtained from the data subject and the provision of notice in certain cases is impossible or would require disproportionate effort, or if the provision of such notice may become impossible or may seriously impede the achievement of the purposes of the processing;
• processing of personal data where the provision of notice on rights relating to rectification, erasure or processing of personal data to recipients who have been disclosed is not possible or would involve a disproportionate effort;
• processing of biometric data for the purpose of specifically identifying a person;
• processing personal data for the purpose of monitoring or controlling individuals;
• processing the personal data of vulnerable persons;
• processing of genetic data in the form of an assessment of personal qualities or scoring, including profiling and prediction;
• processing of CCTV data: (i) in relation to premises that are not owned or controlled by the controller; (ii) in relation to health care, social care, imprisonment and other facilities where services are provided to vulnerable persons, or (iii) with sound recording;
• recording phone calls;
• processing of personal data using innovative technologies or using existing technologies in a new way when processing personal data of vulnerable data subjects;
• processing of personal data of minors for direct marketing purposes, assessment of the personal aspects of minors, based on automated processing, including profiling, or directly offering information society services to minors;
• processing of personal data and/or sound data in the workplace and/or at the premises of the controller or in the areas where its staff are employed; and
• processing of personal data relating to the monitoring of employees, communication, behaviour, location or movement.

———

Q12/ Prior authorisation and public interest

Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?

Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR.

———

Q13/ DPOs

(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?

DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.

———

(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?

DPOs are not subject to secrecy obligations under national law.

———

Q14/ International data transfers

(a) Does national law make specific rules about transfers of personal data from public registers?

Data transfers from public registers are not subject to specific rules.

———

(b) Does national law restrict the transfer of specific categories of personal data to third countries?

Data transfers are not subject to restrictions beyond those set out in the GDPR.

———

Q15/ DPAs

(a) Details of the DPA(s).

• Name of DPA: State Data Protection Inspectorate
  • Address: L. Sapiegos str. 17, 10312 Vilnius, Lithuania
  • Website: ada.lt/go.php/lit/english

———

(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?

The Inspector of Journalist Ethics monitors the application of the GDPR and the Data Protection Law, and ensures that this legislation is applied when personal data are processed for journalistic purposes and for academic, artistic or literary purposes. The Inspector of Journalist Ethics has the same powers as those granted to the DPA by the GDPR.+

———

(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?

The Inspector of Journalist Ethics is responsible for specific issues, in particular, when personal data are processed for journalistic purposes and for academic, artistic or literary purposes.

———

(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?

Data transfers from public registers are not subject to specific restrictions.

———

(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?

Decisions of the DPA can be appealed to the court in accordance with the procedure laid down in the Law on Administrative Proceedings.

———

(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?

There are no specific rules on this issue.

———

Q16/ Claims by not-for-profit bodies

Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?

The Data Protection Law does not explicitly refer to not-for-profit bodies but states that claims submitted by an applicant’s representative must be accompanied by a document attesting the authority of the representatives. If claims are submitted by a not-for-profit body, organisation or association on behalf of an applicant in accordance with Art. 80(1) GDPR or other laws regulating the protection of personal data and/or privacy, then the relevant body must also include in its claim documents confirming it is working in the field of personal data protection.

———

Q17/ Administrative fines, penalties and sanctions

(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?

The Data Protection Law sets out administrative fines which can be imposed on public institutions. The DPA has the right to impose an administrative fine:

• of up to 0.5% of the annual budget of the institution in the current year or of the total annual revenue received in the previous year (but not exceeding €30,000) for the breach of the provisions referred to in Art. 83(4)(a)-(c) GDPR;
• of up to 1% of the annual budget of the institution in the current year or of the total annual revenue received in the previous year (but not exceeding €60,000) for the breach of the provisions referred to in Art. 83(5)-(6) GDPR; or
• in accordance with Art. 83(4)-(6) GDPR, when a public authority or body carries out commercial activities.

———

(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?

There are no additional penalties/sanctions.

———

Q18/ Freedom of expression and information

(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?

There is a general obligation to disapply Arts. 12-23, 25, 30, 33-39, 41-50 & 88-91 GDPR in relation to processing for journalistic, academic, artistic and literary purposes.

———

(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?

As mentioned above, the Data Protection Law provides specific rules and exceptions regarding processing of personal data for journalistic, academic, artistic and literary purposes. When processing data for these purposes, Arts. 12-23, 25, 30, 33-39, 41-50 & 88-91 GDPR do not apply.

———

Q19/ National identification numbers

Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?

The following conditions apply:

• it is forbidden to process national identification numbers for direct marketing purposes; and
• it is forbidden to make the national identification numbers public.

———

Q20/ Processing in the context of employment

(a) For what purposes can employees’ personal data in the employment context be processed under national law?

An employer may collect personal data relating to qualifications, professional skills and business characteristics of a candidate applying for a job from a former employer by duly informing the candidate, and if collecting the data from the existing employer, by receiving consent from the candidate.

Where video and/or audio data is processed in the workplace and at the controller’s premises or in the areas where employees work, and the processing of personal data relates to the monitoring of employees’ behaviour, employees must be informed of such processing in writing or by a method whereby compliance with Art. 13(1)-(2) GDPR can be demonstrated.

It is forbidden to process the personal data of candidates and employees related to convictions and offences committed by the candidate or employee, unless such personal data are necessary to verify that a person meets the requirements of law and/or to comply with legislation for the purpose of performing work or other duties.

———

(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?

There are no specific safeguards of this nature.

———

Q21/ Other material derogations

Are there any other material derogations from, or additions to, the GDPR under national law?

There are no other material derogations.

———

Q22/ Current legal challenges

Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?

There are no current legal challenges ongoing.

———

Q23/ Enforcement

Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?

The DPA has yet to take enforcement action for breaches of the GDPR.

———

Q24/ Regulatory Guidance

Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?

The DPA periodically issues relevant guidance on the application of the GDPR, for example:

• recommendations for SMEs (see here (in Lithuanian));
• recommendations on investigation of personal data security breaches (see here (in Lithuanian)); and
• general guidance on processing personal data (see here (in Lithuanian)).

———

[View source.]