Source: https://www.whitecase.com/publications/article/gdpr-guide-national-implementation-lithuania
Timestamp: 2020-07-02 06:36:03
Document Index: 239219535

Matched Legal Cases: ['Art. 14', 'Art. 37', 'Art. 37', 'Art. 63', 'Art. 58', 'Art. 80', 'Art. 83', 'Art. 83', 'Art. 83', 'Art. 13']

GDPR Guide to National Implementation: Lithuania | White & Case LLP
CFIUS FIRRMA Tool
Global Citizenship Review 2019
GDPR Guide to National Implementation: Lithuania
A practical guide to national GDPR compliance requirements across the EEA
Foreword and issue-by-issue comparison
Request a hard copy of the GDPR Guide to National Implementation »
Q1/ Applicable legislation
Q2/ Personal data of deceased persons
Q3/ Legal bases for processing
Q4/ Consent of children
Q5/ Processing of sensitive personal data
Q6/ Data relating to criminal offences or convictions
Q7/ Exemptions
Q8/ Restrictions on data subjects’ rights
Q9/ Joint controllership
Q10/ Processor
Q11/ Data protection Impact Assessments
Q12/ Prior authorisation and public interest
Q13/ DPOs
Q14/ International data transfers
Q15/ DPAs
Q16/ Claims by not-for-profit bodies
Q17/ Administrative fines, penalties and sanctions
Q18/ Freedom of expression and information
Q19/ National identification numbers
Q20/ Processing in the context of employment
Q21/ Other material derogations
Q22/ Current legal challenges
Q23/ Enforcement
Q24/ Regulatory Guidance
Links to other chapters
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
Old legislation has been updated.
(b) Relevant legislation includes:
The Law on Legal Protection of Personal Data (“Data Protection Law”)
Date in force: 16 July 2018
Link: see here
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been revised.
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue.
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific additional criteria governing this issue.
At what age can a child give their consent to processing in relation to ISS?
14 years of age.
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
All sensitive personal data can be processed if the data subject’s valid consent has been obtained.
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
There are no specific rules on processing this category of data.
(ii) Substantial public interest
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
(iv) Public interest in the area of public health
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
It is forbidden to process the personal data of candidates and employees relating to convictions and offences committed by the candidate or employee, unless such personal data are necessary to verify that a person meets the requirements of law and/or to comply with legislation for the purpose of performing work or other duties.
(a) Does national law specify exemptions to a data subject’s right to erasure?
There are no specific exemptions to the right to erasure.
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
There are no specific exemptions to the right to be provided information.
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
There are no specific exemptions to the right to not be subject to automated individual decision-making.
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
There are no additional restrictions on data subjects’ rights.
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
There are no additional pieces of legislation.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
The DPA has specified that an Impact Assessment must be undertaken in the following cases:
processing of personal data for the purposes of scientific or historical research where personal data are processed without the consent of the individual or the processing is carried out by linking or matching data sets;
processing the personal data of minors;
processing national identification numbers;
processing of personal data being carried out on a large scale, where personal data is not obtained from the data subject and the provision of notice in certain cases is impossible or would require disproportionate effort, or if the provision of such notice may become impossible or may seriously impede the achievement of the purposes of the processing;
processing of personal data where the provision of notice on rights relating to rectification, erasure or processing of personal data to recipients who have been disclosed is not possible or would involve a disproportionate effort;
processing of biometric data for the purpose of specifically identifying a person;
processing personal data for the purpose of monitoring or controlling individuals;
processing the personal data of vulnerable persons;
processing of genetic data in the form of an assessment of personal qualities or scoring, including profiling and prediction;
processing of CCTV data: (i) in relation to premises that are not owned or controlled by the controller; (ii) in relation to health care, social care, imprisonment and other facilities where services are provided to vulnerable persons, or (iii) with sound recording;
recording phone calls;
processing of personal data using innovative technologies or using existing technologies in a new way when processing personal data of vulnerable data subjects;
processing of personal data of minors for direct marketing purposes, assessment of the personal aspects of minors, based on automated processing, including profiling, or directly offering information society services to minors;
processing of personal data and/or sound data in the workplace and/or at the premises of the controller or in the areas where its staff are employed; and
processing of personal data relating to the monitoring of employees, communication, behaviour, location or movement.
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR.
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
DPOs are not subject to secrecy obligations under national law.
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are not subject to restrictions beyond those set out in the GDPR.
(a) Details of the DPA(s).
Name of DPA: State Data Protection Inspectorate
Address: L. Sapiegos str. 17, 10312 Vilnius, Lithuania
Website: ada.lt/go.php/lit/english
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
The Inspector of Journalist Ethics monitors the application of the GDPR and the Data Protection Law, and ensures that this legislation is applied when personal data are processed for journalistic purposes and for academic, artistic or literary purposes. The Inspector of Journalist Ethics has the same powers as those granted to the DPA by the GDPR.+
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
The Inspector of Journalist Ethics is responsible for specific issues, in particular, when personal data are processed for journalistic purposes and for academic, artistic or literary purposes.
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
Data transfers from public registers are not subject to specific restrictions.
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
Decisions of the DPA can be appealed to the court in accordance with the procedure laid down in the Law on Administrative Proceedings.
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
There are no specific rules on this issue.
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
The Data Protection Law does not explicitly refer to not-for-profit bodies but states that claims submitted by an applicant’s representative must be accompanied by a document attesting the authority of the representatives. If claims are submitted by a not-for-profit body, organisation or association on behalf of an applicant in accordance with Art. 80(1) GDPR or other laws regulating the protection of personal data and/or privacy, then the relevant body must also include in its claim documents confirming it is working in the field of personal data protection.
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
The Data Protection Law sets out administrative fines which can be imposed on public institutions. The DPA has the right to impose an administrative fine:
of up to 0.5% of the annual budget of the institution in the current year or of the total annual revenue received in the previous year (but not exceeding €30,000) for the breach of the provisions referred to in Art. 83(4)(a)-(c) GDPR;
of up to 1% of the annual budget of the institution in the current year or of the total annual revenue received in the previous year (but not exceeding €60,000) for the breach of the provisions referred to in Art. 83(5)-(6) GDPR; or
in accordance with Art. 83(4)-(6) GDPR, when a public authority or body carries out commercial activities.
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
There are no additional penalties/sanctions.
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
There is a general obligation to disapply Arts. 12-23, 25, 30, 33-39, 41-50 & 88-91 GDPR in relation to processing for journalistic, academic, artistic and literary purposes.
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
As mentioned above, the Data Protection Law provides specific rules and exceptions regarding processing of personal data for journalistic, academic, artistic and literary purposes. When processing data for these purposes, Arts. 12-23, 25, 30, 33-39, 41-50 & 88-91 GDPR do not apply.
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
it is forbidden to process national identification numbers for direct marketing purposes; and
it is forbidden to make the national identification numbers public.
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
An employer may collect personal data relating to qualifications, professional skills and business characteristics of a candidate applying for a job from a former employer by duly informing the candidate, and if collecting the data from the existing employer, by receiving consent from the candidate.
Where video and/or audio data is processed in the workplace and at the controller’s premises or in the areas where employees work, and the processing of personal data relates to the monitoring of employees’ behaviour, employees must be informed of such processing in writing or by a method whereby compliance with Art. 13(1)-(2) GDPR can be demonstrated.
It is forbidden to process the personal data of candidates and employees related to convictions and offences committed by the candidate or employee, unless such personal data are necessary to verify that a person meets the requirements of law and/or to comply with legislation for the purpose of performing work or other duties.
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
There are no specific safeguards of this nature.
Are there any other material derogations from, or additions to, the GDPR under national law?
There are no other material derogations.
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
The DPA has yet to take enforcement action for breaches of the GDPR.
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA periodically issues relevant guidance on the application of the GDPR, for example:
recommendations for SMEs (see here (in Lithuanian));
recommendations on investigation of personal data security breaches (see here (in Lithuanian)); and
general guidance on processing personal data (see here (in Lithuanian)).
Sorainen contributors
Daivis Švirinas
Partner, Sorainen
T +370 52 685 040
Dr. Daivis is head of the firm’s Competition & Regulatory team in the Baltic States and Belarus as well as the Life Sciences & Healthcare team in Lithuania.
With a Masters degree in both law and economics, Daivis has executed many complex projects, representing Lithuanian and international companies operating in different business sectors, such as wholesale and retail, consumer goods, energy, pharmacy and real estate. In addition, he holds a PhD in law and for over 12 years has taught competition law at Mykolas Romeris University. He has authored many articles, books and publications in the area of competition law and has represented clients in well-known, high-profile competition law cases.
Irma Kirklytė
Senior Associate, Sorainen
As a senior associate specialising in data protection and information technology, Irma assists companies involved in retail and wholesale, financial and consumer product manufacturing and also advises sector clients on regulatory issues.
Irma has provided legal assistance to companies in diverse sectors on implementing the GDPR and provides full scope advice on all matters related to data protection, including data security and management of data breaches.
Irma organises and participates in data protection training for businesses and their employees and co-authored an e-learning course on key aspects of the GDPR.
Country-by-country guides:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
© 2019 White & Case LLP
Dr. Detlev Gabel
Tim Hickman