Privacy Blog
LITHUANIAN DPA IMPOSES FINE ON VILNIUS CITY MUNICIPALITY ADMINISTRATION
22.10.2020
The Personal Data Protection Supervisory Authority of the Republic of Lithuania (“DPA”) has imposed a fine of EUR 15.000 on Vilnius City Municipality Administration on the ground that the Municipality failed to implement appropriate technical and organisational measures.
According to the investigation carried out by the DPA, it is found that when the data indicated for education of the adopted child in the Population Information System was automatically updated, the contact personal data of the applicant was updated and replaced with the contact data (e-mail address) of one of the biological parents of the child available in the Population Register.
The DPA in its decision has pointed out that, in a particular case, such contact personal data as e-mail address irrespective of whether it is indicated in the Population Register or not and, if such data is indicated in the Population Register, such data may at any time be changed by only the data subject and the data controller should not arbitrarily update the data on the basis of information available at the State Enterprise Centre of Registers.
It is thus concluded that when processing the e-mail address of the third party as the contact data of the applicant, the Municipality Administration has failed to implement appropriate organisational and technical measures.
You can read the text of the Decision here.
Should you have any queries and/or remarks, please do not hesitate to contact us.
Kind regards,
Zumbul Attorneys-at-Law
info@zumbul.av.tr