Legal Changes to the Law on Legal Protection of Personal Data of the Republic of Lithuania

Amendments to the Law on Legal Protection of Personal Data of the Republic of Lithuania ("Law on Legal Protection of Personal Data") entered into force on 1 July 2024. These amendments will now allow employers to keep data on employees' and job applicants' criminal records, even if this is not foreseen in the law, and will also have an impact on the procedure for dealing with infringements.

Processing of Criminal Record Data

Until now, the processing of personal data relating to a person's criminal record was only possible if the law provided for this possibility. Following the entry into force of the amendments to the Law on Legal Protection of Personal Data, employers may lawfully process criminal record data of an applicant for a post or job function and of an employee if (1) the processing is necessary for the pursuit of the legitimate interests of the employer, unless the interests of the applicants for a post or job function or the employees prevail over the employer's; and (2) the processing is necessary for the purposes of complying with a legal obligation to verify the person's fulfilment of the requirements laid down in the laws and regulations implementing the law.

The amendments allow employers with a legitimate interest to process criminal record data of employees and job applicants, even if this is not provided for in the law, provided that the requirements of the GDPR for the employer and the following safeguards for the protection of the rights and freedoms of data subjects are implemented:

an assessment of the legitimate interest in the management of the criminal record of the applicant for a post or job function or of an employee will be carried out and a report on this assessment will be drawn up. This report will have to be made in writing, in consultation with the Data Protection Officer, if appointed;
the employer will have adopted and published on its website, if available, a list of the positions or job functions for which the person is required to be free of criminal convictions. This list will also have to include the offences for which the person must be free of conviction;
only the personal data on convictions and criminal offences of the candidate for the post or the functions of the post or the staff member whose post or the functions of the post or the functions of the post are to be carried out, or whose post or the functions of the post are to be carried out, are included in the list will be processed;
the specific extent of the information on convictions and criminal offences will be provided to the employer by the candidate applying for the post or job function or by the employee himself/herself.

It is important to note that the State Data Protection Inspectorate, to assist employers in assessing the lawfulness of the processing of employees' criminal record data and to ensure a balance between the rights and freedoms of employees and the employer's interests, has drafted a Recommendation on the employer's processing of criminal record data. Employers are advised to familiarize themselves with this Recommendation before carrying out actual processing of criminal records.

Lodging Complaints with the State Data Protection Inspectorate

New amendments to the Law on Legal Protection of Personal Data have made it more difficult for a data subject to lodge a complaint when the complaint concerns video surveillance and have introduced new obligations for data subjects to exercise their rights.

Following the entry into force of the amendments, the data subject will be obliged to contact the person carrying out the video surveillance (if known to him/her) to obtain information about the video surveillance. The data subject will only have the right to lodge a complaint with the State Data Protection Inspectorate if the person carrying out the video surveillance does not provide information on the video surveillance within one month, if the information provided is not satisfactory to the applicant, or if it is not possible to contact the person carrying out the video surveillance. The complainant will be required to submit, together with the complaint, information about the contact to the person carrying out the video surveillance and a copy of the reply of the person carrying out the video surveillance, if any, or the reasons why the person could not be contacted.

In addition, data subjects will be required to provide information about the contact with the controller or processor, together with a copy of the response (if any), along with the complaint regarding the exercise of the rights enshrined in Articles 15-22 of the GDPR.

It is important to remember that if complaints do not contain the above information, the State Data Protection Inspectorate will have the right to refuse to examine the complaint.

Amendments to the Complaints Procedures

Here are some of the other changes to the infringement procedure under the Law on Legal Protection of Personal Data, which come into force on 1 July 2024:

the circle of entities that can lodge a complaint with the State Data Protection Inspectorate has been extended to non-profit institutions, organizations or associations operating in the field of personal data protection;
the institute of an adequate level of complaint handling has been implemented. From now on, the State Data Protection Inspectorate will be able to choose the most appropriate and effective ways and means of dealing with complaints, taking into account the specific situation and the criteria laid down in the Law on Legal Protection of Personal Data, such as: priorities for the current year, possible systemic infringements, the need to give an opinion on a substantive issue related to the application of the GDPR etc.;
if the supervisory authority will deal with 2 or more complaints about the same infringement and the same complainant, such complaints may be merged and dealt with as a single complaint, regardless whether they are submitted by one person or by several different persons;
the supervisory authority will have the right to initiate steps to resolve the complaint amicably in accordance with the procedures laid down by it;
the limitation period for imposing administrative fines is extended from two to three years.

There is no doubt that the procedural changes discussed above will have a positive impact on the efficient handling of complaints.