Lietuvos draudimas – Complaint Upheld (Lithuania, 2026)

Lietuvos draudimas (the controller) is an insurance company. In 2025, a data subject filed a complaint with the DPA. According to the data subject, the controller transferred their personal data to a third party without establishing liability for damages. The controller also failed to provide information in accordance with Article 14 GDPR, and processed data to an excessive extent. During its investigations, the DPA found that the controller obtained data from third parties during insurance proceedings in order to identify the data subject; this includes the state company registry and a third person affected by the data subject. The controller later transferred the data subject’s data to a debt collection agency (the processor) after the data subject failed to pay the controller within the time limit. The DPA first clarified that it was not competent to examine the parties’ insurance rights, and that this case was limited to verifying the lawfulness of the processing activities. The DPA partially upheld the data subject’s claim. The DPA found a violation of Articles 14(3)(a) and (b) GDPR, as the controller provided the data subject with information required under Articles 14(1) and (2) GDPR late. The controller received data from third parties regarding the data subject, therefore, it should have provided this information without undue delay (and no later than upon first contact with the data subject). According to the DPA, the controller failed to do both. However, the DPA did not find a violation of Article 28(3) GDPR. The DPA stated that the GDPR regulates the relationship between controllers and processors, and does not give the data subject the right to object to (or authorise) a controller transferring data to a processor. The DPA also dismissed the data subject’s data minimisation claim. The DPA found that the controller processed the necessary data in the debt collection proceedings; if the controller limited the data processed (e.g. to first and last name only) it would not be able to accurately identify the data subject or provide the processor with information related to the data subject’s debts. Therefore, the DPA did not find a violation of Article 5(1)(c) GDPR. The DPA did not issue any fines or enforcement measures, as it considered that acknowledging the violation was sufficient. The controller fulfilled its information obligations under Articles 14(1) and (2) GDPR, even if it was provided late. In addition, the DPA considered that the controller’s actions did not cause significant negative consequences for the data subject.