- Enforcing jurisdiction
- Lithuania · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 3R-345 – Complaint Upheld (Lithuania, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A complaint was upheld after a data breach at Lithuania's Employment Service, where personal data was sent to many unintended recipients. The authority found that the organization failed to respond properly to a request for information about the breach. This case shows that organizations must handle data requests quickly and completely after a breach.
What happened
A data breach occurred when personal data was emailed to 264 unintended recipients.
Who was affected
Individuals whose personal data was unlawfully disclosed due to the breach.
What the authority found
The authority ruled that the organization did not respond adequately to a request for information about the breach.
Why this matters
This case highlights the obligation of organizations to respond promptly and thoroughly to data access requests, especially after a breach. Companies should improve their data handling processes to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In July 2025, a data breach took place at the Employment Service of the Ministry of Social Security and Labour (the controller): the controller sent an email containing personal data to a large number of unintended recipients. In August, one of the data subjects, whose data were breached, filed a request to access their data. In particular, the data subject requested the identity of all the individuals who unlawfully received their data because of the breach. The controller replied in October and informed the data subjects that their data were unlawfully disclosed to 264 individuals, without mentioning their names. The data subject filed a complaint before the DPA, claiming that the controller’s response was both late and incomplete. The controller claimed that handling the request was difficult. Due to the data breach, the controller received an unusually high number of requests. In the controller's view, this situation justified an extensionArticle 12(3) GDPR: "The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay (...)". of the deadline for handling the subject's request. The identify of the recipients The DPA held that the data subject did not have a right to know the identity of the unlawful recipients of their data, for two reasons. First, the DPA held that Articles 33 and 34 GDPR include no obligation for controllers to disclose the identity of individual recipients following a data breachIn this regard, the DPA referred to Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 4(9) GDPR, p. 165 (Oxfor
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 3R-345 in LT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 3R-345 - Lithuania (2025). Retrieved from cookiefines.eu
Last updated: