DPA case 3R-537 – Complaint Upheld (Lithuania, 2025)

In October 2024 a politician (the controller) sent political advertising emails about his candidacy for the Parliament. The mails included a list of all the recipients. One of the recipients (the data subject) reached out to the data controller. She pointed out that personal data of the recipients was included in the emails and requested information about the processing of her data. The controller did not provide her with a clear answer. The data subject later filed a complaint with the DPA. She claiming that she never consented to receiving political advertising on her email address. She also claimed that the controller failed to reply to her request and that the inclusion of the recipients in the mails, constituted a data breach. After the complaint was filed, the controller deleted the data subject’s contacts from his database. First, the DPA held that the candidate was a controller for the processing of personal data. So, he was under the corresponding obligations under the GDPR, including the duty to ensure the lawfulness of the data processing. With regards to lawfulness, the controller claimed that he had previously collected the data subject’s consent for the purpose of direct marketing. In the controller’s view, this justified the processing of the data subject’s email address for the purpose of political advertising. The DPA rejected the argument. In this regard, the DPA clarified that direct marketing and political advertising are distinct activities under Lithuanian lawThe DPA referred to Article 95 of the Electoral Code of the Republic of Lithuania (for the definition of political advertising) and Article 2 of the Law on the Legal Protection of Personal Data (for the definition of direct marketing).. So, the DPA held that they also constitute different purposes for processing personal data. The DPA further observed that the purposes of direct marketing and political advertising are not only different but also incompatible. In other words, th