DPA case 3R-1078 – Dismissed (Lithuania, 2025)

A data subject filed a complaint against a controller. The identity of the controller and the nature of its activities were omitted from the published decision. For reasons unspecified in the decision, the controller disclosed the data subject’s call log to the Lithuanian telecom authority. The data subject demanded to know what data were disclosed. The controller then replied by forwarding the same log to the data subject. The data were provided in encrypted form in order to ensure their confidentiality. The controller instructed the data subject to use the last four digits of their personal identification number as the password to decrypt the call log. The data subject protested that the controller had no legal grounds to process their identification number. Specifically, the data subject put forward two claims: first, that the controller unlawfully acquired their identification number; and second, that the controller unlawfully processed the last four digits of the number by using them as the password for decrypting the call log. During the investigation, the DPA discovered how the controller acquired the data subject's personal identification number. The data subject had previously used their electronic signature in its communications with the controller. The controller acquired their full identification number as a consequence of the verification procedure for the electronic signature. The DPA dismissed the complaint in its entirety. == The DPA observed that Lithuanian law required the controller to verify the data subject's electronic signature. Therefore, the DPA held that the controller lawfully collected the identification number under Article 6(1)(c) GDPR (legal obligation) in the context of the verification procedure. == As mentioned above, the password for decrypting the call log consisted in the last four digits of the data subject’s personal identification number. The DPA considered that the digits in questions were not unique and were shared by ma