DPA case Nr. 3R-219 (2.13-1.E) – Complaint Upheld (Lithuania, 2026)

The data subjects purchased a package trip for three adults and two children through the website of the controller, a travel agency. During the booking process and subsequent correspondence, errors arose concerning the children’s dates of birth, which were reflected in the contract and later in the travel documents. Although some corrections were made by hand in the contract and passport copies were eventually provided, the inaccurate data were not rectified in time, and the trip ultimately did not take place. Following this, the data subjects lodged a complaint with the DPA. They argued that the company had sent post-trip feedback emails without valid consent or an opt-out option, unlawfully processed and retained copies of travelers’ passports without demonstrating necessity or proportionality, failed to ensure the accuracy of personal data despite having access to corrected information, and acted without sufficient transparency by sending a third party’s privacy policy without explanation and by allegedly mishandling information about the recording of a telephone call. In addition, one data subject claimed that the response to an access request under Article 15 GDPR was incomplete and misleading, while another data subject alleged that their access request had not been answered at all. The company argued that customers were contractually responsible for the accuracy of the data they provided, that passport copies were necessary to verify document validity for the trip, and that feedback emails were lawfully sent to existing customers under national electronic communications law. It also argued that the access request had been answered within the statutory time limit. The DPA upheld the complaint for the most part. It first concluded that the feedback emails sent to the data subjects constituted direct marketing under Lithuanian law. While such messages may be sent to existing customers, the company had failed to provide a clear and easily exercisable option to