Information for Data Subjects When the Administration Acts as the Data Controller

The data subject has the following rights: 

• to be informed about the purposes of processing their personal data, the categories of data, the recipients or categories of recipients of the data and the retention periods or criteria used to determine such periods (if this information can be provided); 
• to withdraw their consent; 
• to request correction of inaccurate and completion of incomplete personal data; 
• to request erasure (“the right to be forgotten”[1]) of personal data if at least one of the following conditions apply: 
  • the personal data is no longer necessary for the purposes for which it  was collected or otherwise processed; 
  • the data subject withdraws consent on which processing is based under Article 6(1)(a) or Article 9(2)(a) of the General Data Protection Regulation, and there is no other legal basis for processing; 
  • the personal data has been unlawfully processed; 
  • the personal data must be erased to comply with a legal obligation under European Union or Lithuanian law; 
  • the data subject objects to processing under Article 21(1) of the General Data Protection Regulation and there are no overriding legitimate grounds for the processing or objects under Article 21(2); 
• to request restriction of processing of their personal data if at least one of the following conditions apply: 
  • the accuracy is contested by the data subject for a period enabling the controller to verify the accuracy; 
  • the processing is unlawful and the data subject opposes erasure, requests restriction of its use instead; 
  • the data controller no longer requires the personal data for processing purposes, but the data subject needs it to establish, exercise, or defend legal claims; 
  • the data subject has objected to processing of personal data under Article 21(1) of the General Data Protection Regulation pending verification whether the data controller‘s legitimate grounds override the interests, rights, and freedoms of the data subject; 
• to request transfer of personal data processed by the Administration: 
  • if the Administration determines that the data subject’s request for data transfer is justified and the recipient has the technical capabilities, the Administration will agree in writing with the data subject on measures to ensure the security of the transfer and will fulfill the request; 
  • the Administration reserves the right to refuse to fulfill the right to data portability if the personal data is processed by the Administration while performing public authority functions assigned by European Union or Lithuanian law; 
• to object to the processing of personal data. Upon receiving such a request, the Administration evaluates whether it is justified. If the request is found unjustified, the data subject will be provided with a reasoned explanation for the refusal; 
• to submit a complaint to the State Data Protection Inspectorate. 

[1] According to Recital 65 of the General Data Protection Regulation, the data subject should have the right to request the rectification of their personal data and the right to be forgotten when the storage of such data violates this Regulation or the applicable European Union or Member State law to the data controller. In particular, the data subject should have the right to request that their personal data be erased and no longer processed when the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, when the data subject has withdrawn consent or objects to the processing of their personal data, or when the processing of their personal data does not comply with this Regulation for other reasons. However, it should be lawful to continue storing personal data when necessary for exercising the right to freedom of expression and information, to comply with a legal obligation, to perform a task carried out in the public interest or in the exercise of official authority vested in the controller, for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes, or statistical purposes or for the establishment, exercise or defense of legal claims;

• Data subjects seeking to exercise their rights must submit a written request to the Administration either in person, by registered mail, or by email to [email protected]. This may be done by the data subject personally or through a representative. 
• The request must be 
  • submitted in Lithuanian; 
  • legible; 
  • signed by the person submitting it: 
    • with a handwritten signature. In this case, a valid personal identification document must be provided together with the request (if the data subject submits the request personally at the Administration) or a notarized copy of the personal identification document (if the request is submitted by registered mail, email or by a representative). 
    • with a qualified electronic signature. 
  • if the request is submitted by the data subject personally, this form must be completed. 
  • if the request is submitted by a representative, this form must be completed. 
• To ensure confidentiality, a person submitting a request by registered mail should mark the envelope indicating that the correspondence is intended for the Administration’s Data Protection Officer. 

• The data subject has the right to lodge a complaint regarding the Administration’s actions or inaction in implementing the data subject’s rights, either personally or through their representative, as well as through an authorized non-profit institution, organization or association authorized by the data subject and meeting the requirements of Article 80 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The complaint can be submitted to the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, email: [email protected], website: www.vdai.lrv.lt) or to the Vilnius Regional Administrative Court. 
• If the data subject suffers material or non-material damage due to a violation of their rights, the data subject is entitled to compensation in accordance with the procedure established by the Civil Code of the Republic of Lithuania.