Information for Data Subjects When the Administration Acts as the Data Processor

The data subject has the following rights: 

• to receive information about the processing of their personal data; 
• to access and review their stored personal data; 
• to request correction of inaccurate and completion of incomplete personal data; 
• to request erasure (“right to be forgotten”) of personal data, if at least one of the grounds listed in Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – Regulation (EU) 2016/679) applies; 
• to request the restriction of processing of their personal data when one of the conditions set out in Article 18(1) of Regulation (EU) 2016/679 applies; 
• to lodge a complaint with a supervisory authority. 

1. Data subjects seeking to exercise their rights shall submit a request to the Ministry of Transport and Communications of the Republic of Lithuania or to the data processor acting on behalf of the Ministry either in person, by postal mail or by electronic means. 
2. The request must be legible, signed by the data subject, include the data subject’s full name, residential address, contact information and a clear specification of the right(s) that the data subject wishes to exercise and to what extent. 
3. When submitting the request the data subject must verify their identity by: 

• presenting an identity document to the employee of the Ministry of Transport and Communications or the data processor acting on behalf of the Ministry, who registers the request; 
• providing a notarized copy of the identity document or a copy certified in another legally recognized manner, when submitting the request by postal mail; 
• signing the request with a qualified electronic signature or using electronic means that ensure text integrity and immutability, when submitting the request electronically. 

4. If the data subject does not confirm their identity, their rights will not be enforced. This provision does not apply if the data subject requests information about the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – Regulation (EU) 2016/679). 
5. The data subject may exercise their rights personally or through a representative. 
6. The data processor acting on behalf of the Ministry of Transport and Communications shall promptly, but no later than within one month from the date of receipt of the request, provide the data subject with information on the actions taken in response to the request. This period may, if necessary, be extended by the decision of the head of the data processor or their authorized person by an additional two months, taking into account the complexity and number of requests. The data processor acting on behalf of the Ministry of Transport and Communications shall inform the data subject about such an extension within one month from the receipt of the request, including the reasons for the delay. 
7. If the data processor acting on behalf of the Ministry of Transport and Communications does not take action in response to the data subject’s request, the data processor shall promptly, but no later than within one month from the date of receipt of the request, inform the data subject of the reasons for inaction and of the possibility to file a complaint to the State Data Protection Inspectorate under Article 77(1) of Regulation (EU) 2016/679, as well as the option to seek legal remedies under Article 79 of the Regulation. 
8. More detailed information on the exercise of data subject rights is available here. 
9. When submitting a written request to exercise data subject rights, it is recommended to use the request forms available in the “Recommended Request Forms” section of the website of the Ministry of Transport and Communications. 

Request Form for Access/ Review of Personal Data 
Request Form to Correct and/or Complete Personal Data 
Request Form to Erase Personal Data 
Request Form to Restrict the Processing of Personal Data 

1. For any matters related to the processing of personal data or the exercise of their rights, the data subject has the right to contact Data Protection Officer of the Ministry of Transport and Communications of the Republic of Lithuania by email at [email protected] 
2. To ensure confidentiality, the envelope of correspondence sent by post should be marked to indicate that it is intended for Data Protection Officer of the Ministry of Transport and Communications. 
3. The data subject has the right to lodge a complaint regarding the Ministry of Transport and Communications‘ actions or inaction in implementing the data subject’s rights, either personally or through their representative, as well as through an authorized non-profit institution, organization or association authorized by the data subject and meeting the requirements of Article 80 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). The complaint can be submitted to the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, email: [email protected], website: www.vdai.lrv.lt) or to the Vilnius Regional Administrative Court. 
4. If the data subject suffers material or non-material damage due to a violation of their rights, the data subject has the right to seek compensation by filing a claim with the Vilnius District Court.