Lithuania Law on Legal Protection of Personal Data (2018)

Lithuania ADTAI Articles 3 + 5 Lawful Basis with Lithuanian-specific provisions on children and personal identification numbers. Article 3 Children Consent (Vaikai) - digital consent age 14 (LOWER than GDPR default 16, Lithuania uses derogation Article 8(1) GDPR to lower to 14 - among lowest in EU) + parental consent for under-14 + reasonable verification mechanisms + age-appropriate design + Lithuanian National Child Protection and Adoption Service coordination + Children Rights Convention + ECA-style Lithuanian Child Rights Protection Fundamentals Law. Article 5 Processing of Personal Identification Numbers (Asmens kodas - Lithuanian unique 11-digit citizen identifier) - strict regulation: (a) processed only with explicit consent of data subject; (b) compliance with legal obligation expressly providing for asmens kodas processing; (c) public interest task authorised by law; (d) protect

• Children consent verification (under 14)
• Asmens kodas processing register + lawful basis
• Civil Registry Office coordination
• Lithuanian National Child Protection coordination
• Alternative identifier evidence
• VDAI Personal ID Numbers Guidelines compliance

• No age 14 children verification
• Asmens kodas without statutory basis
• No Civil Registry coordination
• Excessive asmens kodas use

Lithuania ADTAI Articles 9 + 14 Governance and Accountability. Article 9 Data Protection Officer Designation and Reporting (Duomenu apsaugos pareigunas - DAP) - GDPR Article 37 mandatory designation criteria + Lithuanian additional designation requirements: (a) public authorities; (b) core activities consisting of systematic monitoring on large scale; (c) core activities involving processing of special categories or criminal record data on large scale; (d) Lithuanian-specific: organisations processing personal data of 5,000+ data subjects systematically + financial sector entities + healthcare entities + social insurance entities + education entities of significant size. DAP qualifications + professional experience + Lithuanian Data Protection Officer Association continuing professional development + ITAA (IT Auditors Association) coordination + ISO 27701 Lead Implementer/Auditor credent

• DAP designation + VDAI notification (1 month)
• ISO 27701 Lead Implementer/Auditor credentials
• Lithuanian Data Protection Officer Association engagement
• Lithuanian Banking/Insurers/Hospitals Code adoption
• Lithuanian National Accreditation Bureau certification body engagement
• DAP independence + reporting evidence

• No DAP designation
• No VDAI notification
• No ISO 27701 credentials
• No Code of Conduct adoption
• No certification

Lithuania ADTAI Articles 10 + 12-13 Enforcement and Sanctions. Article 10 State Data Protection Inspectorate Powers (VDAI igaliojimai) - GDPR Article 58 transposition: investigative + corrective + authorisation + advisory powers including investigations + audits + on-site inspection + access to premises + production of records + interviews + reprimands + warnings + temporary or definitive bans + processing suspension + Cross-Border data flow suspension + administrative fines + corrective orders + EU consistency mechanism participation. VDAI cooperates with sectoral regulators: Bank of Lithuania (banking + insurance) + RRT (telecommunications + e-commerce) + State Tax Inspectorate + Customs + Ministry of Health + Ministry of Education + State Labour Inspectorate. Article 12 Complaints and Investigations Procedure (Skundu ir tyrimu procedura) - data subjects may complain directly to VDAI +

• VDAI investigation response plan
• Sanctions exposure register (EUR 10M-20M + 2-4% turnover)
• Lithuanian Criminal Code Articles 167/168/198 awareness
• Vilnius Administrative Court review procedure
• Supreme Administrative Court appeal path
• Constitutional Court review awareness
• Sectoral cooperation evidence (Bank of LT + RRT + STI + Customs + MoH + MoE)
• Ombudsman coordination for discrimination cases

• No VDAI response plan
• No sanctions exposure analysis
• No criminal-risk register
• No appeals path documentation
• No sectoral cooperation evidence

Lithuania ADTAI Articles 6 + 11 Journalism and Press Freedom regime. Article 6 Processing for Journalistic + Academic + Artistic or Literary Expression (Zurnalistinis + akademinis + menines + literaturines israiskos tvarkymas) - extensive GDPR Article 85 derogation balancing freedom of expression + privacy + Lithuanian Press Law (Visuomenes informavimo istatymas) + Lithuanian Public Broadcasting Law + Lithuanian Journalists Union Code of Ethics + academic freedom + creative expression + public figure considerations + legitimate interest test + Constitutional Court decisions on press freedom and privacy. Article 11 Inspector of Journalist Ethics (Zurnalistu etikos inspektorius) - LITHUANIAN-UNIQUE INSTITUTION: independent statutory body appointed by Seimas + responsible for: (a) supervising journalist ethics + Lithuanian Journalist Code of Ethics + Public Information Law + Public Broadcas

• Inspector of Journalist Ethics engagement records
• Journalist Code of Ethics compliance evidence
• Public Information Law alignment
• Article 6 derogation memos
• Public figure consideration analysis
• Constitutional Court press freedom precedent review

• No Inspector engagement for journalism
• No journalism-specific derogation memo
• Public figure considerations missing
• Press freedom alignment gap

Republic of Lithuania Law on Legal Protection of Personal Data (Asmens duomenu teisines apsaugos istatymas - ADTAI) of 16 July 2018 + adopted by Seimas (Lithuanian Parliament) + effective 16 July 2018 + replaces 1996 Law on Legal Protection of Personal Data + amended 2020 + 2022. Foundational Lithuanian data protection statute implementing EU GDPR (Regulation 2016/679) directly applicable + LT national derogations + specifications + transposes EU Law Enforcement Directive 2016/680 via separate Law on Legal Protection of Personal Data of Criminal Investigations (CrPDA). Lithuanian Constitution Article 22 inviolability of private life + Article 25 freedom of expression balance. Valstybine duomenu apsaugos inspekcija (VDAI - State Data Protection Inspectorate) - independent supervisory authority + Vilnius headquarters + Director appointed by Seimas on Prime Minister proposal + 5-year term +

• Applicability assessment
• Personal data inventory
• VDAI engagement records
• Lithuanian privacy notices
• Constitutional Article 22 compliance memo
• Baltic States coordination evidence (AKI + DVI)

• No VDAI engagement
• Notices not in Lithuanian
• Treating ADTAI same as GDPR without Lithuanian provisions
• No Inspector of Journalist Ethics coordination for journalism

Lithuania ADTAI Articles 17-18 Security + Breach Notification + International Transfers. Article 17 Breach Notification to VDAI (Pranesimas apie asmens duomenu saugumo pazeidima VDAI) - GDPR Article 33 implementation + controller must notify VDAI within 72 hours of becoming aware where likely to result in risk to rights and freedoms + notify affected data subjects without undue delay where likely high-risk + content (nature + categories + approximate number + likely consequences + measures taken or proposed + DPO contact). VDAI online breach notification portal + sectoral additional notification for: financial sector to Bank of Lithuania + healthcare to Ministry of Health + telecommunications to RRT (Communications Regulatory Authority) + critical infrastructure to NKSC (National Cyber Security Centre) + Police for criminal aspects + sectoral notifications parallel to VDAI. Article 18 In

• VDAI breach notification + 72-hour log
• Sectoral notification evidence (Bank of Lithuania + RRT + Ministry of Health + NKSC)
• Data subject breach notification when high-risk
• Cross-border transfer inventory
• 2021 EU SCCs executed copies
• Schrems II TIA
• Belarus/Russia sanctioned jurisdiction exclusion documentation
• Ukraine cooperation evidence

• Late VDAI notification
• No sectoral parallel notification
• No subject notification
• Old SCCs
• No Russia/Belarus exclusion
• No TIA

Lithuania ADTAI Articles 15-16 + 20 Data Subject Rights Lithuanian implementation. Article 15 Data Subject Rights in Lithuanian - reaffirms GDPR Articles 15-22 rights with Lithuanian-language documentation requirement + 30-day response standard + 60-day extension + free first request + Lithuanian Sign Language accessibility + Lithuanian + Russian + Polish + English minority language support depending on processing location + Lithuanian Disability Affairs Department coordination for accessibility. Article 16 Restrictions on Data Subject Rights (Apribojimai) - GDPR Article 23 implementation specifying Lithuanian-permitted restrictions: (a) national security + defence (Ministry of Defence + State Security Department); (b) public security + criminal investigation (Code of Criminal Procedure + Police Department + Prosecutors Office); (c) economic + financial interest (Bank of Lithuania + Stat

• Rights request SLAs (30-day + 60-day) + log
• Lithuanian + Russian + Polish + English response templates
• Article 16 restriction documentation per category
• Direct marketing opt-in evidence + soft-opt-in policy
• Lithuanian Disability Affairs Department accessibility evidence
• Lithuanian Sign Language access

• Notices only in Lithuanian (no minority languages)
• Restrictions undocumented
• Marketing without opt-in
• No accessibility consideration

Lithuania ADTAI Articles 7-8 + 19 Special-Contexts Processing. Article 7 Video Surveillance (Vaizdo stebejimas) - VDAI Video Surveillance Guidelines (2019, updated 2023) + GDPR Article 6 lawful basis + DPIA mandatory for systematic monitoring of public/employer space + clear signage in Lithuanian + Russian + English (minority language considerations) + proportionality + retention limit 14-30 days standard + 72 hours for low-risk + designated operator + restricted purposes + Lithuanian Labour Code workplace consultation + works council notification. Article 8 Processing in the Workplace (Asmens duomenu tvarkymas darbo santykiu kontekste) - extensive Lithuanian-specific regime: (a) Lithuanian Labour Code Article 27 employment data processing principles + employee consent NOT a primary basis due to power imbalance + legitimate interest balance test; (b) employee monitoring (telephone + emai

• Workplace data processing policy + Labour Code Article 27 compliance
• Video surveillance DPIA + Lithuanian/Russian/English signage + 14-30 day retention
• Employee monitoring DPIA + policy + notification
• Scientific research ethics + Lithuanian Council of Bioethics
• Pseudonymisation/anonymisation safeguards
• Whistleblower Protection Law 2022 integration

• No employee monitoring DPIA
• CCTV without minority-language signage
• No Bioethics Council engagement
• No Whistleblower integration