FOR THE PROTECTION OF PRIVACY AND TRANSPARENCY
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Note made: 7 May 2021
Restriction of access in force until the decision enters
into force, but for personal data until 7 May 2096
Basis: clauses 35 (1) 2, 35 (1) 12 of the Public
Information Act
Recommendation on personal data protection
Notice of termination of proceedings
The Data Protection Inspectorate (hereinafter referred to as the Inspectorate) received a
complaint from Lithuanian citizen in the information exchange system
IMI regarding unsolicited telephone calls. On 28 August 2018, a woman from the company
called the applicant (with the number ) and made an offer to
purchase goods. The applicant asked what the legal basis for the call was. The applicant was
told that the caller had an offer. The caller from was of the opinion that this
was not an advertisement but an offer. The applicant reminded the caller that under data
protection law, they do not have the right to offer goods without prior consent. The caller replied
that they had always worked like that and would continue to do so. According to the complaint,
the applicant’s personal data are being processed illegally and used for marketing purposes.
The Inspectorate asked the Lithuanian supervisory authority for its opinion on calls being made
to arbitrarily generated numbers. The Lithuanian data protection authority clarified that persons
may not be called in Lithuania without their prior consent, even if this number is randomly
generated.
The Inspectorate explained to the processor of data that the Lithuanian data protection authority
is of the opinion that even only a telephone number can be considered to be personal data and
that calling a randomly generated telephone number therefore constitutes to processing personal
data and that prior personal consent is required for conducting direct marketing in this way. The
Estonian Data Protection Inspectorate requests that this requirement to be complied with in the
future, because if a complaint is received, the Inspectorate must apply Lithuanian law regarding
direct marketing for activity in Lithuania.
Based on the above, the Estonian Data Protection Inspectorate initiated supervision proceedings
pursuant to clause 56 (3) 8) of the Personal Data Protection Act.
The Inspectorate drew the attention of the data controller of the data to the following and
made a recommendation to :
1. When processing personal data, the controller must ensure that the data would be
processed lawfully, fairly and in a transparent manner in relation to the data
subject (point (a) of Article 5 (1) of the General Data Protection Regulation). To
explain, there must be a legal basis for any kind of data processing. Hereby, it is
important that data processing would be clear and understandable, and that people are
not provided with misleading information about the processing of personal data. The
processing of personal data shall be lawful only if at least one of the conditions provided
for in Article 6(1) of GDPR is fulfilled.
2. lacks any legal basis to make calls to telephone numbers obtained
from public databases or generated in another way. Therefore, calls to numbers not in
line with the originally stated purpose for obtaining the numbers are not permitted.
Tatari 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / Registry code 70004235
FOR THE PROTECTION OF PRIVACY AND TRANSPARENCY
does not have the consent to call the numbers to make offers. For
example, if a person selling a car has published his/her telephone number publicly on
the Internet, this number may not be called with the purpose of offering him/her goods
or services. The number is published for the sole purpose of receiving calls for selling
the car.
3. Pursuant to the Lithuanian Law on Electronic Communications, the data
controller must have the prior consent to make marketing calls. This is the view of
the Lithuanian data protection authority. The Inspectorate makes a
recommendation to follow the Lithuanian Law on Electronic Communications
when making calls so that the company would operate in accordance with
Lithuanian law.
Based on the above, the Inspectorate terminates the supervision procedure and forwards this
notice to the data controller.
Lawyer
Authorised by Director General
Republic of Estonia
Data Protection Inspectorate
Tatari 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee / Registry code 70004235