To:
(By email)
11 December 2023
DPC Ref:
Re: v Revolut Bank UAB
Dear ,
This is a decision of the Data Protection Commission (DPC) in relation to your complaint
originally lodged on 17 January 2021 against Revolut Bank UAB (Revolut). As you are already
aware, the Lithuanian Data Protection Authority (Lithuanian DPA) investigated your
complaint because it was the lead supervisory authority for Revolut Bank UAB (Revolut). This
decision is based on the investigation and information provided to the DPC by the Lithuanian
DPA.
Draft Decision of the Lithuanian DPA 16 June 2023
Following the conclusion of the investigation into the complaint and subsequent
consultations with the DPC and other supervisory authorities in Europe, the Lithuanian DPA
issued a draft decision in relation to the Complaint pursuant to Article 60 GDPR.
The Lithuanian DPA rejected your complaint based on its investigation into the matter.
Having cooperated with the Lithuanian DPA and satisfying ourselves as to its investigative
steps and analysis, the DPC raised no objection to its draft decision. No objections were
raised by any of the other Concerned Supervisory Authorities either and, accordingly, the
draft decision is now binding in accordance with Article 60(6) GDPR. The draft decision and
reasoning of the Lithuanian DPA is enclosed for your information.
The DPC’s role in relation to your complaint
The DPC’s initial investigation confirmed that the processing at issue in relation to your
complaint was ‘cross border’ for the purpose of applying the General Data Protection
Regulation (GDPR). This meant that the DPC’s role in relation to your complaint was as a
concerned supervisory authority, and that the investigation into your complaint would be
conducted by the lead supervisory authority for Revolut, the Lithuanian DPA.
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
The DPC informed you on 14 October 2021 that the Lithuanian DPA were the lead
supervisory authority competent to investigate your complaint. The DPC forwarded your
complaint to the Lithuanian DPA and provided you with regular updates in relation to your
complaint. The DPC also ensured that your views were heard on the Lithuanian DPA’s draft
decision and that these were appropriately accounted for by the Lithuanian DPA before the
draft decision became binding. The DPC also independently assessed the Lithuanian DPA’s
draft decision as part of its obligations as a Concerned Supervisory Authority pursuant to the
cooperation and consistency mechanism under Article 60 of the GDPR. As noted above, the
DPC was satisfied that no objection should be raised to the draft decision.
Decision of the DPC
As the supervisory authority with which your complaint was lodged, the DPC must adopt and
issue the decision based on the investigation of the Lithuanian DPA that your complaint has
been rejected. Accordingly, the purpose of this letter is to notify you that the DPC has
adopted the enclosed draft decision of the Lithuanian DPA as the decision in respect of your
complaint for the purposes of Article 60(8) GDPR.
A copy of this letter and adopted decision will also be provided to Revolut for its information.
Your right to an effective judicial remedy
Article 78 GDPR entitles you to an effective judicial remedy against a legally binding decision
of a supervisory authority. The adoption of this rejection of your complaint is a “legally
binding decision” of the DPC as defined in Section 150 (12) of the Data Protection Act 2018
(Act). Pursuant to section 150 (5) of the Act, you may, within 28 days from the date you
received this notice from the DPC, appeal against this decision to either the Circuit Court or
the High Court.
Next Steps
As the Lithuanian DPA has completed its investigation into this matter and the DPC has
issued you with the decision and informed of your rights, the DPC will close its file in relation
to your complaint.
Yours sincerely,
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
Tony Delaney
Deputy Commissioner
Data Protection Commission
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100