STATE DATA PROTECTION INSPECTORATE
DECISION
REGARDING THE 05-04-2024 COMPLAINT OF
12 September 2025 No. 3R-1254 (2.13-1.E)
Vilnius
The State Data Protection Inspectorate (hereinafter - the Inspectorate) on 07-01-2025 received
the 05-04-2024 Complaint of the applicant (hereinafter - the Applicant)
regarding the actions of Vinted, UAB (hereinafter - the Company), which was transferred by the French
Supervisory Authority via the Internal Market Information System (IMI) (Inspectorate’s Registration No.
1R-51 (2.13 Mr)) (hereinafter - the Complaint).
In the Complaint, the Applicant stated that on 14-03-2024, he was informed that the Company
had blocked his account due to an alleged violation of the platform’s rules—specifically, the use of
multiple accounts. The Applicant claims that following this notification, he contacted the Company on
multiple occasions, requesting evidence to support the alleged rule violation. However, he did not receive
any satisfactory response.
The Inspectorate, acting as the lead supervisory authority and being competent to adopt final
decision regarding the Applicant’s Complaint (Article 56 and Article 60(7) of the Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural
Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, and
Repealing Directive 95/46/EC (hereinafter - the GDPR)),
has determined:
On 18-04-2025 the Inspectorate received the reply of the Company (Inspectorate’s Registration
No. 1R-2540 (2.13 Mr)) (hereinafter - the Reply), in which the Company explained that the Applicant’s
account was blocked due to the infringements of the platform’s rules and that on 13-10-2024 this account
was deleted following the standard terms of storing personal data. The Company confirmed that on 04-
04-2024 it received the request of the Applicant to access the data in accordance to Article 15 of the
GDPR. In the Reply, the Company explained, that the client service specialist, who examined the request
of the Applicant, due to the complex form of the request, did not properly identify that the Applicant
does not only object to the decision to have his account blocked and is requesting to review this decision,
but also, requested access to specific personal data linked to the decision to have his account blocked. As
a result, the specialist, who examined the request, only confirmed that they can do nothing more in
regards to the decision to have the Applicant’s account blocked, and did not take appropriate actions
regarding the Applicant’s request to access his personal data.
Regarding the implementation of the Applicant’s right to access data
During the examination of the Complaint, it was established that on 18-03-2024 and 04-04-2024,
the Applicant contacted the Company to request access to their data, following the decision to block their
1
account. The Applicant contested this decision and requested precise information and specific evidence
that served as the basis for the account suspension, which, according to the Company, was due to a breach
of the rules—specifically, the use of multiple accounts.
As shown in the annexes submitted with the Complaint and in the Company’s Reply, the
Company did not take any action in response to the Applicant’s requests.
Article 15 of the GDPR sets out the data subject's right of access to their personal data. Article
15(1) provides that the data subject has the right to obtain confirmation from the controller as to whether
or not personal data concerning them is being processed and, where that is the case, to access that data
and the information listed in points (a) to (h). Articles 15(3) and 15(4) further establish that the controller
must provide a copy of the personal data being processed, although this right must not adversely affect
the rights and freedoms of others.
Article 12(2) of the GDPR requires controllers to facilitate the exercise of data subject rights
under Articles 15 to 22. According to Article 12(3), the controller must respond to a request made under
those articles without undue delay and in any event within one month of receiving the request. If no
action is taken, Article 12(4) provides that the controller must inform the data subject within the same
period of the reasons for not acting, and of the right to lodge a complaint with a supervisory authority
and seek a judicial remedy.
The European Data Protection Board’s Guidelines 01/2022 on the right of access clarify that this
right aims to give individuals sufficient, transparent, and easily accessible information about the
processing of their personal data, enabling them to be aware of and verify the lawfulness and accuracy
of such processing. It is also a tool that facilitates the exercise of other rights, such as the right to
rectification or erasure.
Since it was found that the Company failed to take any action in response to the Applicant’s
access requests dated 18-03-2024 and 04-04-2024, and did not provide any reply within the timeframe
established under Article 12(3) of the GDPR, the Applicant’s Complaint concerning the improper
handling of their right of access under Article 15 of the GDPR is considered to be well-founded.
Regarding the Imposition of Corrective Measures Against the Company
Article 31(2)(1) of the Law on Legal Protection of Personal Data of the Republic of Lithuania
(hereinafter – the LLPPD) indicates, that when the complaint or a part of it is deemed valid, the
Inspectorate shall provide the instructions, recommendations to the data controller and/or data processor,
and/or apply other measures indicated in the statutes of law regulating the protection of personal data,
and/or privacy. By following Article 12(2)(5) of the LLPPD, the Inspectorate shall have the right to
provide to the data controllers, data processors and other legal entities or natural persons
recommendations and instructions on the processing of personal data, and/or protection of privacy.
Recital 129 of the GDPR states that any measure taken should be appropriate, necessary, and
proportionate in order to ensure compliance with the Regulation, taking into account the specific
circumstances of each individual case. The Law on Legal Protection of Personal Data (LLPPD) grants
the Inspectorate discretion, once a complaint is found to be valid, to determine appropriate remedial
actions. It is important that any measures imposed by the Inspectorate are appropriate, necessary, and
proportionate in light of the identified infringement.
Article 58(2)(b) of the GDPR empowers supervisory authorities to issue reprimands to
controllers or processors where processing operations have violated provisions of the GDPR.
Taking into account that the Inspectorate has no evidence indicating that the infringements
identified in this decision are systemic in nature (i.e. affecting other users of the platform in addition to
the Applicant), a reprimand is considered an appropriate and proportionate measure in response to the
violations of Article 12(3) and Article 15 of the GDPR.
2
The Inspectorate considers that the imposition of additional corrective measures (such as
instructions regarding the implementation of the Applicant’s right to access) would not be appropriate,
given that the personal data the Applicant sought to access has already been deleted, and the proper
fulfilment of their right of access is now objectively impossible.
In view of the above, and in accordance with Article 31(1)(1) and Article 31(2)(1) of the Law on
Legal Protection of Personal Data (LLPPD), as well as Articles 58(2)(b) and 60(7) of the GDPR, the
Inspectorate
decides:
1. To recognise the Applicant’s Complaint as well-founded.
2. For the established infringements of Article 12(3) and Article 15 of the GDPR, to issue a
reprimand to the Company.
3. Inform the Company and the Applicant of the decision adopted.
This decision may be appealed to the Regional Administrative Court within one month from the
date of its delivery in accordance with the procedure established by the Law on Administrative
Proceedings of the Republic of Lithuania (address: Žygimantų g. 2, Vilnius).
Director
3