# STATE DATA PROTECTION INSPECTORATE
# DECISION
November 10, 2025 No. 3R-1577 (2.13-1.E)
Vilnius
The State Data Protection Inspectorate (hereinafter – the Inspectorate) on 18-09-2024 received a complaint dated 22-07-2024 from [REDACTED] (hereinafter – the Applicant) (Inspectorate reg. No. 1R-5955 (2.13.Mr)) (hereinafter – the Complaint), which was forwarded by the Polish supervisory authority through the European Commission’s Internal Market Information System (IMI) (IMI reg. No. 684370).
In the Complaint, the Applicant states that he received information from the addressee [email protected] about the transfer of his personal data to UAB "Kontomatik" (hereinafter – the Respondent), established in Vilnius. However, despite repeated attempts to contact by telephone and a request submitted by e-mail on 14-05-2024 under Articles 15 and 14 of the GDPR¹, the Respondent did not provide any response by the date of submission of the Complaint. The Applicant states that he does not know where, to whom, when, and to what extent his data was transferred, on what legal basis it is processed, and how its security is ensured, and requests that the Respondent be obliged to provide the information and copies of the data.
The Inspectorate, being competent to act as the Lead Supervisory Authority and to prepare a final decision regarding the Applicant’s Complaint (Articles 56 and 60(7) of the GDPR),
has determined:
On 19-08-2025, the Inspectorate received the Respondent’s reply (Inspectorate reg. No. 1R-5493 (2.13.Mr)) (hereinafter – the Reply), in which it was explained that on 14-05-2024 the Respondent received the Applicant’s e-mail requesting information on the processing of personal data and copies of personal data, as provided for in Articles 14 and 15 of the GDPR. Due to human error, the Respondent replied to this request only on 10-09-2024, emphasizing that no personal data of the Applicant had been found in the Respondent’s databases and apologizing for the delay in providing the response.
In the Reply, the Respondent acknowledged that the Applicant’s request had not been fulfilled in due time, but once the situation came to light, the Respondent immediately prepared a response to the Applicant and, although belatedly, fulfilled his rights as a data subject.
In the Reply, the Respondent noted that the protection of personal data is of particular importance to it, drew conclusions from this incident, and took measures to prevent such a situation from recurring.
Together with the Reply, the Respondent submitted to the Inspectorate a copy of the response of 10-09-2024 to the Applicant’s request to access the data being processed.
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – GDPR).
2
Article 15 of the GDPR establishes the right of access of the data subject. It should be noted that the provisions of Article 15 of the GDPR are applied in conjunction with Article 12 of the GDPR, paragraph 3 of which requires the controller to provide the data subject with information on the actions taken upon receipt of a request under Articles 15–22 of the GDPR no later than within one month of receiving the request.
It should also be noted that, according to the case-law of the Supreme Administrative Court of Lithuania, when formulating the subject matter of a complaint, it is the applicant who defines the limits of the case². By analogy, this case-law is applicable also in public administration institutions when examining applicants’ complaints.
In the present case, taking into account the content of the Applicant’s Complaint, it has been established that the subject matter of the Applicant’s Complaint consists of a possible violation of the right of access to the data being processed, linked to the failure to comply with the time limits laid down in Article 12(3) of the GDPR.
Accordingly, the Inspectorate will not assess the substance of the Respondent’s reply of 10-09-2024 to the Applicant. It should also be noted that, after receiving the Respondent’s reply on 10-09-2024 to his request to access the processed data, the Applicant did not contact the Inspectorate to supplement the Complaint in relation to the provision of an incomplete reply.
It should be noted that the Respondent admits that it replied to the Applicant’s request for access to the data being processed in breach of the time limits laid down in Article 12(3) of the GDPR, accordingly, the Inspectorate will not comment further on this matter. The Applicant’s Complaint is recognized as well-founded.
In accordance with Article 31(2)(1) of the Law on Legal Protection of Personal Data (hereinafter – LLPPD), in cases where the Complaint or part of it is recognized as well-founded, the Inspectorate provides the controller and/or the processor with reasoned instructions, recommendations and/or applies other measures provided for in Article 58(2) of the GDPR, Article 33 of the LLPPD and other laws regulating the protection of personal data and/or privacy <...>. In deciding on the application of corrective measures, it is relevant to note Recital 129 of the GDPR, which states that each measure should be appropriate, necessary and proportionate in order to ensure compliance with the GDPR.
In deciding whether to impose corrective measures on the Respondent, the Inspectorate takes into account the fact that the violation concerned a single data subject (the Inspectorate has no information that the Respondent committed this violation in respect of other individuals). Considering that the Respondent fulfilled the Applicant’s right of access to the data and submitted a reply to the Applicant on 10-09-2024, no instruction will be given to the Respondent. The Inspectorate decides that in this case the appropriate corrective measure is a reprimand imposed on the Respondent pursuant to Article 58(2)(b) of the GDPR.
Taking into account the above and pursuant to Article 31(1)(1), Article 31(2)(1) of the LLPPD, and Article 58(2)(b) of the GDPR,
decides:
1. To recognise the Applicant’s Complaint as well-founded.
2. To impose a reprimand on the Respondent for violation of Article 12(3) of the GDPR.
This decision may be appealed to the Regional Administrative Court within one month from the date of its delivery in accordance with the procedure established by the Law on Administrative Proceedings of the Republic of Lithuania (address: Žygimantų g. 2, Vilnius).
² The ruling of the Supreme Administrative Court of Lithuania of 11 April 2012 in administrative case No. A442-1447/2012.
3
Director