Enforcement · Lithuanian Data Protection Authority (VDAI) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Company: Non-compliance with general data processing principles
How it connects
Related across sources
Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidance EDPB Annual Report 2021 Guidance Guidelines 9/2022 on personal data breach notification under GDPR Guidance Guidelines 07/2022 on certification as a tool for transfers Guidance Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies
Full text
The Lithuanian DPA has fined a company EUR 20,000. The company had suffered a data breach in which personal data of 50,000 data subjects were compromised. During its investigation, the DPA found that the company had failed to implement appropriate technical and organizational measures to protect personal data. These included the lack of adequate access controls and authentication of IT system administrators in the controller's information systems. Also, the DPA found that the company failed to set an appropriate retention period for personal data.
Industry: Not assigned
Original document at the source vdai.lrv.lt