# Company: Insufficient fulfilment of data subjects rights

- Type: Enforcement
- Source: Lithuanian Data Protection Authority (VDAI)
- Date: 2023-01-24
- Original: https://www.enforcementtracker.com/ETid-2200
- Canonical: https://overview.legal/posts/48315
- Topics: Personal Data, Healthcare, Storage Limitation, Data Subject Rights Exercise Modalities and Procedures, Controllers, Retention Period, Data Controller, Processing Agreement, Processing, Supervisory Authorities

## Summary

The Lithuanian DPA has fined a company EUR 8, 000. The controller failed ot properly fulfil the data subject's right to access their personal data processed by the company. The controller partially provided information about the processing of the data subject's personal data, but the data subject was not given the opportunity to verify the legal basis (or bases) for the processing of their personal data, the specific data being processed, the purposes of processing, the retention period, etc.

## Full text

The Lithuanian DPA has fined a company EUR 8, 000. The controller failed ot properly fulfil the data subject's right to access their personal data processed by the company. The controller partially provided information about the processing of the data subject's personal data, but the data subject was not given the opportunity to verify the legal basis (or bases) for the processing of their personal data, the specific data being processed, the purposes of processing, the retention period, etc.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 15 (1) a), b), c), d), g) GDPR, Art. 15 (3) GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48315 · 2026-08-22