VDAI (Lithuania) - Decision No. 3R-1700

Facts }}}} The DPA held that a gambling operator lawfully transferred data to a processor for sending invitations to sporting events, but found that the controller breached transparency obligations by not informing the data subject about the categories of data recipients.The DPA held that the operator of a gambling site lawfully transferred data to a processor for sending invitations to sporting events since the engagement of a processor does not require a separate legal basis. However, the court found that the controller breached transparency obligations by not informing the data subject about the recipients of their personal data. == English Summary ==== English Summary == The applicant claimed that his personal data, including his name, telephone number, and age, had been disclosed to third parties without a legal basis and without providing adequate information to the data subject. He further stated that the controller was unable to explain how his data had been obtained or shared,