Activities of the State Data Protection Inspectorate in 2024
The State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI) is an independent supervisory authority for personal data protection, overseeing the implementation of the General Data Protection Regulation (GDPR) and carrying out tasks established by other Lithuanian and EU legal acts. As a supervisory authority for personal data protection, VDAI’s mission is to safeguard the fundamental right to personal data protection.
One of the key priorities in 2024 was to enhance the knowledge, competence and skills of data controllers, data protection officers and data subjects in the field of personal data protection, with a strong focus on preventive activities. VDAI collaborated with professional associations from various sectors, organised online events with no participant limits and publicly shared recordings of these events. In total, VDAI representatives participated in 18 events in 2024, delivering 38 presentations, with a total audience exceeding 6,000 participants.
In 2024, public confidence in personal data protection knowledge also increased: according to a representative survey of Lithuanian residents on personal data protection, 86% of respondents (4% more than in 2023 and 11% more than in 2022) were aware of the legal act establishing personal data protection rules – the GDPR.
To reduce the number of individual inquiries and provide more comprehensive information on relevant personal data and privacy protection issues to larger stakeholder groups, VDAI placed significant emphasis on developing methodological resources. In 2024, 25 methodological tools were prepared or updated, including 10 summaries of VDAI decisions, 4 FAQs, 8 recommendations and guidelines, and others.
During the reporting period, VDAI actively engaged in international activities within the European Data Protection Board (EDPB) and its subgroups, and cooperated with supervisory authorities of other EU Member States. It also began participating in the activities of the European Innovation Board. In 2024, VDAI took part in 173 meetings of EDPB, other EU institutions and international organisations, as well as working group and subgroup meetings (compared to 149 in 2023 and 76 in 2022).
Interesting facts and figures:
• Since 2022, the promotion of amicable complaint resolution has been encouraged. In 2024, 52 complaints were resolved amicably, representing a 93% increase compared to 2022 (27 cases) when this practice was first introduced.
• A significant part of the Inspectorate’s activities in 2024 involved handling individual complaints. The number of complaints received in 2024 increased by 15% compared to 2023. Over a three-year period, the most common complaint categories remained the same: disclosure of personal data, video surveillance, direct marketing, data collection and the right to access personal data.
• In 2024, upon identifying violations, the Inspectorate issued 123 orders, 54 reprimands and 52 recommendations, imposed 13 fines, issued 7 warnings and applied other sanctions in 2 cases.
• In 2024, the Inspectorate imposed a total of 13 administrative fines, 12 of which resulted from complaint investigations and 1 from an inspection. The total amount of fines imposed was EUR 2,423,971, with the highest fine amounting to EUR 2,385,276 and the lowest EUR 231.
• In 2024, VDAI acted as the lead supervisory authority in 57 international cases.
• A significant part of VDAI’s activities in 2024 was dedicated to legislative work. The number of legal acts submitted for review increased by 5% compared to 2023. The number of coordinated government resolutions and ministerial orders grew substantially, with 31% more government resolutions and 42% more ministerial orders coordinated in 2024 compared to 2023.
• Over recent years, the number of consultations provided has been steadily increasing (3,691 in 2022, 4,136 in 2023 and 4,334 in 2024). In 2024, significantly more consultations were provided in an official written form – 251 (compared to 170 in 2023), and via email – 902 (compared to 799 in 2023). The number of consultations provided through other channels remained stable.
• Since the implementation of the GDPR, a total of 3,492 data protection officers have been appointed and have reported to the Inspectorate. In 2024, 176 data protection officers were appointed in Lithuania.
• In 2024, regarding the statistics on personal data breaches (PDBs) in Lithuania, the Inspectorate received 273 PDB notifications, with 1,467,368 affected data subjects in Lithuania. Some 52% of PDBs resulted from human error; 33% were caused by cyber incidents, including data encryption, ransom demands, social engineering-based attacks and credential stuffing (cyberattacks.)
