VDAI (Lithuania) - 3R-1078

VDAI - 3R-1078
[[File:|center|250px]]
Authority:	VDAI (Lithuania)
Jurisdiction:	Lithuania
Relevant Law:	Article 4(1) GDPR Article 6(1)(c) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	23.07.2024
Decided:	13.08.2025
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	3R-1078
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Lithuanian
Original Source:	VDAI (in LT)
Initial Contributor:	cci

The DPA held that using the last four digits of a personal identification number as a password for a document submitted to the data subject does not constitute processing of personal data.

English Summary

Facts

A data subject filed a complaint against a controller. The identity of the controller and the nature of its activities were omitted from the published decision.

For reasons unspecified in the decision, the controller disclosed the data subject’s call log to the Lithuanian telecom authority. The data subject demanded to know what data were disclosed. The controller then replied by forwarding the same log to the data subject. The data were provided in encrypted form in order to ensure their confidentiality. The controller instructed the data subject to use the last four digits of their personal identification number as the password to decrypt the call log.

The data subject protested that the controller had no legal grounds to process their identification number. Specifically, the data subject put forward two claims: first, that the controller unlawfully acquired their identification number; and second, that the controller unlawfully processed the last four digits of the number by using them as the password for decrypting the call log.

During the investigation, the DPA discovered how the controller acquired the data subject's personal identification number. The data subject had previously used their electronic signature in its communications with the controller. The controller acquired their full identification number as a consequence of the verification procedure for the electronic signature.

Holding

The DPA dismissed the complaint in its entirety.

On the collection of the identification number

The DPA observed that Lithuanian law required the controller to verify the data subject's electronic signature. Therefore, the DPA held that the controller lawfully collected the identification number under Article 6(1)(c) GDPR (legal obligation) in the context of the verification procedure.

On the use of the last four digits of the identification number as a password

As mentioned above, the password for decrypting the call log consisted in the last four digits of the data subject’s personal identification number. The DPA considered that the digits in questions were not unique and were shared by many personal identification numbers. Therefore, the digits did not make the data subject identifiable.

On these grounds, the DPA concluded that the last four digits of the data subject's personal identification number did not constitute personal data and that their use as a password did not fall under the scope of the GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Lithuanian original. Please refer to the Lithuanian original for more details.

STATE DATA PROTECTION INSPECTORATE
DECISION
13 August 2025 No 3R-1078 (2.13-1 E) Vilnius
The State Data Protection Inspectorate (hereinafter referred to as the Inspectorate) received a
complaint dated 23.07.2024 from [DATA NOT TO BE DISCLOSED] (hereinafter referred to as the 'Applicant')
on 23.07.2024 (Inspectorate Reg. No 1R-4862 (2.13.Mr)) against the actions of [DATA NOT DISCLOSED]
(hereinafter referred to as 'the complained person'), one of which is the use of the Applicant's personal
code for data encryption (hereinafter referred to as 'the complaint').
The Complainant asks the Inspectorate to declare the Complaint well-founded on the grounds that
"my personal identification number has been illegally extracted from my e-signature and used by
[INFORMATION NOT DISCLOSED]". (untranslated language).
The applicant attached to his complaint a reply from the person complained against by email of
08.12.2022
to the complainant stating, inter alia:
"As you have repeatedly requested a tiering report, we enclose encrypted traffic data that we have
provided to the RRT as an attachment to this letter. You will be able to see the data by entering the last four
digits of your personal identification number, which we obtained after verifying the authenticity of your
electronic signature following your REQUEST of 26/10/2022".
The Complaint states that on the same day (08-12-2022), the Complainant contacted the person
complained against with a request ("the Request"):
"Please indicate how you verified the authenticity of the e-signature so that it shows you the ID
number"
<...>
"What is the encryption here if my personal identification number can be taken by any employee
from my application? This is a violation and you must immediately contact the Data Inspectorate and inform
me. Please also state on what basis you are using my personal code and the data from it?" (untranslated
language).
The applicant claims that he has not received any explanation from the complainant on this point1.
The Inspectorate, having examined the Applicant's complaint within its competence,
has concluded:
The Inspectorate received a reply from the complainant on 22 August 2024 (Inspectorate reg. No 1R-
5425 (2.13 Mr) (hereinafter referred to as the 'Response').
First of all, the Complained Person indicated and attached evidence that on 23.12.2022, the
Complained Person sent a reply to the Complainant to the Complainant's Request by e-mail to the e-mail
address [DATA NOT TO BE DISCLOSED] from the mailbox [DATA NOT TO BE DISCLOSED], and clarified that
when checking the authenticity of the electronic signature on the gosign.lt platform (where the Complained
Person signed the document addressed to the Complained Person), the Complained Person's personal
identification number was also shown.
1The Inspectorate will not assess the implementation or non-implementation of the Applicant's rights as a data subject in
this Decision, as this assessment has already been carried out in the Inspectorate's Decision No 3R-783 of 29.07.20.2024
(2.13-1.)
2
The person complained against noted that it does not process the Applicant's personal identification
number for other purposes, that the Applicant's personal identification number became known to the
person complained against following the receipt of the Applicant's data use request of 26.10.2022, which
was signed with an electronic signature, and the verification of the authenticity of this electronic signature
on the gosign.lt platform, where the Applicant's personal identification number is accessible (visible).
The reply explains that, given that the Applicant has requested his call records, which contain de facto
sensitive personal data and require appropriate security measures to protect such data, the complained
person was obliged to take appropriate measures to protect personal data in accordance with Article 32 of
the GDPR(2),commensurate with the degree of risk involved. In the present case, the person complained
against had to decide how to protect the data sent to the Complainant from becoming accessible to third
parties, as well as how to ensure that the data sent are only received by the persons to whom they are
intended, respectively, by making sure that it is to these persons that the data are sent. As a general rule, in
accordance with the personal data protection regime of the person complained about, the encrypted tiling
is sent via a secure channel by transmitting the encryption code to the telephone number used by SMS.
Given that the telephone number of the applicant's requested tally has been blocked due to fraudulent use
of the service, this procedure could not have been applied by the complainant to the applicant. For this
reason, the options available to exercise the Complainant's right of access to personal data were either (a)
to visit the customer service showroom and confirm his identity physically (which, however, would
potentially be a burden for the Complainant himself in terms of an additional journey compared to the
option of submitting his personal data by electronic means), or (b) to encrypt the message to be sent. The
person complained against indicates that, taking into account the recommendation made by the
Inspectorate in its Decision No 3R-977 (2.13-1.E) of 22.11.2022 on the same complaint by the same
Applicant, to allow data subjects to be identified in more than one way, not only upon arrival at the salon, it
opted for option (b), as it would not impede the ability of the Applicant to exercise its right of access to
personal data. The reply explains that, given that the other channel (tel. no.) for sending the code was not
available (blocked), the last four digits of the Applicant's personal identification number, which was made
available to the complainant after the receipt of the document signed by the applicant by e-signature, were
used in order to allow the applicant to decrypt the message sent. The Complainant submitted that, in this
case, the last four digits of the Applicant's personal identification number were used in order to respond to
the Complainant's complaint and to provide the information requested by the Complainant, while at the
same time ensuring the security of the information sent, as one of the security measures in order to ensure
the confidentiality of more sensitive data in accordance with Article 32 of GDPR.
The person complained against, summarising the information provided in the Response, pointed out
that only authorised personnel work with personal data, in accordance with the 'need to know' principle.
The reply stresses that when sending personal data to clients, the complainant must ensure that the
personal data are provided to the person who requested them. In cases where it is not possible to provide
the encryption code through a channel other than the one used by the person making the request, the
person complained against must take other measures to ensure the security of the information being sent.
An electronic signature is a reliable means of remote identification which is used to establish the identity of
an individual before the disclosure of personal data of the data subject. Encrypting data with the last digits
of the personal identification number ensures that personal data is not disclosed to the wrong person.
The Complained Person attached the Applicant's Request and the reply of 23.12.2022 to the
Applicant's Request to the Response.
Article 3 of the Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter
referred to as 'the GDPR') provides that: (1) a personal identification number may be processed where any of
the following applies
2Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC ("GDPR")
3
(1) the conditions of lawfulness of the processing of personal data referred to in Article 6(1); (2) it is
prohibited to make the personal identification number publicly available; (3) it is prohibited to process the
personal identification number for direct marketing purposes.
Accordingly, it is necessary to determine, within the scope of the complaint, whether the person
complained against was entitled to process the Applicant's personal identification number on the basis of
Article 6(1) of GDPR.
Article 4(2) of the GDPR provides that 'processing' means any operation or sequence of operations
which is performed upon personal data or sets of personal data, whether or not by automated means, such
as collection, recording, sorting, organisation, storage, adaptation or alteration, retrieval, access, use,
disclosure by transmission, dissemination or otherwise making available, alignment or combination with
other data, restriction, erasure or destruction.
The person complained against states that he/she has become aware of the Applicant's personal
identification number during the verification of the authenticity of the Applicant's e-signature.
Article 1(1) of the Law of the Republic of Lithuania on Electronic Identification and Trust Services
for Electronic Transactions ('the Law on Identification') provides that the purpose of this Law is to provide a
legal basis for the effective functioning of the electronic identification and trust services market in the
Republic of Lithuania, in order to protect the interests of the users of these services to the greatest extent
possible. Article 14 of the Law on Identification provides that the use of the code of the person to whom
the electronic signature certificate is issued as an additional specific attribute in an electronic signature
certificate, where this is necessary in view of the intended purposes of the use of the certificate, is allowed.
The use or non-use of the code of the person to whom the electronic signature certificate has been issued
shall not affect the interoperability and recognition of electronic signatures.
The GOSIGN rules of use3published by the Public Register Centre provide that the user shall choose
to check the validity of the electronic signatures of the signed document and GoSign shall provide the user
with a conclusion as to the validity of the document's signatures and with additional signature information
after checking the electronic signature components4.
Accordingly, the person complained against, having received by e-mail from the Applicant a
document signed with an e-signature, by which the Applicant expressed his request to receive his personal
data (the telephone call records, which are considered confidential traffic data under the Law on Electronic
Communications of the Republic of Lithuania), had a legal obligation to establish (verify) the Applicant's
identity, and therefore carried out the procedure of checking the validity of the e-signature on the website
of gosign.lt, in which he lawfully had access to the Applicant's personal identification number. This action of
the complainant can be considered as complying with Article 6(1)(c) of the GDPR, i.e. the legal obligation of
the complainant, and the complaint of the Applicant in this respect should therefore be rejected as
unfounded.
It should be noted that the Applicant asks the Inspectorate to declare the complaint justified not
only with regard to the access to his personal code, but also with regard to the lawfulness of the use of a
part of the personal code (the last four digits) to encrypt data.
Article 4(1) of the GDPR provides that personal data means any information relating to an identified
or identifiable natural person (data subject); an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, a personal identification
number, location data and an internet identifier, or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person.
According to Article 8(2) of the Law on the Population Register of the Republic of Lithuania, the
structure of the personal identification number at the time of its assignment is as follows: the first digit
corresponds to the sex and the centenary of the birth, the second and the third to the last two digits of the
birth year, the fourth and the fifth to the birth month, the sixth and the seventh to the date of birth, and
the eighth, ninth and tenth to the births of those who were born on the same day of the record
3https://www.gosign.lt/lt/taisykles
4Which includes the personal identification number
4
The eleventh digit is a control number of the first ten digits.
According to the legal regulation as presented, the last four digits of the personal identification
number cannot be regarded as personal data - information that can be used to identify a person - because
the last four digits of the personal identification number are not a unique sequence of digits and may be
repeated in a series of personal identification numbers. In the present case, the four-digit sequence was
used by the complainant as a key to decrypt the encrypted data, since this sequence of digits was known to
both the complainant and the applicant, and, if the information sent were to reach another recipient of the
data, the latter could not be aware of the sequence, which cannot be regarded as information on a person
who is or can be identified, in the absence of knowing the full set of the personal identification code
(eleven digits).
Thus, assessing the actions of the complained person in using the last four digits of the Applicant's
personal identification number, the Inspectorate concludes that in this case the Applicant's personal data as
understood under Article 4(1) of the GDPR, i.e. data from which the identity of the Applicant can be
established, was not processed, and therefore, there is no reason for the application of the provisions of
the GDPR in relation to the processing of this sequence of numbers. Accordingly, the Applicant's complaint
in this respect is dismissed as unfounded.
In the light of the foregoing and in accordance with the provisions of the present Decision, the
Inspectorate
Article 31(1)(2) of the Law on Legal Protection of Personal Data of the Republic of Lithuania,
h a s a d d e c l u d e d
1. Dismiss the applicant's complaint as unfounded.
4. Inform the applicant and the person complained against of the decision taken.
This decision may be appealed against to the Administrative Court of the Regions (address:
Žygimantų g. 2, Vilnius) within one month from the date of its notification, in accordance with the
procedure laid down by the Law on Administrative Proceedings of the Republic of Lithuania.
Director Dijana Šinkūnienė