VDAI (Lithuania) - 3R-998

VDAI - 3R-998
[[File:|center|250px]]
Authority:	VDAI (Lithuania)
Jurisdiction:	Lithuania
Relevant Law:	Article 4(2) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	14.05.2024
Decided:	31.07.2025
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	3R-998
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Lithuanian
Original Source:	VDAI (in LT)
Initial Contributor:	cci

The DPA rejected a data subject’s complaint regarding his neighbor’s dummy CCTV system and held that the GDPR does not apply to dummy cameras since no processing takes place.

English Summary

Facts

An individual (the data controller) installed CCTV cameras on his property. His neighbor (the data subject) filed a complaint, claiming that the cameras were monitoring his yard.

During the investigation, the controller claimed that the cameras were not recording. The data subject did not provide any evidence or argument to counter this claim.

Holding

The DPA considered that the data subject failed to provide evidence that the complainant’s cameras were active and were recording footage.

On these grounds, the DPA concluded that no processing of personal data took place and consequently dismissed the complaint. In this regard, the DPA referred to EDPB guidance and clarified that the GDPR does not apply to dummy cameras.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Lithuanian original. Please refer to the Lithuanian original for more details.

EXTRACT OF AN ELECTRONIC DOCUMENT
STATE DATA PROTECTION INSPECTORATE
DECISION
31 July 2025 No 3R-998 (2.13-1.E)
Vilnius
The State Data Protection Inspectorate (hereinafter referred to as the Inspectorate) received
on 14 May 2024-05-14 an application forwarded by the Vilnius District Police Commissariat of the Chief
Police Commissariat of the Vilnius Region (hereinafter referred to as the 'Applicant'), submitted to the
Inspectorate by the [DATA NOT TO BE DISCLOSED] (hereinafter referred to as the 'Applicant'), under
reg. No. 1R-3211 (2.13.Mr)) and on 28 June 2024 (Inspection reg. No. 1R-4326 (2.13.Mr)), 2025-03-03
(Inspection reg. 1R-1332 (2.13.Mr)) and 21 May 2025 (Inspection reg. No 1R-3347 (2.13.Mr)) received
its supplements (hereinafter together referred to as 'the complaint').
The complaint alleges that [REDACTED] ('the Complained Party') monitors the Applicant's yard
with a remotely controlled video camera installed on his house. It is also stated that the Applicant not
only films but also records sound.
The Inspectorate, having examined the complaint within its competence,
has concluded:
The complainant submitted an explanation to the Inspectorate on 17 June 2025 (Inspectorate
reg. No 1R-3977 (2.13.Mr)), in which he stated that he had installed two CCTV cameras on the house
which he owns. The first CCTV camera is installed on the balcony of the house and the second one is
installed on the facade of the house, as seen from the road side of the garden community. The
explanation states that the CCTV cameras were installed at the end of 2023/beginning of 2024, but
that no video surveillance was or is actually carried out by them, and therefore no video recording is
made.
The processing of personal data (including image data) is governed by the GDPR1and the ADTAA2.
Article 1(1) of the GDPR provides that this Regulation lays down rules relating to the protection
of natural persons with regard to the processing of their personal data and rules relating to the free
movement of personal data. According to Article 2(1) of the GDPR, this Regulation applies to the
processing of personal data wholly or partly by automated means and to the processing, by non-
automated means, of personal data which form part of, or are intended to form part of, a structured
collection.
According to Article 4(2) of the GDPR, processing means any operation or sequence of
operations which is performed upon personal data or sets of personal data, whether or not by
automated means, such as collection, recording, sorting, organisation, storage, adaptation or
alteration, retrieval, access, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination with other data, restriction, erasure or destruction.
Article 4(1) of the GDPR provides that 'personal data' means any information relating to an
identified or identifiable natural person (data subject); an identified natural person is one who can be
identified, directly or indirectly
1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
2Law on Legal Protection of Personal Data of the Republic of Lithuania ("LPPD").
2
can be identified, in particular by reference to an identifier such as a name, a personal identification
number, location data and an internet identifier, or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person.
In order to establish the (il)lawfulness of the video-surveillance accompanied by sound
recording that has been or is being carried out, the material collected during the complaint procedure
must contain evidence that video-surveillance accompanied by sound recording has been or is being
carried out. The Applicant has attached to the complaint photographs showing CCTV cameras installed
on the balcony and facade of the Complainant's house, one of which (installed on the Complainant's
balcony), according to the Applicant, is monitoring his yard. It is also mentioned in the complaint that
the Complainant's wife provided the Applicant with information that one of the CCTV cameras is
recording audio.
Having examined the complaint material, the Inspectorate considers that the photographs of the
Applicant submitted together with the complaint and the abstract reference to the fact that sound
recording is being carried out, unsupported by any other evidence, do not indicate that the CCTV
cameras are in operation and recording sound. The mere fact that a CCTV camera is installed on the
balcony of the building belonging to the Complainant at a distance of 1,5 metres from the boundary of
the Applicant's plot does not allow to draw the irrefutable conclusion that the Complainant is actually
carrying out video surveillance accompanied by sound recording. No other evidence or arguments
have been adduced by the Applicant to refute the Complainant's claims that the cameras installed in
the Complainant's house are not used for video surveillance. In the light of the above, the Inspectorate
concludes that the video surveillance by means of the Complainant's cameras with sound recording is
not carried out.
Paragraph 8 of the European Data Protection Board's Guideline 3/2019 of 29 January 2020 on
the processing of personal data by means of video devices3notes that the GDPR does not apply to the
use of camera multicamera (i.e. any camera which does not function as a camera and therefore does
not process any personal data).
The decision adopted by the Inspectorate after the examination of the complaint is considered
to be a public administrative act and must therefore comply with the criteria of legality and
reasonableness of an individual administrative act set out in Article 10(5) of the Law o n Public
Administration of the Republic of Lithuania. Article 10(5)(5) of the Law on Administrative Acts states
that an administrative decision must state the legal and factual grounds for the administrative decision
or other circumstances which have influenced the administrative decision. It should be noted that this
requirement is intrinsically linked to the principle of objectivity enshrined in Article 3(9) of the Law,
which means that the adoption of an administrative decision and other official actions of a public
administration body must be impartial and objective.
Similarly, point 38 of the State Data Protection Inspectorate's description of the procedure for
handling complaints4provides that the decision must be based on objective data (facts) and legal
provisions <...>.
Taking into account the above legal regulation and having assessed the circumstances and
evidence provided in the Complainant's complaint and the Complainant's explanation, the
Inspectorate decides that there are no legal grounds to establish that there is a violation of the
processing of the Complainant's personal data as no processing of the personal data is carried out by
the failure to carry out the video surveillance and audio recording of the Complainant's cameras (Art. 4
(2) of GDPR). Consequently, the Applicant's complaint regarding the unlawful video and audio
recording is rejected as unfounded.
3https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_lt.pdf.
4Description of the Complaints Handling Procedure of the State Data Protection Inspectorate, approved by Order No 1T-
20(1.12.E) of 2 March 2021 of the Director of the State Data Protection Inspectorate "On the Approval of the Description of
the Complaints Handling Procedure of the State Data Protection Inspectorate"
3
In the light of the foregoing and in accordance with Article 31(1)(2) of the DPA
paragraph 1,
P r e p a r t i c u l a r y :
1. Dismisses the applicant's complaint.
2. The applicant and the person complained against shall be informed of the decision taken.
This decision may be appealed against to the Administrative Court of the Regions (address:
Žygimantų g. 2, Vilnius) within one month from the date of its notification, in accordance with the
procedure laid down by the Law on Administrative Proceedings of the Republic of Lithuania.
Director Dijana Šinkūnienė