A letter or inquiry from VDAI: what it means and what to do

A letter from the State Data Protection Inspectorate (VDAI) may be an inquiry, a reminder, a notice of an investigation or a decision. An inquiry is not a decision that you have committed an infringement. But if the letter asks for information or documents, you must answer: persons must comply with the supervisory authority’s requirements and provide information, explanations and copies of documents without delay (Article 14 ADTAĮ). For controllers and processors, the Regulation also sets a duty to cooperate with the supervisory authority on request (Article 31 GDPR).

How to prepare the answer itself, step by step, we describe on Privacio (in Lithuanian). Here we answer a different question: what the Inspectorate can do under the law, how to tell an inquiry from a decision, and what happens when the answer is poor or missing.

What VDAI can do under the law

VDAI performs the supervisory authority’s tasks set out in the Regulation (Article 11(1) ADTAĮ). It also advises controllers and prepares methodological recommendations (Article 11(2)(1) ADTAĮ). So some letters are informational: they remind you of duties or ask how you meet them.

The Inspectorate has the supervisory authority’s powers set out in the Regulation (Article 12(1) ADTAĮ). The most important ones to know when a letter arrives:

• to order the controller to provide any information it requires for the performance of its tasks (Article 58(1)(a) GDPR);
• to notify an alleged infringement of the Regulation (Article 58(1)(d) GDPR);
• to obtain all necessary information, copies of documents and data, and to access all data and documents (Article 12(2)(1) ADTAĮ);
• during the examination of infringements, to enter premises without prior notice, in the case of a legal person during its working hours (Article 12(2)(2) ADTAĮ);
• to obtain oral and written explanations and to require a person to come to the Inspectorate’s premises (Article 12(2)(9) ADTAĮ);
• to give recommendations and instructions on data processing (Article 12(2)(5) ADTAĮ).

So an answer to an inquiry is not a formality. The Inspectorate has the right to use information obtained while examining infringements or performing other functions (Article 12(2)(10) ADTAĮ). What you write may therefore be used later.

Inquiry, reminder or decision: how to tell them apart

Read the letter and answer three questions for yourself: does it ask specific questions, does it set a deadline, does it mention a complaint or an investigation.

A reminder or informational letter. It reminds you of duties but does not ask for specific information. If it asks you to confirm that you have read it, confirm. It is also a signal to check whether the duties mentioned are actually met in your organisation.

An inquiry during an investigation or a complaint. It asks for explanations or documents. This is a requirement you must comply with (Article 14 ADTAĮ). In this case you are the person under investigation or the person complained about, and you have rights. You can obtain explanations about the subject matter and basis of the investigation or complaint (Article 17(2)(1) ADTAĮ). You can submit additional explanations on your own initiative (Article 17(2)(2) ADTAĮ).

A decision. When it ends an investigation on its own initiative, the Inspectorate decides, with reasons, that no infringement was found, or gives instructions or recommendations or applies other measures, or draws up a record of an administrative offence (Article 22(1) ADTAĮ). The person under investigation is informed of such a decision in writing within 3 working days, except where an administrative fine is intended (Article 22(2) ADTAĮ). When it has examined a complaint, the Inspectorate finds it justified or rejects it (Article 31(1) ADTAĮ). If it finds the complaint justified, it may give instructions or recommendations or apply other measures (Article 31(2) ADTAĮ). In both cases the decision can be appealed to a court (Article 22(3) ADTAĮ; Article 31(5) ADTAĮ).

A proposal to impose a fine. This is a separate document, and you need to recognise it at once. In it the Inspectorate sets a deadline, not shorter than 10 working days from receipt of the document, to submit your explanations in writing (Article 34(1) ADTAĮ). Failure to submit explanations does not prevent a decision on the fine. And if explanations were already obtained during the investigation, they may not be asked for again at this stage. This is one more reason to write the answer to the first inquiry as if it were your explanation in the case.

Deadlines: which ones really apply

Article 14 ADTAĮ does not set a number of days for answering an inquiry. It says “without delay” (Article 14 ADTAĮ). So in practice the deadline is the one the letter itself sets. If you cannot meet it, write to the Inspectorate before it expires, explain why and propose a date.

It matters when the clock starts. Documents are deemed served even if nobody has read them yet. When sent through the e-delivery system or by electronic means, the day of service is the next working day after sending (Article 17(5) ADTAĮ). Refusing to accept a registered letter counts as service. For a letter sitting in an unchecked shared mailbox, the clock is already running.

An investigation on the Inspectorate’s own initiative takes no longer than 4 months from the decision to carry it out (Article 21(1) ADTAĮ). This may be extended, but the total may not exceed 6 months (Article 21(2) ADTAĮ). The clock stops when the Inspectorate starts a fine procedure for non-compliance with its instructions, or while it waits for an expert opinion or another supervisory authority’s opinion (Article 19² ADTAĮ). One of the reasons for extension named in the law is the person under investigation avoiding the Inspectorate’s requirements.

What can go wrong and what the consequences can be

The letter is ignored. This is the biggest mistake. The Regulation provides for administrative fines for infringing the controller’s obligations under Articles 25 to 39, including the duty to cooperate, of up to 10 million euros or, for an undertaking, up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a) GDPR). For failure to provide access in violation of Article 58(1): up to 20 million euros or 4 % of turnover, whichever is higher (Article 83(5)(e) GDPR). ADTAĮ sets lower caps for public authorities and bodies (Article 33(1) and (2) ADTAĮ), unless they carry out commercial activity (Article 33(3) ADTAĮ). In addition, when deciding whether to impose a fine and its amount, the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects is taken into account (Article 83(2)(f) GDPR). A controller that stays silent cannot use this factor in its favour.

The answer is given without checking the facts. The risk arises when the answer is written by someone who knows how things should be, not how they are. The controller must be able to demonstrate compliance with the principles (Article 5(2) GDPR). For example, if the answer says recordings are deleted after 30 days and an inspection finds recordings a year old, the problem doubles: an infringement and an inaccurate explanation to the authority.

Admitting what was not asked. An answer to an inquiry is not the place for self-analysis of the whole organisation. Answer the questions asked. If, while preparing, you find a real problem, for example an unrecorded security breach, that is a separate question with its own deadlines (Article 33(1) GDPR). Deal with it deliberately, not in one sentence of the answer. When to notify a breach is described in the article personal data breach: when to notify VDAI and people.

More personal data are sent than requested. The data minimisation principle also applies when sending data to the Inspectorate: data must be limited to what is necessary for the purpose (Article 5(1)(c) GDPR). If a sample or a description is requested, do not send the whole customer database. If data about a specific person are requested, send only theirs.

When to call a lawyer

An organisation can handle a simple reminder itself. It is worth involving a lawyer when:

• the letter mentions a complaint, an investigation or an alleged infringement (Article 58(1)(d) GDPR);
• you are invited to give explanations in person, or the Inspectorate intends to visit;
• you have received a proposal to impose an administrative fine (Article 34(1) ADTAĮ);
• while preparing the answer you find that some duties are not being met;
• the questions concern health or other special-category data, video surveillance or employee monitoring;
• you have received a decision and are considering appealing it to a court (Article 22(3) ADTAĮ; Article 31(5) ADTAĮ).

If the organisation has a data protection officer, cooperating with the supervisory authority is one of the officer’s tasks (Article 39(1)(d) GDPR). The officer also acts as the contact point when the authority raises issues relating to processing (Article 39(1)(e) GDPR). So the letter should reach the officer on the first day, not the last.

If you are not an organisation but a person who filed a complaint, see the article complaint to VDAI: how long it takes and what happens next.