Associations and public institutions: members’, volunteers’ and donors’ data under the GDPR

A small association or public institution (viešoji įstaiga, VšĮ) processes more personal data than it seems: the list of members or shareholders, volunteer agreements, donor records, lists of beneficiaries. The General Data Protection Regulation (GDPR) applies to processing by automated means and to structured paper filing systems (Article 2(1) GDPR). We explain who it applies to in Who does the GDPR apply to.

Here we cover what Lithuanian laws require you to keep, who may see it and what must not be published, when a volunteer must be checked and when a data protection officer is needed.

Which data is processed because the law requires it

Where processing is necessary for compliance with a legal obligation, no consent is needed (Article 6(1)(c) GDPR).

Shareholders of a public institution. The Law on Public Institutions (VšĮĮ) requires the institution to be notified of the acquisition of shareholder rights, giving the shareholders’ names, surnames and personal codes (Article 4(5) of the Law on Public Institutions (VšĮĮ)). Shareholders’ data, with a correspondence address, is supplied to the Information System of Legal Entities’ Participants (Article 10(1)(1) of the Law on Public Institutions (VšĮĮ)).

Donors and beneficiaries. The Law on Charity and Sponsorship (LPĮ) allows associations and public institutions to be recipients of support (Article 7(1) of the Law on Charity and Sponsorship (LPĮ)) once they obtain the status of a recipient of support (Article 7(3) of the Law on Charity and Sponsorship (LPĮ)). A recipient keeps accounts of support received, recording the donors (unless the support was anonymous) and the specific recipients (where support is passed on), and files an annual report with the State Tax Inspectorate (Article 11(2) of the Law on Charity and Sponsorship (LPĮ)). This provision does not change in the edition taking effect on 1 January 2027.

What becomes public. The Law on Associations (AĮ) requires an association that received support to list separately, in the explanatory notes to its financial statements, each legal person that gave support, save for the small-support exception (Article 10(3) of the Law on Associations (AĮ)). A public institution shows support from natural persons only as a total value and subject (Article 22(3) of the Law on Public Institutions (VšĮĮ)). The Register of Legal Entities publishes the reports (Article 10¹(2) of the Law on Associations (AĮ), Article 23(2) of the Law on Public Institutions (VšĮĮ)), and on the organisation’s own website (for an association, if it has one; for a public institution, where the state or a municipality holds more than half of the votes at the general meeting of shareholders) they are published without natural persons’ data that data protection laws do not allow to be published (Article 10¹(1) of the Law on Associations (AĮ), Article 23(1) of the Law on Public Institutions (VšĮĮ)). The law requires a public institution to name its shareholders (Article 22(5)(2) of the Law on Public Institutions (VšĮĮ)), but not individual donors. In our assessment, entering them is a mistake, because the report becomes public.

Members and volunteers

List of members. Every member of an association has the right to see the list of members (Article 13(5) of the Law on Associations (AĮ)) and the association’s documents, and to receive all information it holds about its activities (Article 13(4)(3) of the Law on Associations (AĮ)). A shareholder of a public institution has a similar right (Article 4(3)(2) of the Law on Public Institutions (VšĮĮ)). In our assessment, these rights do not include publishing the list on a website or passing it to partners, because data may not be further processed in a manner incompatible with the purposes of collection (Article 5(1)(b) GDPR). Article 13(5) of the Law on Associations (AĮ) speaks only of a right to see the list, so in our assessment the association is not obliged to hand over a copy.

Volunteers. The Law on Voluntary Activities (SVĮ) allows associations and public institutions to host volunteers (Article 7 of the Law on Voluntary Activities (SVĮ)). A written agreement is mandatory where the activity is long-term, where expenses are reimbursed, or where either party asks for one (Article 11(2) of the Law on Voluntary Activities (SVĮ)). Data needed to perform it is processed under Article 6(1)(b) GDPR. The organisation may require documents showing that the person meets requirements set by special legislation for the specific activity. Where these contain special-category (for example health) or criminal-record data, appropriate safeguards apply (Article 11(5) of the Law on Voluntary Activities (SVĮ)).

Volunteers and children. One such special law is the Law on the Fundamentals of Protection of the Rights of the Child (VTAPĮ). It covers volunteering in organisations providing social, cultural, educational, sports or health care services only to children, and in other organisations, including religious communities, where the activity involves direct and regular contact with children (Article 30(1) of the VTAPĮ). Contact is direct if the person can be alone with a child or can form a physical or emotional relationship with them, and regular if the person can be in contact with children non-accidentally, more than once (Article 30(3) and (4) of the VTAPĮ). In such cases the organisation may engage the volunteer only after checking the validity of their code for lawful work with children and satisfying itself that the statutory ban does not apply to them. A foreign national provides documents from their state of citizenship or permanent residence showing no conviction for the listed offences (Article 30(5) of the VTAPĮ). If there is no code, the organisation itself applies for one, and it re-checks validity at least once a calendar year (Article 30(6) of the VTAPĮ). The information obtained may not be passed to third parties, save where laws provide (Article 30(8) of the VTAPĮ).

Sensitive data and the Article 9 exception

Processing data revealing political opinions, religious or philosophical beliefs, trade union membership or health is prohibited unless an exception applies (Article 9(1) GDPR). The list of members of a religious community or a patients’ society can reveal such data by itself.

Article 9(2)(d) GDPR allows a not-for-profit body to process it if:

• it has a political, philosophical, religious or trade union aim;
• it acts in the course of its legitimate activities with appropriate safeguards;
• only the data of members, former members or persons in regular contact with it in connection with its purposes is processed;
• the data is not disclosed outside the body without the consent of the people concerned.

In our assessment, an association whose aim is not political, philosophical, religious or trade-union, for example a patients’, disability or sports association, cannot rely on this exception. Other exceptions remain, for example the person’s explicit consent (Article 9(2)(a) GDPR). A body that can rely on the exception may not disclose the data outside itself without consent (Article 9(2)(d) GDPR), so it may not pass the list of members to a sponsor, a municipality or an event partner.

Records, the DPO and newsletters

Records of processing activities. This obligation does not apply to an organisation employing fewer than 250 persons, unless the processing is likely to result in a risk to people’s rights and freedoms, is not occasional, or includes special categories or criminal-record data (Article 30(5) GDPR). In our assessment, a list of members kept on an ongoing basis, or support accounts reported on every year (Article 11(2) of the Law on Charity and Sponsorship (LPĮ)), is not occasional processing, so the exemption does not fit even an organisation with two employees.

Data protection officer. A DPO is mandatory, among other cases, where processing is carried out by a public authority or body (Article 37(1)(a) GDPR) or where the organisation’s core activities consist of large-scale processing of special categories or criminal-record data (Article 37(1)(c) GDPR). The Law on the Legal Protection of Personal Data (ADTAĮ) treats as public authorities and bodies also public institutions financed from state or municipal budgets and state monetary funds that are authorised to carry out public administration, or provide public or administrative services to persons, or perform other public functions (Article 2(2) of the ADTAĮ). In our assessment, such a public institution must designate a DPO whatever its size. For other small associations and public institutions a DPO is not mandatory, unless the core activity is, for example, large-scale processing of health data. A DPO may also be designated voluntarily (Article 37(4) GDPR). More in Do we need a data protection officer.

Information and newsletters. When collecting data from a person, the organisation tells them, among other things, who the controller is, the purposes and the legal basis (Article 13(1) GDPR): in the membership form, the volunteer agreement, the donor form. Where donors’ data is processed for direct marketing purposes, the person has the right to object at any time (Article 21(2) GDPR). When an email or SMS needs consent, we explain in Direct marketing by email and SMS: when consent is needed.

What can happen

The first risk is a fine. Processing without a legal basis or without an Article 9 exception can lead to a fine of up to twenty million euros or, for an undertaking, up to four per cent of turnover (Article 83(5)(a) GDPR). A breach of the records duty or other controller obligations can lead to a fine of up to ten million euros or up to two per cent of turnover (Article 83(4)(a) GDPR). For a public authority or body, including a public institution covered by Article 2(2) of the ADTAĮ, the caps are lower: no more than thirty thousand euros for breaches of Article 83(4)(a)–(c) GDPR and no more than sixty thousand euros for breaches of Article 83(5) GDPR (Article 33(1) and (2) of the ADTAĮ), unless it carries on commercial economic activity (Article 33(3) of the ADTAĮ). These are upper limits: a fine must be effective, proportionate and dissuasive (Article 83(1) GDPR).

The second is damage. A person who has suffered material or non-material damage as a result of an infringement has the right to receive compensation from the controller (Article 82(1) GDPR), for example when the list of members of a religious community is published.

The third is status as a recipient of support. If an organisation fails to prepare the report referred to in Article 11(2) of the Law on Charity and Sponsorship (LPĮ) within two months after a warning, the competent institution applies for the status to be withdrawn (Article 13(5)(1) of the Law on Charity and Sponsorship (LPĮ)).

When to contact a lawyer

• the organisation holds sensitive members’ data and does not know whether it can rely on Article 9(2)(d) GDPR;
• a partner, sponsor or municipality asks for the list of members, volunteers or beneficiaries;
• volunteers work in an organisation serving only children, or have direct and regular contact with children, and their code for lawful work with children has not been checked;
• a public institution is financed from a state or municipal budget or state monetary funds and does not know whether it needs a DPO;
• a list of members or donors was sent to the wrong people or published.