Municipal institutions and the GDPR: museums, libraries, care homes

A municipal library, a state or municipal museum and a social care institution have one thing in common. Under the General Data Protection Regulation (GDPR) they may be public authorities or bodies. That has three consequences: a data protection officer is mandatory (Article 37(1)(a) GDPR), legitimate interest cannot be relied on when performing their tasks (Article 6(1), last subparagraph, GDPR), and the fine caps are set not only by the GDPR but also by Lithuanian law.

Schools and healthcare institutions have their own articles. This one covers other institutions: what the GDPR requires of them, what their sector laws say about data, and what is at stake when the duties are not met.

Is your institution a “public authority or body”

The GDPR does not define the term. The Lithuanian Law on the Legal Protection of Personal Data (ADTAĮ), for its own purposes, treats as public authorities and bodies state and municipal institutions and bodies, enterprises and public institutions (viešosios įstaigos) financed from the state or municipal budgets and state monetary funds that are authorised to carry out public administration, provide public or administrative services or perform other public functions (Article 2(2) ADTAĮ).

The sector laws state the legal form clearly:

• Library. A municipal public library is a budgetary institution owned by the municipality (Article 10(1) of the Law on Libraries (BibĮ)).
• Museum. Municipal museums are budgetary institutions or public institutions owned by the municipality (Article 10(1) of the Law on Museums (MuzĮ)). National and state museums are budgetary institutions (Articles 8(1) and 9(1) MuzĮ). Municipal museums provide public services of museum visits and museum education (Article 10(2)(1) MuzĮ).
• Social services institution. The Law on Social Services (SPĮ) refers to state and municipal budgetary social services institutions and to public social services institutions whose owner, or a member holding more than half of the votes, is the state or a municipality (Article 22(1) SPĮ). Whether a private social services institution is a public body depends, in our assessment, on the same test in Article 2(2) ADTAĮ: budget funding and public functions. If it does not meet that test, it may still have to designate an officer on another ground – where its core activities consist of processing special categories of data on a large scale (Article 37(1)(c) GDPR). The health data rules (Article 6(2) SPĮ, Article 9(1) GDPR) apply to all social services institutions.

A budgetary institution is a public legal person funded from the state or municipal budgets that provides public services or performs state or municipal functions (Article 2(1) of the Law on Budgetary Institutions (BĮĮ)). In our assessment, such an institution is also a public body within the meaning of Article 37(1)(a) GDPR. A municipal museum operating as a public institution provides public services by law (Article 10(2)(1) MuzĮ), and it may receive municipal budget funds (Article 6(5) MuzĮ). If it is financed from the budget, it falls within the definition in Article 2(2) ADTAĮ and, in our assessment, is a public body within Article 37(1)(a) GDPR. That has to be checked against the funding of the specific institution.

The officer is mandatory, but one can serve several institutions

A public authority or body designates a data protection officer regardless of its size and of the data it processes (Article 37(1)(a) GDPR). The only exception is courts acting in their judicial capacity. When an officer is mandatory for other organisations is covered in our article Do we need a data protection officer?.

For a small institution, Article 37(3) GDPR matters: a single data protection officer may be designated for several public authorities or bodies, taking account of their organisational structure and size. The officer may be a staff member or work under a service contract (Article 37(6) GDPR). If the service is bought, what to put in the tender conditions is discussed in our article Data protection officer services in public procurement.

Once the officer is designated, a few more requirements remain:

• the officer’s contact details must be published and communicated to the supervisory authority (Article 37(7) GDPR), which in Lithuania is the State Data Protection Inspectorate (VDAI) (Article 7(1) ADTAĮ);
• if the officer also has other duties, the institution ensures that they do not result in a conflict of interests (Article 38(6) GDPR);
• the officer monitors compliance, including awareness-raising and training of staff (Article 39(1)(b) GDPR). Whether training is mandatory is covered in our article GDPR training for employees.

What an institution may base its processing on

The two key GDPR bases for an institution are a legal obligation (Article 6(1)(c) GDPR) and a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e) GDPR). Both bases must be laid down in Union or Member State law (Article 6(3) GDPR). Legitimate interest does not apply to processing carried out by public authorities in the performance of their tasks (Article 6(1), last subparagraph, GDPR). Recital 47 GDPR explains why: it is for the legislator to provide the legal basis for public authorities.

What the sector laws say about data:

• BibĮ defines a user as a person who has acquired the right to use library services under the law and the library’s rules of use (Article 2(7) BibĮ). The rules of use are approved by the library’s governing body (Article 19(2) BibĮ). BibĮ does not regulate the processing of users’ personal data.
• MuzĮ does not regulate the processing of visitors’ personal data. It mentions only statistical data on the museum’s activity, supplied to the Ministry of Culture (Article 10(2)(14) MuzĮ).
• BĮĮ does not regulate the processing of service recipients’ data.

In our assessment, it follows that a library’s or museum’s processing rests on the functions assigned to it by law (Article 10(2) BibĮ, Article 10(2)(1) MuzĮ), and that the purpose must be necessary for performing those functions (Article 6(3) GDPR). A library also needs to identify a user in order to require replacement of a lost document or compensation for the damage (Article 19(3) BibĮ). How much data to ask for, and which, the institution must justify itself in its own rules, because the law does not list it.

Social services institutions: health data

In a social services institution the position is different, because here the law speaks about data directly. Personal data processed for allocating, providing and accounting for social services and the other listed purposes are processed in accordance with ADTAĮ and the GDPR, and the retention periods are set by the implementing acts of SPĮ (Article 6(1) SPĮ). For these purposes, social services institutions also process special categories of data concerning health: diagnosed diseases, treatment, medication, the level of disability or participation (Article 6(2) SPĮ). The text of Article 6 SPĮ does not change in the editions from 2027-01-01 and 2029-01-01.

The GDPR prohibits the processing of health data (Article 9(1) GDPR), subject to listed exceptions. One of them is where processing is necessary for the provision of social care on the basis of Union or Member State law (Article 9(2)(h) GDPR). That exception carries a condition: the data are processed by or under the responsibility of a professional or another person subject to an obligation of secrecy (Article 9(3) GDPR). SPĮ does not use the word “secrecy”, but it requires social workers to follow the Code of Ethics for Social Services Staff in their professional activity (Article 26(8)(3) SPĮ), which is approved by the Minister of Social Security and Labour (Article 28(6) SPĮ). The Code imposes a duty of confidentiality on all social services staff: information received from service recipients must remain confidential and may be disclosed only in the cases the Code lists (point 6.7 of the Code of Ethics for Social Services Staff, approved by Order No A1-448 of the Minister of Social Security and Labour of 5 July 2023). In our assessment, this is an obligation of secrecy under rules established by national competent bodies within the meaning of Article 9(3) GDPR. The institution should also record it in job descriptions or staff commitments, in particular for staff who are not social workers.

Two further duties follow:

• Records of processing. The exemption for organisations employing fewer than 250 persons does not apply where special categories of data are processed (Article 30(5) GDPR).
• Impact assessment. It is mandatory where special categories of data are processed on a large scale (Article 35(3)(b) GDPR). Whether the scale is large has to be assessed for the specific institution. In addition, under VDAI’s list an impact assessment is mandatory where video surveillance is carried out in a social care institution (Article 35(4) GDPR; point 6.2 of the list approved by VDAI Director’s Order No 1T-35 (1.12.E) of 14 March 2019).

What can happen

Each Member State may lay down whether and to what extent administrative fines may be imposed on public authorities and bodies (Article 83(7) GDPR). Lithuania did so in Article 33 ADTAĮ:

• for infringements of points (a) to (c) of Article 83(4) GDPR – up to half a percent of the institution’s current-year budget and other income received in the previous year, but not more than thirty thousand euro (Article 33(1) ADTAĮ);
• for infringements of the principles, data subjects’ rights and the other provisions listed in Article 83(5)(a)–(e) GDPR, and for non-compliance with an order of the supervisory authority (Article 83(6) GDPR) – up to one percent, but not more than sixty thousand euro (Article 33(2) ADTAĮ);
• if the institution carries out economic commercial activity, the general GDPR fine caps apply (Article 33(3) ADTAĮ).

The last point is not theoretical for a library or a museum. The Ministry of Culture approves the list of paid services of state and municipal libraries (Article 4(9) BibĮ), and the list of paid services of museums is set by the ministry exercising the owner’s rights over the museum or by the municipal council (Article 4(1)(5), 4(2) and 4(3)(2) MuzĮ). A museum’s funds include budget funds, among them income from the services museums provide, the sale of goods and the rental of premises (Article 6(1)(1) MuzĮ). Whether a paid service already counts as economic commercial activity, these laws do not say. In our assessment, this is an open question, and the lower caps cannot be taken for granted. More in our article GDPR fines for state and municipal institutions.

A fine is not the only consequence. The supervisory authority’s decisions after an investigation or a complaint are published on its website (Article 14¹(1) ADTAĮ). Any person who has suffered material or non-material damage as a result of a GDPR infringement has the right to compensation (Article 82(1) GDPR). A leak of a care home resident’s health data may also turn into such a claim.

When to call a lawyer

• when the institution has no designated officer, or the officer’s contact details have not been published and communicated to VDAI;
• when several municipal institutions want to share one officer and their structure and size need to be assessed;
• when a social services institution processes health data but has no records of processing or impact assessment;
• when the institution provides paid services and you need to assess which fine cap applies to it;
• when you receive a VDAI inquiry or a complaint, or a personal data breach has occurred.