News

Personal data protection: the Supreme Administrative Court of Lithuania referred questions to the Court of Justice of the European Union on the interpretation of the GDPR when examining complaints concerning the processing of personal data, including the powers of supervisory authorities, the liability of data controllers, and compliance with the principles of transparency, lawfulness and accountability.

By a ruling of 12 November 2025, an extended panel of judges of the Supreme Administrative Court of Lithuania referred a request for a preliminary ruling to the Court of Justice of the European Union, seeking clarification on the interpretation of provisions of the General Data Protection Regulation (GDPR).

The model case was initiated on the basis of 54 individual administrative cases that were homogeneous in terms of both legal and factual circumstances. The cases concerned decisions of the State Data Protection Inspectorate, by which the company Vinted was found to have infringed the GDPR.

The circumstances examined in the model case arose after individuals whose accounts had been blocked on the Vinted platform contacted the company in order to exercise their right to be forgotten. After receiving negative responses, those individuals lodged complaints with the competent data protection authority. Having examined the complaints, the Inspectorate identified three types of infringements in Vinted’s actions, namely that the company:

1. failed to provide sufficiently detailed responses to requests for the erasure of personal data, thereby infringing the principle of transparency;

2. failed to properly retain information necessary to demonstrate compliance with the right of access to personal data, thereby infringing the principle of accountability;

3. processed personal data for the purposes of shadow banning without complying with the principle of lawfulness.

In order to dispel doubts regarding the interpretation of the GDPR, the Supreme Administrative Court of Lithuania referred questions to the Court of Justice of the European Union, requesting a preliminary ruling on issues relating to the powers and obligations of supervisory authorities when examining complaints concerning possible infringements of the GDPR, the liability of data controllers, and their duties to ensure compliance with the principles of transparency, accountability and lawfulness.

The Court requested the Court of Justice of the European Union to clarify, inter alia:

• whether a limitation period established in national law for the imposition of an administrative fine may restrict the ability of a data protection supervisory authority to adopt a decision on a complaint relating to cross-border data processing and to apply the corrective measures provided for in the GDPR;

• whether a supervisory authority, when examining a complaint, has the right (or the obligation) to assess other GDPR infringements identified in the course of the investigation;

• whether, under the GDPR, a supervisory authority receiving a data subject’s complaint is required to clearly define the scope of the examination of the complaint and to indicate to the data controller the specific information requested in order to ensure the proper handling of the complaint;

• whether, in implementing the principle of accountability, a data controller is required to retain all data relating to the data subject who lodged the complaint for the entire duration of the complaint-handling process, even if such data are not directly related to the scope of the complaint examined by the supervisory authority;

• what scope of information must be provided to a data subject when he or she requests the erasure of data under Article 17 of the GDPR;

• whether the processing of personal data for the purposes of shadow banning, where the data subject is not individually informed of such processing, may be regarded as lawful under the GDPR.

The administrative proceedings were stayed pending the delivery of a preliminary ruling by the Court of Justice of the European Union.

Administrative case No eA-2296-822/2025.