27 January 2022

Dear Director Andrijauskas,

Dear Deputy Director Morkūnienė,

We, the Media Freedom Rapid Response (MFRR) and partner organisations, are writing to denounce the administrative harassment of “Karštos Pėdos” (“Hot Feet”). We call on the State Data Protection Inspectorate (SDPI) to stop pressuring and obstructing the journalistic project’s activities, to abide by the limits to its authority as defined in domestic law and to respect the letter and spirit of EU Regulation 2016/679 (General Data Protection Regulation, GDPR).

Karštos Pėdos is a platform launched in autumn 2020 that is part of a transparency initiative co-funded by the European Commission and implemented by Media4Change in collaboration with Investigative Journalism Centre Siena. It visualises links between politically exposed persons in Lithuania and government spending, making use of datasets comprising declarations of interest of public persons, public procurement statistics and EU funding data, which are all publicly available.

Since late 2020, the SDPI has been attempting to inspect Karštos Pėdos. The investigation was initiated through a series of correspondence, in which the SDPI has been requesting a host of information to show that the project is not violating GDPR and the Law on Legal Protection of Personal Data. The SDPI ordered to provide data protection impact assessment, records of processing activities and documentation that data subjects of concern have been notified of their data processing, among other things.

From the outset, the team behind Karštos Pėdos have been arguing that the GDPR does not apply to journalists to the full extent. We share their view that in line with the derogations provided under the Regulation, Karštos Pėdos is not obliged to provide all the requested information as the information in their platform complies with the journalistic exemption Lithuania’s framework should provide according to the GDPR. Moreover, pursuant to Article 7 of the Law on Legal Protection of Personal Data, the SDPI lacks the authority to monitor the application of data protection laws to the processing of personal data for journalistic purposes, which instead lies with the Inspector of Journalistic Ethics. In June 2021, following a request by Media4Change, the Office of the Inspector of Journalistic Ethics confirmed in a letter that Karštos Pėdos is considered a journalistic activity. It is our understanding that despite being informed of the Office of the Inspector of Journalistic Ethics’ position, the SDPI has ignored it and has not involved the Office. In November 2021, moreover, the SDPI escalated the proceedings by proposing the imposition of an administrative fine for failing to provide the requested information in violation of data protection laws.

We concur with the Office of the Inspector of Journalistic Ethics and with the project team that Karštos Pėdos’s activities and content available are in line with journalist purposes serving the public interest. Therefore, pursuant to the Law on Legal Protection of Personal Data, the SDPI is not authorised to inspect or to impose fines on Karštos Pėdos. We further recall that the GDPR obliges the Member States to reconcile the right to protection of personal data with the right to freedom of expression and information. Accordingly, we call on the SDPI to stop pressuring and attempting to obstruct the activities of Karštos Pėdos.

Signed by:

ARTICLE 19

European Centre for Press and Media Freedom (ECPMF)

European Federation of Journalists (EFJ)

Global Investigative Journalism Network (GIJN)

International Consortium of Investigative Journalists (ICIJ)

International Press Institute (IPI)

OBC Transeuropa (OBCT)

Organized Crime and Corruption Reporting Project (OCCRP)

The Daphne Caruana Galizia Foundation