LithuaniaElectronic Communications Law, Article 73(1) to (3), Confidentiality of Communications and Recording in Business Practice
73 straipsnio 1-3 dalys, Lietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Do not listen to, record, store or otherwise intercept the content of messages or traffic data carried over public electronic communications services, or become acquainted with them, without the consent of the actual users of the services, except where the law lawfully allows it under Articles 77, 78 and 96 of the Electronic Communications Law.NIST Privacy FrameworkCT.PO-P1
- Do not disclose the content of messages carried over electronic communications networks, or the related traffic data, and do not make it possible to learn them, without the users' consent, except in cases set by law.NIST Privacy FrameworkCT.PO-P1
- Before you record information and related traffic data in lawful business practice to provide evidence of a commercial or other business transaction that may have legal consequences, inform the users of the recording and its purpose, and keep the recorded content and traffic data no longer than the period during which the transaction can be legally challenged.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.DM-P5
- If you provide electronic communications networks or services, take appropriate organizational and technical measures to ensure the confidentiality of communications, and give the State Data Protection Inspectorate the conditions to carry out its control.NIST Privacy FrameworkPR.DS-P2NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), which Article 73, paragraph 3 charges with supervising how businesses providing electronic communications networks or services implement the confidentiality requirements of paragraph 1.
What this law does
Article 73, paragraph 1 of the Electronic Communications Law prohibits listening to, recording, storing or otherwise intercepting the content of messages and traffic data, or becoming acquainted with them, without the consent of the actual users of public electronic communications services, except where the law lawfully allows it under Articles 77, 78 and 96.
Without the users' consent it is also prohibited to disclose the content of messages carried over electronic communications networks or the related traffic data, or to make it possible to learn them, except in cases set by law. Paragraph 2 provides that these rules do not apply to the recording of information and related traffic data carried out in lawful business practice to provide evidence of a commercial or other business transaction that may have legal consequences under legislation.
Before the recording starts, the actual users of public electronic communications services must be informed of the recording and its purpose. The recorded content and related traffic data may be kept no longer than the period during which the validity of the transaction can be legally challenged. Under paragraph 3, businesses that provide electronic communications networks or services must take appropriate organizational and technical measures to implement paragraph 1.
The State Data Protection Inspectorate supervises how those businesses implement the confidentiality requirements of paragraph 1. Law No. XIV-635 of set out the Electronic Communications Law anew. Article 2(1) of that Law brings the new text into force on .
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.