Privacy Policy

The Motor Insurers’ Bureau of the Republic of Lithuania, as a data controller, respects your right to privacy and ensures the protection of the data related to you, which complies with the standards laid down in the legislation.
For the reasons of transparency, below we provide our detailed information about how and when we collect and use your personal data. If you want to find out more about the processing of your personal data, or if you believe that your rights to the protection of personal data have been violated, contact us using the contact details provided below.

PERSONAL DATA PRIVACY POLICY AT THE MOTOR INSURERS’ BUREAU OF THE REPUBLIC OF LITHUANIA

This Personal Data Privacy Policy (hereinafter referred to as the Policy) provides information on how the Motor Insurers’ Bureau of the Republic of Lithuania (hereinafter referred to as the Bureau) processes personal data.

1. Definitions

‘Personal Data’ means any information that is directly or indirectly linked to a natural person (a Data Subject).
‘Data Subject’ means a natural person whose personal data (Personal Data) are processed.
‘Database of Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles’ (hereinafter referred to as the Database) means a set of legal, organisational, technical measures and software tools administered/managed by the Bureau, intended to register, retain, use and otherwise process the data, information, documents referred to in Article 28 of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania and other legislation as well as the copies thereof.
‘Processing’ means any action (including collection, recording, retention, alteration, use, provision, access granting, requesting, transfer, etc.) carried out with personal data.
Other terms used herein shall have the same meanings as the terms used in the legislation.

2. General provisions

2.1. This Policy provides general provisions on how Personal Data is processed in the Bureau. Additional information about the processing of Personal Data may be available in the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania, Law on Legal Protection of Personal Data of the Republic of Lithuania, other legislation, contracts and other documents of the Bureau, as well as on the Bureau’s website at http://www.cab.lt/.
2.2. The Bureau ensures the confidentiality of Personal Data that complies with the requirements of the existing legislation, and the implementation of appropriate technical and organisational measures aimed at the protection of Personal Data against unauthorised access, disclosure, accidental loss, alteration, destruction, or other unlawful processing.
2.3. In order to ensure the protection of Personal Data, the Bureau implements or intends to implement the following Personal Data protection measures:
• Administrative (surveillance of the workplaces and the Bureau’s premises, safe handling of documents, computer data and archives thereof, the establishment of a procedure for the organisation of work in various fields of activity, etc.); • Hardware and software protection (firewalls, protection against malware and viruses, secure administration of servers, the Database and other information systems, etc.); • Communications and computer network protection (filtering of the shared data, programmes, unwanted data packets, etc.).
2.4. The Bureau seeks to ensure that the data of Data Subjects is complete, up-to-date and accurate; therefore it is revised and updated on a regular basis.
2.5. The Bureau may engage data processors for the processing of Personal Data. In such cases, the Bureau shall take the necessary steps to ensure that such data processors process Personal Data in accordance with the Bureau’s instructions.

3. Objectives and grounds for the processing of Personal Data

The main objectives pursued by the Bureau through the processing of Personal Data:
3.1. To properly perform the duties imposed on or the functions assigned to the Bureau by the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania, i.e. to:
• ensure the functioning of compulsory insurance against civil liability in respect of the use of motor vehicles (hereinafter referred to as compulsory insurance) in Lithuania;
• ensure the operation of the Database;
• perform functions of the Information Centre;
• provide to state authorities and other persons entitled to receive information the up-to-date data referred to in Articles 28 and 42 of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania, in the Law on Road Traffic Safety of the Republic of Lithuania and other legislation;
• provide the information referred to in Articles 6(11), 9(10), 19(15), 28 of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania that is necessary for the conclusion and performance of contracts of compulsory insurance;
• perform the functions of a guarantee fund, handle the claims referred to in Article 17 of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania, pay compensations;
• perform the functions of a compensation body in the Republic of Lithuania, handle the claims referred to in Article 18 of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania, pay compensations;
• perform the functions of the national insurers’ bureau in the Republic of Lithuania, fulfil international obligations of the Bureau as required by the legal acts regulating the Green Card system, handle claims and pay compensations as required by the legal acts regulating the Green Card system;
• collect information about claims representatives of insurance undertakings, and approve claims representatives of insurance undertakings of foreign countries;
• organise and coordinate international cooperation in the field of compulsory insurance;
• coordinate the activities of the insurers related to compulsory insurance;
• fulfil the purpose of the prevention fund.
3.2. To fulfil the requirements and legal obligations set out in the legislation of the European Union and the Republic of Lithuania, and the requirements of international agreements;
3.3. For the purpose of lodging, transferring and defending legal claims, to pursue the Bureau’s legitimate interest in claiming reimbursement of the amounts paid and/or managing the Data Subject’s debt;
3.4. To prevent violations during which compulsory insurance is used unlawfully;
3.5. To assess data on the Data Subject to the extent required for the provision of information about the concluded insurance contracts and caused road accidents, for the issuing of a Green Card, and for making decisions related to debt and risk management, and fraud prevention.
3.6. To examine and handle complaints, applications or notifications, and to ensure proper clerical work and internal administration;
3.7. To conclude and perform contracts;
3.8. For the purposes of archiving, statistics, modelling and analysis, to ensure the public interest in other tasks assigned to the Bureau.

One or more of the above mentioned objectives and legal grounds may apply to the processing of the same Personal Data.

4. Categories of Personal Data

The main categories of Data Subjects, the data on which is collected by the Bureau, include, but are not limited to:
4.1. Persons who have sustained damage;
4.2. Persons responsible for a road accident;
4.3. Debtors of the Bureau;
4.4. Persons involved in road accidents;
4.5. Users of motor vehicles;
4.6. Holders of the compulsory insurance policy;
4.7. Claims representatives of insurance undertakings;
4.8. Persons who have submitted complaints, applications or notifications;
4.9. Persons providing services to the Bureau;
4.10. Legal representatives of Data Subjects (acting under a power of attorney or on other grounds);
4.11. The employees of the Bureau.

The main categories of Personal Data processed by the Bureau include, but are not limited to:

  • Person’s identity data, such as the name, surname, personal identification number, date of birth, data indicated in an ID document (passport, personal identity card), signature.
  • Contact details, such as the address, phone, fax number, e-mail address, communication language.
  • Data related to work activities, such as the education, place of work, position, professional activities, information on an employment contract, patent, business certificate, services provided, personal social insurance data.
  • Financial data, such as the name of the bank (other credit institution), bank account number.
  • Data on insurance, such as the data indicated in the insurance contract and the insurance certificate (insurer’s name, number, the period of validity, and other information recorded in insurance documents).
  • Data related to the use of motor vehicles and their participation in traffic, such as the data on the motor vehicle (registration number and other motor vehicle identification data, the territory in which the motor vehicle is normally based, model, make, type, data on the owner, date of purchase, maintenance history, information on its participation in traffic, photographs and video data), data on the motor vehicle’s user.
  • Data on road accidents, such as the place, date, time, circumstances of the road accident, motor vehicles and persons involved in the road accident, circumstances in which the damage was caused, information provided for in the road accident notifications and explanations, data on persons who have sustained damage, persons responsible for causing the road accident and damage, information on the damage caused during a road accident, including the damage to health, the data indicated in police certificates or other provided information on the road accident, the photographs and video data provided in relation to the road accident.
  • Other data important for compensating of damage, claiming reimbursement of the amounts paid and debt management, such as:
    • The data about being subject to civil, administrative or criminal proceedings due to a road accident, the information indicated in decisions and judgements served by courts, the place and period of service of the debtor’s sentence;
    • The data on the family, kinship, heirs, other related persons, including information about minor children;
    • The financial data on received income, benefits, allowances, pensions, compensations, assets and property, current and/or past debts, financial obligations, creditworthiness, credit history, and other information necessary for the calculation of damage and/or for debt collection and management;
    • Other data necessary for compensating of damage and claiming reimbursement of the amounts paid: the data on the damage (including photographs and video data), citizenship, gender, status (student, pensioner, unemployed, etc.), habitual residence of the Data Subject;
    • Other data provided by the Data Subject when applying to the Bureau regarding a road accident or damage.
  • Data obtained during the implementation of the requirements of the legislation, such as the data received from law enforcement authorities, courts, bailiffs, notaries, lawyers, debt collection companies, reinsurers, auditors, experts, the State Social Insurance Fund, the tax administrator, persons carrying out control over compulsory insurance, public bodies, institutions, third parties managing registers, and other persons.
  • Data of the users of the Bureau’s e-services portals, such as login credentials, dates of visits, the IPs assigned by the Internet service provider, and other personal data which the person provides by himself/herself and/or which the Bureau is obliged to process by laws and other legal acts.
  • Data provided in complaints, applications or notifications, such as the data collected when the Data Subject applies to the Bureau or the Bureau’s representative, or communicates to the Bureau by phone, e-mail, notifications and other means of communication (the date of the complaint, application or notification, information indicated in the complaint, application or notification (including special categories of Personal Data, photographs and video data), the information obtained in the course of examination of the complaint, application or notification, and other Personal Data provided by the person).
  • Data indicated in the service contract, such as the information on the amounts paid, and other information recorded in contracts.
  • Other Personal Data which is necessary to achieve the objectives referred to in Clause 3 hereof and/or which the Bureau is obliged to process by laws and other legal acts.

5. Sources of Personal Data

Data is collected and updated, in order to ensure the correctness, both from the Data Subject and using publicly available information on the Data Subject, as well as from other public bodies, institutions, persons, registers or databases whenever it is necessary to implement the provisions of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania and other legislation, and to achieve the objectives referred to in Clause 3 hereof.

6. Recipients of Personal Data

Personal Data are transferred to recipients, such as:
6.1. Public bodies and institutions, other persons performing the functions and legal obligations assigned to them by law, or carrying out tasks in favour of the public interest (e.g. law enforcement authorities, courts, bailiffs, notaries, lawyers, the State Social Insurance Fund, Territorial Health Insurance Funds, persons carrying out tax administration and control, etc.);
6.2. Third parties managing the registers (including the Population Register, the Register of Legal Entities, the Central Mortgage Office, the registers referred to in Article 271 of the Republic of Lithuania Law on Road Traffic Safety, or other registers in which Personal Data is processed);
6.3. Persons carrying out control over compulsory insurance;
6.4. Reinsurers and compulsory insurance undertakings;
6.5. Persons involved in the process of compensation for damage;
6.6. Persons who have sustained damage, and their representatives;
6.7. Persons responsible for a road accident or damage, and their representatives;
6.8. Persons involved in a road accident, and their representatives;
6.9. Bankruptcy administrators, debt collection companies to which claims over the Data Subject’s debt are transferred, companies providing debt management services, and other persons helping to exercise the Bureau’s right to claim reimbursement of the amounts paid (UAB Creditinfo, UAB Gelvora, UAB Julianus Inkaso, etc.);
6.10. Auditors, legal and financial advisers, experts;
6.11. Data processors authorised by the Bureau;
6.12. National insurers’ bureaux, compensation bodies, guarantee funds, information centres, and other bodies operating under the Directive of the European Parliament and the Council governing compulsory insurance;

6.13. Other persons whose services the Bureau uses in performing the functions referred to in Clause 3.1 hereof, such as financial institutions, telecommunications companies, archiving, postal service providers, persons providing information technology and website administration services, experts, healthcare institutions, the Disability and Working Capacity Assessment Office, the Lithuanian Labour Exchange as well as other persons having a legitimate interest in accessing Personal Data of claims handled by the Bureau, or to whom the data must be provided for the purpose of handling claims and paying compensations);
6.14. Other recipients when the legislation requires the disclosure of Personal Data, and other persons having a legitimate interest.

7. Geographical area of processing

7.1. Personal Data is usually processed within the territory of the European Union / European Economic Area (EU/EEA), but in certain cases, Personal data may be transferred and processed outside the EU/EEA.
7.2. Personal Data may be transferred outside the EU/EEA to the persons referred to in Article 28(6) of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania (national insurers’ bureaux of other states, guarantee funds, reinsurers, etc.) where the transfer is required under international agreements on the handling of the claim and/or the provision of information.

8. Retention period

8.1. Personal Data shall be processed only for as long as it is necessary for the purposes referred to herein, or for as long as provided for by the legislation if a longer data retention period is not laid down in it. The Personal Data retention period is defined taking into account the nature of the functions performed by the Bureau, the Bureau’s legitimate interest, or the requirements of the legislation (e.g. those governing accounting requirements, the period of limitation, activities of the information centre, clerical work, etc.).

9. Rights of the Data Subject

The Data Subject’s rights related to the processing of his/her Personal Data, as guaranteed by the legislation:
9.1. To require rectification of Personal Data if they are incorrect, incomplete or inaccurate;
9.2. If there are grounds provided for in the legislation, to object to the processing of his/her Personal Data;
9.3. If there are grounds provided for in the legislation, to request erasure of his/her Personal Data;
9.4. If there are grounds provided for in the legislation, to restrict the processing of his/her Personal Data, e.g. for a period enabling the Bureau to evaluate whether the Data Subject has the right to request erasure of his/her Personal Data;
9.5. To get information on whether the Bureau processes his/her Personal Data and, if so, to access them;
9.6. To get, in writing or a commonly used electronic form, Personal Data provided by himself/herself, which are processed on the basis of his/her consent or contract, and, if possible, to transfer such data to another service provider (right to data portability); 9.7. If the Bureau has been given the consent to process Personal Data – to withdraw it;
9.8. To not consent to a fully automated decision, including profiling, if such decision making has legal consequences or a similar significant effect on the Data Subject;
9.9. To apply to the Bureau or lodge a complaint with the State Data Protection Inspectorate regarding the processing of Personal Data if the Data Subject believes that his/her Personal Data are processed in violation of his/her rights and legitimate interests laid down in the legislation.

The Data Subject shall be granted access to Personal Data, and Personal Data shall be rectified and destroyed, or their processing actions shall be suspended only after establishing the Data Subject’s identity.

The rights referred to in Clauses 9.2- 9.4 hereof may not apply where the processing of Personal Data is required for the proper implementation of the provisions of the Law on Compulsory Insurance against Civil Liability in Respect of the Use of Motor Vehicles of the Republic of Lithuania and of other legislation, for lodging, exercising and defending legal claims, for the protection of rights of other natural or legal person, for the performance of functions, as provided for in relation to the Bureau in the legislation, in the public interest, or if there are other grounds for the lawfulness of processing.

If the Data Subject’s data are processed due to a debt to the Bureau, the debtor shall have the right to get acquainted with the processing of such Data directly at UAB Creditinfo Lietuva (address: A. Goštauto St. 40A, LT 01112 Vilnius, Lithuania, http://www.manocreditinfo.lt/, phone: (8 5) 2394149).
For the sake of convenience, we provide the main provisions of UAB Creditinfo Lietuva regarding data processing and security:
“The credit Bureau processes and provides to third parties (financial institutions, telecommunications companies, insurance, electricity suppliers and utilities, trading companies, etc.) your information for the legitimate interests and purposes of assessing creditworthiness and managing the debt. Credit history data are processed for 10 years after the fulfilment of obligations.
You can access your credit history by applying to the credit Bureau directly or using the Finpass mobile application.
You also have the right to request rectification or erasure or restrict the processing of data, and the right to object to the processing of data, as well as the right to data portability.
You can find out more about the exercise of and restrictions on these rights at www.manocreditinfo.lt.”

10. Contact information

10.1. The Data Subject has the right to contact the Bureau with a view to submitting queries, withdrawing the consents given, submitting requests for the exercise of rights of the Data Subject, and complaints regarding the processing of Personal Data.
10.2. The Bureau’s contact details:
Algirdo St. 38, LT – 03606 Vilnius.
E-mail: biuras@cab.lt
10.3. If it is unclear or you have complaints about how your personal data is used, please contact Data Protection Officer appointed by the Bureau, head of legal department Renata Veselkienė, e-mail: duomenuapsauga@cab.lt.