Category: Personal data protection

A single comment on social media could end up in court 

Posted on by avocad_bxgv12hf

On social media, it often seems like you can say anything. However, the reality is different—words shared in the public sphere can have very specific legal consequences. Julius Sakalauskas, an attorney with the law firm AVOCAD, says that in Lithuania, there are increasingly frequent cases where comments or posts on the internet become the subject of legal disputes in court. “The internet is not a free zone where you can say anything. Liability for words in the public sphere can be the same as in traditional media,” the lawyer emphasizes.

The Constitution of the Republic of Lithuania stipulates that human dignity is protected by law. This means that the same rules apply on social media as in any other public space. According to the attorney, a person’s honor and dignity are violated when information that does not correspond to reality is disseminated about them, thereby damaging their reputation. In such cases, courts evaluate several key factors: whether the information was disseminated publicly, whether it relates to a specific person, whether it is untrue, and whether it demeans a person’s honor and dignity. “If all these conditions are met, the person who disseminated such information may face legal liability. It is important to note that even a single post on a social network can be considered public dissemination of information,” explains J. Sakalauskas.

Not all criticism is defamation

However, the lawyer emphasizes that not every sharp or critical comment is considered a violation. In a democratic society, people have the right to express their opinions, and freedom of expression is protected. “An opinion is a subjective assessment—for example, that someone’s actions appear unprofessional. However, a problem arises when an opinion that does not correspond to reality is presented as a fact,” says the lawyer. If a person claims that another person committed a specific act—for example, embezzled money—and this is not true, such a statement may already be considered a violation of honor and dignity.

Furthermore, an opinion that is unethical, dishonest, unsupported by any arguments or facts, or that omits certain facts may also violate a person’s honor and dignity and result in legal liability.

It is often assumed that only the person who wrote a comment is responsible for it. In practice, however, liability may extend further. “First and foremost, the responsibility lies with the author of the comment. However, in certain cases, it may also fall on the platform or website administrator if they are aware of clearly illegal content, tolerate it, and fail to remove it in a timely manner,” explains the attorney. This means that liability can also be joint and several, which is why most platforms actively monitor comments and respond to violations.

What should you do if false information is spread about you?

When faced with defamatory information, the most important thing is to respond quickly. According to the lawyer, the first step is to contact the author of the information or the platform and demand that the false information be removed or refuted. It is also possible to file a formal complaint and seek compensation for damages.

“If the information is clearly defamatory, you can also contact the police. And if an amicable resolution cannot be reached, the dispute goes to court,” says J. Sakalauskas.

The consequences of defamatory comments can be very real and tangible. Civil liability is most commonly applied—a court may order the removal of the information, require a retraction, and award compensation for both pecuniary and non-pecuniary damages. This may also include litigation and attorney’s fees.

“The amount of non-pecuniary damages depends on the nature of the information published and its dissemination. On the internet, this can be particularly extensive, so the impact on a person’s reputation can be very significant,” the lawyer emphasizes.

Cases in which a person is unjustly accused of committing a crime are viewed with particular severity.

Social media platforms are increasingly finding themselves in court

In Lithuania, there is a growing number of cases where social media posts become the subject of legal disputes. “We see many situations where politicians or individuals who consider themselves media representatives publicly accuse others of, for example, embezzling funds intended for aid. Such cases are treated strictly in court,” says the lawyer.

If it is determined that false information has been disseminated that defames a person’s honor and dignity—that is, violates that person’s rights—legal liability shall apply.

The lawyer has a simple but important piece of advice for all social media users. “Before posting a comment, ask yourself: could you say the same thing to someone face to face?” says J. Sakalauskas.

According to him, it is important to remember that there is a real person behind every profile, and carelessly shared information can have long-term consequences.

Criticism is both permissible and necessary, but it must be well-reasoned, respectful, and based on facts. If there is any doubt about the accuracy of information, it should be presented as an opinion rather than a fact.

“Social media is no longer a place where responsibility disappears—it remains just as it is in real life. Speaking responsibly online is the best way to avoid legal problems,” the lawyer concludes.

The Epstein case in the public sphere: when can a comment in Lithuania become grounds for legal liability?

Posted on by avocad_bxgv12hf

In recent days, there has been much public discussion about the Jeffrey Epstein case and the people associated with it. Social networks have been flooded with comments, emotional reactions, assessments, and interpretations that often go beyond the bounds of ordinary opinion. However, what may seem to many as spontaneous statements on the internet can have very specific and real consequences from a legal point of view.

The wave of discussion was further intensified by the fact that the US Department of Justice, in compliance with a court order, published documents related to the case. Although the disclosure itself was based on legal grounds, this does not automatically mean that all the information contained therein can be freely and irresponsibly used in further public communication. According to lawyers, questions about the alleged anonymization of data are increasingly arising in practice—formally hidden names or surnames do not necessarily mean that a person can no longer be identified when considering the entire context and additional circumstances.

According to Mantas Baigys, a lawyer at the AVOCAD law firm and an expert in personal data protection law, public discussion of high-profile cases reveals that society still does not sufficiently understand where freedom of expression ends and legal responsibility begins.

According to the lawyer, one of the most frequently ignored aspects is comments on social networks. "People driven by emotions often write statements that can be considered not only offensive or humiliating to a person's honor and dignity, but also as having signs of criminal activity. Threats of violence, justification of violence, or incitement to violence, even if expressed figuratively, can become grounds for a pre-trial investigation. It is important to understand that social networks are legally considered a public space, and words written on them are taken as seriously as those spoken in public or published in the media," says the lawyer.

An equally important issue is the protection of personal data. Information that has been made public, even if it has already been published in foreign media or court documents, does not automatically become freely available. Publicly available data continues to be considered personal data. Its collection, systematization, republication, or distribution on social networks must have a clear legal basis. "This applies not only to private individuals, but also to journalists, opinion makers, and content creators," warns M. Baigys.

In practice, we are increasingly encountering what is known as secondary use of information, where publicly disclosed data is transferred to comments, articles, or social media posts, supplemented with personal interpretations or emotional assessments. According to the lawyer, anyone who disseminates such information further assumes independent legal responsibility, regardless of who was the original source of the information. This means that a person may become a defendant in a civil case in a Lithuanian court based on a claim by the injured party and, in certain cases, face sanctions for violations of the General Data Protection Regulation.

The third, often overlooked aspect is the right to privacy. The Epstein case revealed numerous details about specific individuals' personal relationships, lifestyles, and circumstances that are not necessarily directly related to the legal substance of the case. When driven by curiosity to "dig up more" and publish additional details of private life, it is very easy to cross the line. Even a person involved in a high-profile case does not lose their right to privacy, and in certain cases, violating this right may result in criminal liability.

When assessing the legality of such publications, which contain a wealth of information about individuals, such information cannot be disseminated solely to satisfy public curiosity or create a sensation.

According to AVOCAD's lawyer, this obligation applies not only to individual social media users, but also to journalists and media outlets. Professional activities, freedom of the press, or the dissemination of information to the public do not exempt one from the obligation to constantly assess whether the information published actually serves the public interest or whether it violates a person's right to privacy and personal data protection requirements.Case law consistently emphasizes that the publication of information about a person should not serve solely to generate clicks or satisfy the curiosity of the audience.

In summary, Mantas Baigys emphasizes that the internet often creates a false illusion of security and informality. However, in legal terms, it is the same public space where the same laws and principles of responsibility apply as in real life. It is possible to take an interest in current cases and discuss them, but this should be done responsibly, with the understanding that every public statement can have legal consequences. Legal liability on the internet is not theoretical—it is real, tangible, and increasingly applied in practice.

 

Patient image in advertising: the law is not new, but the market is still 'learning from fines

Posted on by avocad_bxgv12hf

Healthcare advertisements today are still full of patient images, personal stories and before-and-after shots. On social networks, this has become an almost natural way of marketing - sharing customer experiences, changes, feedback or even recommendations. However, this is precisely the kind of communication that is in direct conflict with Article 15(1) of the Law on Advertising, which lays down strict prohibitions on the advertising of medical and healthcare services. Although most clinics are acting in good faith and want to show a real result, the law leaves no room for compromise in this area: the image of the patient, the patient's name, the patient's story or the doctor's recommendation are not allowed in advertising.

Jonas Zaronskis, partner at AVOCAD, says that advertising of healthcare and medical services is one of the most sensitive areas of advertising. "Unlike in the commodity market, it is about human health, dignity and the often fragile state of being. That is why the legislator has chosen to regulate it extremely strictly. Article 15(1) of the Law on Advertising prohibits the use of a patient's name, surname, image and the use of recommendations from healthcare institutions, specialists or their professional organisations," notes Jonas Zaronskis.

According to the lawyer, this provision came about by accident - it aims to protect public health, patient privacy and prevent misleading. Patient stories, before-and-after photos or doctors' recommendations have a very strong emotional impact, which can give the unjustified impression that the outcome will always be the same, regardless of individual circumstances. Restriction primarily protects the consumer from false expectations and emotional pressure to choose a service - particularly important where it is not only about aesthetics, but also about long-term self-confidence and a healthy relationship with one's body.

The amendments to the law have further strengthened these protections. The wording of the prohibition has been extended to cover not only traditional advertising but also digital marketing, social networks and opinion-forming content. "This was done to pre-empt new, visually impactful forms of advertising that can be even more powerful than traditional print or TV media. In other words, the legislator has chosen a principle: it is better to impose strict limits at the outset than to allow abusive precedents in a sensitive area such as health", says Mr Zaronski.

Warnings and fines: real consequences for clinics

According to the lawyer, practice shows that supervision has become stricter in recent years and fines have become significant. For example, in 2023, UAB Vitkus was fined €20,000 for using a patient's image in an advertisement. In 2024, the court upheld this sanction and found that the advertisement was specifically related to healthcare services and that the prohibition should therefore apply in full. In the same year, the Estetus clinic was fined an even higher amount of €40,000 for the mass use of patient images in its advertising. It can be seen that the bar for these amounts is high and the courts do not consider them excessive.

In addition, in practice, the content of an opinion leader speaking from the patient's perspective or sharing personal experiences in return for a reward or a discount is generally considered prohibited. In contrast, more neutral information about the range of services or facilities does not necessarily violate the law. Although no opinion formers have yet been sanctioned, their activities are being actively monitored, and it is likely that in the future, controls may extend to this channel of communication.

Warnings and fines are a real threat to trademarks. Brands that fail to comply with the provisions of the Advertising Law face real consequences. Even a seemingly innocent social network post can become a serious infringement. The SACP has the power to issue warnings and impose fines of various amounts. Official warnings can be issued first - for example, if a clinic uses a patient's photo or testimonial in its advertising. However, a fine of up to 3% of the annual revenue, up to a maximum of €100,000, can also be imposed for a first offence. If the infringements are repeated or considered serious, the penalties are even higher - up to 6% of annual revenue, but not more than €200,000. In addition, failure to comply with the orders of the SCAT can result in additional fines of up to €289 per day of delay for clinics and fines of between €289 and €2,896 for failure to provide information necessary for the investigation.

Where does the patient's image end and the advertising risk begin?

However, according to Jonas Zaronskis, a partner at AVOCAD, such a strict provision is debatable. Clinics have a very different understanding of what constitutes a "patient image": is it just a recognisable face and name, or also anonymised fragments such as a silhouette or body part? There are also different views on the question of which services fall under the category of health care and which under the category of cosmetic services. Do all aesthetic procedures really need to be regulated in the same strict way? This raises legal risks and uncertainties.

Another issue, according to the lawyer, is the proportionality of sanctions. A fine of twenty or forty thousand euros can be a critical financial burden for a smaller clinic, even though the infringement may not have been committed with malicious intent, but rather with unclear limits. Such penalties sometimes seem like a cannon shot at a sparrow when a clearer explanation or preventive measures would have sufficed. "Unfortunately, due to limited institutional resources, the State Consumer Rights Protection Service is more likely to punish than to advise, so clinics learn from sanctions rather than from prior guidance," Zaronskis observes.

In the light of these tensions, it would be rational to review the regulation itself. First of all, the notion of patient image should be defined more precisely, i.e. whether anonymised excerpts should be considered as prohibited. There is also a need for a clearer distinction between health care services and cosmetic services, as the current application is often extremely broad. "In addition, there is a need for detailed guidelines with permitted and non-permitted examples and clear criteria for communication by opinion leaders. It is important to strengthen the counselling function so that prevention is more effective than mere punishment," notes Mr Zaronski.

In conclusion, Article 15(1) of the Law on Advertising reasonably protects the patient, public health and consumer interests. However, according to lawyer Jonas Zaronskis, in the context of modern marketing, this provision sometimes acts as a hammer where a precise surgical tool would be needed.

"The value chain is right, but the application is sometimes too broad and the sanctions are hardly proportionate to smaller players. The solution should therefore not be to relax protections, but to clarify definitions, develop clear guidelines and strengthen advisory practices. For the time being, the safest option for clinics is to adopt a conservative model: avoiding patient images, not using the patient's perspective and not relying on recommendations from doctors or institutions. This helps to avoid fines, but clearer regulation is needed in the future so that the sector can work to ensure both consumer protection and fair competition," the lawyer notes.

 

What if you find misleading information about yourself in a Google search?

Posted on by avocad_bxgv12hf

Have you ever googled yourself and found unpleasant or even misleading information? Such discoveries can cause not only emotional discomfort, but also real damage to your reputation or performance. When can I request that such data be removed from search results and how can I do so? Sandra Mickienė, Senior Associate at AVOCAD, answers these questions and shares practical advice .

Primary Disseminator - the first step

It is important to understand that Google is not the entity that creates or uploads information about an individual to the internet. "As a search engine operator, Google merely indexes sources already available on the Internet and presents them to the user as search results. Therefore, if there are concerns about certain harmful information in the public domain, the first step should not be directed at Google, but at the original disseminator of the information.

Therefore, if you know of a specific natural or legal person who has published information that is untrue or defamatory, it is recommended that you first contact that person and ask them to remove the information. Such a request should be made in writing, clearly stating what information is considered to be untrue, how it violates the rights of the individual, and what action is being requested, such as immediate removal of the specific posting or a public denial of the publication.

However, it is not uncommon for the original disseminator to refuse to remove the information, or not to respond at all to a request, in the event of a belief (or a false declaration of belief) that the information he or she is disseminating is correct, or in the event of a conflicting relationship with the person about whom the information has been published.

In such cases, a person can defend his or her rights in court by suing the original disseminator for unlawful processing of personal data, violation of honour and dignity, and compensation for damages. However, in practice, such procedures take time: it can take several months or even years from the drafting of the lawsuit to a court decision. During this period, untrue information made publicly available on the internet can cause real and lasting damage by interfering with a person's professional, social or personal life.

Therefore, in order to mitigate the negative effects of such information as soon as possible, it is recommended that you do not delay, and that you contact Google to request the removal of the search results associated with such defamatory and untrue information, either in parallel or immediately after receiving a negative response (or no response) from the original disseminator of the information.

Application of the General Data Protection Regulation (GDPR) to search engine operators

The GDPR establishes that it applies not only to controllers established in the EU, but also to companies that offer services to data subjects in the Union or monitor the behaviour of individuals in the EU, regardless of where they are established. Thus, although Google is established outside the EU, it is active in all EU Member States, provides search services in individual national markets (e.g. via google.com, google.de, etc.) and processes data of EU residents, and is therefore directly subject to the GDPR.

The Court of Justice of the European Union (CJEU) has clarified in its case law that search engine operators such as Google are considered to be controllers of personal data under the GDPR when they index, store and make available personal data in the form of search results. This activity - i.e. obtaining information from third-party websites, organising it and presenting it in a structured way according to specific keywords (e.g. a person's name) - constitutes the processing of personal data, notwithstanding the fact that the information itself has been made publicly available by a third party. Moreover, even the mere display of a person's name or picture in search results already constitutes processing of personal data.

Therefore, Google, as data controller, is obliged to ensure the rights of data subjects, including the right to be forgotten, i.e. the right to require search engines to remove links to third-party websites that contain information relating to a specific individual. This obligation arises if (i) the person making the request is located in the EU (the GDPR applies to the processing of data of persons located in EU Member States) and (ii) one of the legal grounds for requesting erasure under Article 17 of the GDPR is present, for example:

  • when the data are no longer necessary for the purpose for which they were collected;
  • where the person withdraws the consent on which the processing was based;
  • where the processing was unlawful;
  • where the data must be erased in accordance with legal requirements.

The CJEU has also clarified that the inclusion of information in search results under a person's name significantly increases its accessibility, which can have a much greater impact on a person's right to privacy than the mere posting of the information itself on the original website. Therefore, where there is a legal basis for requesting the removal of information, search engine operators are obliged to delete links to the relevant pages, even if:

  • that information is still available in the original source,
  • its publication in that source is lawful.

This clarification strengthens the ability of data subjects to control the dissemination of their personal data on the internet and obliges search engine operators such as Google to implement the GDPR requirements responsibly in practice.

Practical tips: what is important to know when considering submitting an erasure request to Google

According to the case law of the CJEU, it is a fundamental principle that the right to privacy and the protection of personal data generally prevails over the commercial interests of the search engine operator or the public's interest to know and obtain information.

However, the right to the protection of personal data is not absolute - if the person is a public figure (e.g. a politician), or the information makes a significant contribution to the public interest or to the democratic debate, or if the information discloses alleged criminal offences or other improper/unlawful conduct, then public interest and the public's right to know may also take precedence over the protection of personal data in such cases. The balance between the individual's right to privacy, data protection and the public's right to be informed would thus be assessed on a case-by-case basis. It would also look at the nature of the information, its relevance, the prominence of the person, the context, the veracity of the information and the manner in which the information was obtained and disseminated.

In practice, we have found that Google often refuses requests to delete information relating to an individual on the grounds of public interest and the public's right to know. For example, when a person requests the removal from search results of links to information that links him or her to an alleged offence, Google often refuses to do so on the grounds that (i) the public has an interest in knowing the information, and (ii) the requester would have to prove that the sentence has been served, the conviction is spent or the like in order to have the information removed.

In this respect, it is important to note that such behaviour by Google is not in line with the case law of the CJEU. Although, in fact, a mere reference to the right to be forgotten is not in itself sufficient - the CJEU has clarified that a person requesting the deletion of information must provide certain evidence to substantiate the false, untrue nature of the information. However, the CJEU has also underlined another very important rule: this burden of proof must not be disproportionate or impossible to meet. The data subject cannot be required to produce a court judgment against the original disseminator or other evidence to prove that the person never committed the acts published in the online links whose removal is requested.

On the contrary, a person may only be subject to requirements that are reasonable in the light of the circumstances of the particular situation. As the CJEU has pointed out, placing an excessive burden of proof on the individual would not only be contrary to the principle of proportionality, but would also, in practice, undermine the exercise of the right to be forgotten.

Google is therefore not entitled to unreasonably burden a person's right to erasure by requiring evidence that the person is not objectively able to provide. Such a requirement violates the principle of proportionality and restricts the effective exercise of this right.

Another important and related aspect is that if the information disseminated about a person is inaccurate or at least partially misleading, the individual's rights to privacy and data protection must be given priority, even if the information relates to a topic of public interest or to a public figure. The CJEU has noted that, even where the data subject plays an important role in public life, the right to freedom of expression and information cannot extend to the right to disseminate or have access to inaccurate information. Therefore, if it is established that at least part of the information contained in the removal request is inaccurate and not of a minor nature, Google must delete the inaccurate, misleading or defamatory data from the search results.

Where and how to apply to Google

If a person decides to exercise the right to be forgotten, he or she must fill in a special Google form available online. When filling in this form, it is necessary to indicate:

  • name and surname;
  • the specific search queries (for example, a person's name) that produce the disputed results;
  • each link (URL) that is requested to be removed from the search results;
  • an explanation of why the information should be removed (e.g. misleading, untrue, defamatory, etc.);
  • additional documents or information in support of the request (if available);
  • proof of identity (e.g. a copy of your ID card or passport).

What to do if Google rejects your request

If a request to remove information is refused, the person may:

  1. contact a national data protection authority, such as the State Data Protection Inspectorate in Lithuania, which may issue a decision and order Google to remove the data if it finds that the individual's rights have been infringed.
  2. defend your rights in court, based on the GDPR and CJEU case law.

In summary, the right to be forgotten is an important personal data protection tool to protect one's reputation and private life against the dissemination of misleading, offensive or outdated information on the internet. While the practical implementation of this right still poses challenges - from the burden of proof to the refusal of requests by search engine operators - the CJEU's jurisprudence clearly defines the limits and helps to strike a balance between the individual's right to privacy and the public's right to know.

The key is not to delay, to act systematically and to follow the law and the CJEU's interpretations. And if you are faced with a difficult situation or a refusal to delete your data, it's a good idea to contact lawyers who can help you to prepare a well-founded and evidence-based request or defend your rights in court.

Does an employer have the right to use an employee's image to advertise services and goods?

Posted on by avocad_bxgv12hf

Today's social networking trends mean that businesses are increasingly involving their employees in the promotion of goods and services they sell.

A side effect of this trend is that, after the termination of their employment contract, employees typically do not want themselves and their image associated with a particular company and its products, and therefore demand that all advertisements be removed from social networks and no longer used in the future. Can employers protect themselves against such demands from employees? Mantas Baigys, attorney at law and personal data law expert at AVOCAD, answers.

Under the Civil Code, a photograph (part of a photograph), portrait or other image of a natural person may be reproduced, sold, displayed, printed, or photographed only with the person's consent. Consent may be given orally, in writing or by implication.

According to the lawyer, neither the Labour Code nor any other legislation prohibits an employee from agreeing with the employer on the use of his/her image to advertise his/her goods and services on social networks.

"One of the essential conditions to be agreed between the employer and the employee is to assess and discuss the duration of the use of the image. In a legal situation where a person has freely authorised the use of his or her image for commercial purposes and has not discussed the term of use in the contract, the right of the person to the image is protected, given that this right is part of the right to privacy," the lawyer notes.

When two legal goods - the right to respect for private life in the context of image protection and the employer's proprietary interests in the advertising of its services and goods - collide, the protection of the individual's right to privacy must be given priority.

For these reasons, if the employee and the employer have not agreed on a time limit for the use of the image, the employee will normally have the right to withdraw his or her consent (which may be withdrawn during the term of the employment contract) to the use of his or her image in the employer's advertisements after the termination of the contract.

A key piece of advice from Mantas Baigis is that the agreement with the employee on the use of his/her image in advertisements, while discussing all the necessary conditions, must also clearly agree on the term of use of the image (e.g. how the image will be used after the end of the employment relationship).

"If such conditions are not included - according to the latest trends in case law - employers will be obliged to remove all advertisements from social networks and may be liable to pay for all the material and non-material damage suffered by the employee," the lawyer points out.

"The issue of the legality of the use of the image may also be investigated by the State Data Protection Inspectorate for breaches of the General Data Protection Regulation in the improper processing of employees' personal data, and if found to be in breach, could lead to huge sanctions," says Mantas Baigys.