We represented Car Vertical in a personal data protection court case challenging a decision by the local state data protection authority. The case involved novel questions around how the GDPR applies to collecting, combining, and presenting historical vehicle data from various sources. It required interpretation of GDPR principles like data quality, minimisation, and accountability – especially in the context of the client’s digital product: vehicle history reports.
Car Vertical is a fast-growing Lithuanian scale-up offering vehicle history check services. Customers worldwide can order reports to learn about past damage, mileage, theft, and other important vehicle details.
This case is among the first cases in Lithuania to look at complex GDPR issues in the data aggregation sector. They touched on new legal arguments around processing data for offering of the vehicle history check services.
We led the overall legal strategy and represented the client in administrative courts, working closely with their product, legal, and engineering teams. We:
- Carried out a full review of how data is processed across the client’s platforms
- Built GDPR-based arguments to justify data collection and reuse
- Prepared and submitted legal documents using both EU-level guidance (like EDPB opinions) and local case law
- Advised on ways to improve the product and reduce risks while keeping innovation intact
Our role was key because the case affected the client’s whole business model and ability to grow. It involved legal, reputational, and commercial risks. By working across legal and technical teams, we helped the client defend its approach while showing regulators that it could innovate responsibly.
Also, this case sets an important example how historical and technical data can be reused under GDPR – especially when data is partially anonymised or aggregated. It adds to the legal conversation around data use in regulated digital services, helping to balance individual rights with business needs.
