Laurynas Lukošiūnas, managing partner of the law firm “HUB Legal,” told 15min that the class action lawsuit has already been prepared and sent for review to the individuals affected by the data leak from the Register Center who joined the joint lawsuit.
Read more Thursday quiz: can you answer at least 8 out of 10 general knowledge questions?
“HUB Legal” initiated this process immediately after the scandal broke out, and after publicly inviting people to join the lawsuit and creating a website, the lawyers received over 3,000 inquiries.
“We have done a great job, relying not only on Lithuanian but also foreign examples. To date, over 700 people have joined the complaint and signed representation agreements. We believe that by the time we finish the lawsuit submission process, this number will grow to 1,000. Within three weeks, when we finalize the draft, we will submit it to the court,” explained L. Lukošiūnas about the progress.
More lawyers have taken similar initiatives, so L. Lukošiūnas said that if several lawsuits are submitted to the court, it is likely that they will be consolidated.
“We have made significant progress, so others will probably be joined to our case,” said the managing partner of “HUB Legal.”
Demanding millions in compensation from the state
L. Lukošiūnas stated that the class action lawsuit demands compensation for non-material damage to the affected residents whose data was stolen.
“The complaint describes the entire situation: the state’s duties, the roles of the Register Center and the Ministry of Justice (one is the data controller, the other the processor). It explains why it is important to protect this data and what risks arose for people when they lost it.
In this case, we are talking about non-material damage — people’s experiences, stress, and inconveniences. We currently do not have evidence of material damage (for example, if someone used the data to take out a loan), but the complaint can be supplemented later – the statute of limitations is three years. We have no doubt that leaked personal codes and residential addresses are already on the dark web, which causes a justified feeling of insecurity. The state did not fulfill its duties, trust was lost. Abroad, data leaks of such sensitive information are taken very seriously,” said L. Lukošiūnas.
The lawyers submitting the class action plan to request 5,000 euros in non-material damage compensation from the Register Center, the Ministry of Justice, and the Migration Department for each affected person – meaning this would already amount to 3.5 million euros.
An unprecedented case
L. Lukošiūnas said that the mass data leak from the registers managed by the Register Center is the first such case in Lithuania.
“There is no precedent, so we are guided by foreign examples. The Court of Justice of the European Union has taken a very strict stance on data sensitivity. This will be a unique case even on the scale of the European Union. It certainly will not be simple and may be examined for many years. It may be necessary to seek clarifications from the EU Court of Justice and go through several instances,” said L. Lukošiūnas, prepared for a long journey.
Read more FDA-approved drug for ADHD, working in a completely new way
Working on a success fee basis
The lawyers who prepared the class action work on a success fee basis – this means that affected residents who joined the class action will not have to pay for legal services, but in case of success, if the courts award them compensation, the lawyers will take a portion of that amount as a fee.
“Our success fee is 30% of the awarded amount. This may seem high, but now people do not have to pay anything. And we can work for five years without any guarantees. If nothing is awarded — we get nothing,” commented L. Lukošiūnas.
However, there is a small, more theoretical risk, according to L. Lukošiūnas, that if the lawyers lose the case and the state hires external lawyers, the court could order the costs to be paid by all members of the group who submitted the complaint.
“But usually the state is represented by the Ministry of Justice’s lawyers and no costs are awarded. Even if that happened, divided among a thousand people, it would be minimal amounts. We indicate this in our agreements for transparency, but the likelihood of such a scenario is very low,” said L. Lukošiūnas.
600 thousand data records leaked
The scandal over the Register Center data leak arose in May, when the 15min portal was the first to report on the incident.
However, although affected residents learned about the stolen data only in May, unauthorized access to the registers managed by the Register Center occurred much earlier – from January to April.
According to law enforcement data, more than 600,000 Real Estate Register entries were illegally accessed and downloaded over several months through accounts of Migration Department employees hacked from abroad. The institution learned about the possible incident in early April, and the public was informed only at the end of May.
The leaked data included residents’ names, surnames, personal codes, birth dates, real estate addresses, register numbers, cadastral data, as well as information about property rights and their registration basis. The Register Center emphasized that no contact details, bank account numbers, payment information, or documents related to property transactions were disclosed. The company also stated that there was no hacking into the Register Center’s own systems – access to data was obtained through legitimate user accounts held by the Migration Department.
Due to this case, the General Prosecutor’s Office initiated a pre-trial investigation, and the State Data Protection Inspectorate started its own investigation. Questions arose in the public space not only about the scale of the leak but also about why residents were informed about the incident late.
The incident already had political consequences – after the scandal became public, the head of the Register Center, Adrijus Jusas, resigned.
