HDPA (Greece) - 40/2021

HDPA (Greece) - 40/2021
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 15 GDPR Article 21 GDPR Articles 4, 5, 12 and 13 of Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	07.09.2021
Published:
Fine:	10000 EUR
Parties:	Organization of Urban Transport of Thessaloniki (OASTH) Former shareholders of OASTH (anonymous)
National Case Number/Name:	40/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Greek DPA (in EL)
Initial Contributor:	n/a

The Greek DPA fined a public transport company €10,000 for unlawfully disclosing the personal data of two former shareholders in a press release, and for failing to answer the access requests and objections of nine other former shareholders. However, it held the disclosure of ten former shareholders' names involved in a dispute of public interest with the company was not contrary to data protection law.

English Summary

Facts

The Organization of Urban Transport of Thessaloniki (OASTH) was one of the largest transport company in Greece. A few months before OASTH entered in insolvency proceedings, employees of the city of Thessaloniki organized strikes during several days. Those strikes were organized, inter alia, to protest against the fact that dividends had been paid to shareholders, while some due salaries had not been paid to employees. This strike was a central political issue not only for Thessaloniki but also for the entire country. Two years after having been acquired by the Greek State, OASTH remained at the center of many political debates. Aware of this, the President of OASTH decided to implement a policy of transparency towards the public.

In 2021, several former shareholders of OASTH started contesting the return/value of the shares of OASTH. In the context of this dispute, some of the former shareholders entered into settlement negotiations with OASTH, while others got involved is a public feud with the company.

During a press conference, the identity of several former shareholders involved in the dispute was disclosed by the President of OASTH. On the same day, the names of twenty-nine former shareholders were also published in a press release written by OASTH, together with the percentage of their participation in the capital of OASTH, the date of acquisition of the shares, and the acquisition price in euros. Those information were further picked up by journalists and shared in the press and on social media.

Following the publication of these information, nine shareholders decided to exercise their right to access to their personal data, and their right to object to the processing of personal data, in accordance with Article 12 and Article 13 of the Law 2472/1997. OASTH however did not follow up on these requests, before arguing that the shareholders had not paid the administrative fee which was due to submit such requests.

In this context, twelve of the former shareholders (the Complainants) decided to lodge a complaint against OASTH with the Greek DPA, claiming that OASTH had unlawfully processed their personal data and/or had failed to answer their requests, thereby infringing the Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data, as well as the GDPR.

Holding

First, the Greek DPA considered that lawfulness of the processing of the personal data of the Complainants through the publication of the names of the twenty-nine former shareholders in the press release. Considering that the dispute relating to the management and future of OASTH was a matter of public interest, the Greek DPA found that the publication of the names of the former shareholders who had contested the return/value of the shares was legitimate, and outweighed the rights and interests of the shareholders in remaining anonymous. In order to balance the legitimate interest of OASTH to inform the public against the rights of the shareholders, the Greek DPA also took into account the fact that some of these former shareholders were already involved in a public feud with OASTH, while others had sent the latter an out-of-court settlement which had been made public.

The Greek DPA however found that the publication of the names of two of the Complainants was not justified for informing the public, as they were not among those who had raised claims with respect to the return/value of the shares. Hence, OASTH had no legitimate interest in disclosing their identity to the public. For this reason, the Greek DPA imposed on OASTH a fine of 3,000 EUR for the publication of these two names.

Finally, with regard to the nine Complainants who had exercised their right to access and to object to the processing of personal data, the Greek DPA found that OASTH had violated the applicable law by not properly answering these requests. The Greek DPA therefore imposed on OASTH a fine of 7,000 euros for violation of Articles 12 and 13 of Law 2472/1997.

In total, the Greek DPA therefore imposed a fine of 10,000 EUR on OASTH for violation of articles 4, 5, 12 and 13 of law 2472/1997. In parallel, the Greek DPA also issued a warning with respect to the lack of compliance of OASTH with the GDPR, and in particular the obligation of the controller to duly consider and answer data subjects' requests.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

  
    

  
  
    
  
    Category
              Decision
          

  
    Date
              07/09/2021

          

  
    Transaction number
              40
          

  
    Thematic unit
          
              03. Public Administration - Local Government - State action
              
      

  
    Summary
              The Authority (co) examined the appeals of 12 former shareholders of OASTH against the Organization, regarding the publication of their names in a press conference given by the President of OASTH and the publication of a list with specific names for 29 former shareholders. The list was included in a relevant OASTH Press Release published on the same day. First, the Authority considered that the issues related to the operation and the future of OASTH were a matter of public interest and in this context the publication of the names of the former shareholders who raised claims from the value / return of the share (they had also sent a relevant out-of-court settlement to OASTH , which was made public) or was in public controversy with the Agency was justified. However, two names of shareholders were mentioned who were not justified in informing the public, as they were not included in those who raised claims. For this reason, the Authority imposed on OASTH a fine of 3,000 euros for the publication of these two names. Furthermore, with regard to the applicants, who also complain about the dissatisfaction of a right they had exercised with OASTH, based on Law 2472/1997, the Authority imposed on OASTH a fine of 7,000 euros for violation of Articles 12 and 13 of Law 2472 / 1997. The Authority, taking into account articles 4, 5, 12 and 13 of law 2472/1997, imposed on OASTH a fine of a total amount of 10,000 euros for established violations of the same law. Finally, he issued a warning for the compliance of OASTH with the provisions of the GCP, in particular for the exercise of data subject rights and their response in accordance with the law.

          

  
    PDF Decision
              40_2021anonym.pdf227.86 KB
          

  


    
  
    Category
              Decision
          

  
    Date
              07/09/2021

          

  
    Transaction number
              40
          

  
    Thematic unit
          
              03. Public Administration - Local Government - State action
              
      

  
    Summary
              The Authority (co) examined the appeals of 12 former shareholders of OASTH against the Organization, regarding the publication of their names in a press conference given by the President of OASTH and the publication of a list with specific names for 29 former shareholders. The list was included in a relevant OASTH Press Release published on the same day. First, the Authority considered that the issues related to the operation and the future of OASTH were a matter of public interest and in this context the publication of the names of the former shareholders who raised claims from the value / return of the share (they had also sent a relevant out-of-court settlement to OASTH , which was made public) or was in public controversy with the Agency was justified. However, two names of shareholders were mentioned who were not justified in informing the public, as they were not included in those who raised claims. For this reason, the Authority imposed on OASTH a fine of 3,000 euros for the publication of these two names. Furthermore, with regard to the applicants, who also complain about the dissatisfaction of a right they had exercised with OASTH, based on Law 2472/1997, the Authority imposed on OASTH a fine of 7,000 euros for violation of Articles 12 and 13 of Law 2472 / 1997. The Authority, taking into account articles 4, 5, 12 and 13 of law 2472/1997, imposed on OASTH a fine of a total amount of 10,000 euros for established violations of the same law. Finally, he issued a warning for the compliance of OASTH with the provisions of the GCP, in particular for the exercise of data subject rights and their response in accordance with the law.

          

  
    PDF Decision
              40_2021anonym.pdf227.86 KB