HDPA (Greece) - 43/2019: Difference between revisions

From GDPRhub
No edit summary
No edit summary
Line 1: Line 1:
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
{{DPAdecisionBOX
! colspan="2" |HDPA - 43/2019
|-
| colspan="2" style="padding: 20px; background-color:#ffffff" |[[File:logoGR.jpg|center|250px]]
|-
|Authority:||[[HDPA (Greece)]]
[[Category:HDPA (Greece)]]
|-
|Jurisdiction:||[[Data Protection in Greece|Greece]]
[[Category: Greece]]
|-
|Relevant Law:||


[[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]
|Jurisdiction=Greece
[[Category:Article 5(1)(a) GDPR]]
|DPA-BG-Color=background-color:#ffffff;
|DPAlogo=LogoGR.jpg
|DPA_Abbrevation=HDPA (Greece)
|DPA_With_Country=HDPA (Greece)


[[Article 5 GDPR#2|Article 5(2) GDPR]]
|Case_Number_Name=43/2019
[[Category:Article 5(2) GDPR]]
|ECLI=


[[Article 58 GDPR#2c|Article 58(2)(c) GDPR]]
|Original_Source_Name_1=HDPA
[[Category:Article 58(2)(c) GDPR]]
|Original_Source_Link_1=https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2019&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7
|Original_Source_Language_1=Greek
|Original_Source_Language__Code_1=EL
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=


[[Article 58 GDPR#2d|Article 58(2)(d) GDPR]]
|Type=Complaint
[[Category:Article 58(2)(d) GDPR]]
|Outcome=Upheld
|Date_Started=
|Date_Decided=
|Date_Published=13.01.2020
|Year=
|Fine=15,000
|Currency=EUR


[[Article 58 GDPR#2i|Article 58(2)(i) GDPR]]
|GDPR_Article_1=Article 5(1)(a) GDPR
[[Category:Article 58(2)(i) GDPR]]
|GDPR_Article_Link_1=Article 5 GDPR#1a
|GDPR_Article_2=Article 5(2) GDPR
|GDPR_Article_Link_2=Article 5 GDPR#2
|GDPR_Article_3=Article 58(2)(c) GDPR
|GDPR_Article_Link_3=Article 58 GDPR#2c
|GDPR_Article_4=Article 58(2)(d) GDPR
|GDPR_Article_Link_4=Article 58 GDPR#2d
|GDPR_Article_5=Article 58(2)(d) GDPR
|GDPR_Article_Link_5=Article 58 GDPR#2d
|GDPR_Article_6=Article 58(2)(i) GDPR
|GDPR_Article_Link_6=Article 58 GDPR#2i
|GDPR_Article_6=Article 83(2) GDPR
|GDPR_Article_Link_6=Article 83 GDPR#2


[[Article 83 GDPR#2|Article 83(2) GDPR]]
|EU_Law_Name_1=
[[Category:Article 83(2) GDPR]]
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=


|-
|National_Law_Name_1=
|Type:||Complaint
|National_Law_Link_1=
|-
|National_Law_Name_2=
|Outcome:||Upheld
|National_Law_Link_2=
|-
|Decided:||n/a


[[Category:2020]]
|Party_Name_1=ALLSEAS MARINE S.A.
|-
|Party_Link_1=https://www.allseas.gr/en
|Published:||13. 1. 2020
|Party_Name_2=
|-
|Party_Link_2=
|Fine:||EUR 15,000
|Party_Name_3=
|-
|Party_Link_3=
|Parties:||[https://www.allseas.gr/en ALLSEAS MARINE S.A.]
 
|-
|Appeal_To_Body=
|National Case Number:||43/2019
|Appeal_To_Case_Number_Name=
|-
|Appeal_To_Status=
|European Case Law Identifier:||n/a
|Appeal_To_Link=
|-
 
|Appeal:||n/a
|Initial_Contributor=
|-
|
|Original Language:||[[Category:Greek]]
}}
Greek
|-
|Original Source:||[https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2019&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7 HDPA (GR)]
|}


The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR. The HDPA also issued a fine EUR 15,000 for violation of the data subject’s right to access and of the principles relating to data processing as foreseen under [[Article 5 GDPR#1|Article 5(1) GDPR]].  
The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR. The HDPA also issued a fine EUR 15,000 for violation of the data subject’s right to access and of the principles relating to data processing as foreseen under [[Article 5 GDPR#1|Article 5(1) GDPR]].  

Revision as of 16:03, 7 March 2022

HDPA (Greece) - 43/2019
LogoGR.jpg
Authority: HDPA (Greece)
Jurisdiction: Greece
Relevant Law: Article 5(1)(a) GDPR
Article 5(2) GDPR
Article 58(2)(c) GDPR
Article 58(2)(d) GDPR
Article 58(2)(d) GDPR
Article 83(2) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published: 13.01.2020
Fine: 15,000 EUR
Parties: ALLSEAS MARINE S.A.
National Case Number/Name: 43/2019
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Greek
Original Source: HDPA (in EL)
Initial Contributor: n/a

The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR. The HDPA also issued a fine EUR 15,000 for violation of the data subject’s right to access and of the principles relating to data processing as foreseen under Article 5(1) GDPR.

English Summary

Facts

The Complainant was General Manager and DPO of the company ALLSEAS MARINE S.A., which according to his complaint processed without any prior notification and keeps processing his and his family's personal data, including sensitive data, infringing this way his right as employee to personal data. With his complaint he asked the HDPA to order the company to cease the processing of personal data, to give back to him all his personal data in digital form or hard copies and to impose an adequate fine. The personal data was mainly collected via a video surveillance system.

Dispute

The DPA had to assess whether the stored data was personal and whether any exceptions shall apply due to the employment relationship and context.

Holding

The HDPA found that the controller, acting as data controller in this case, failed to prove the lawfulness of installation and operation of the video surveillance system. The company did not provide technical information about that system and had not notified the HDPA for its installation as was provided for in Article 19(4)(a) of L. 2471/1997 which was in force until GDPR came into force. It, thus, violated the principle of accountability according to Article 5(2) GDPR and Article 5(1)(a) GDPR. The HDPA found that given these violations there is no reason to further examine whether there is a proper legal basis for the processing. It stressed, however, that even if the complainant had given his consent prior to the installation, the consent wouldn't be valid due to the imbalance of power between employer and employee. The HDPA finally:

a) ordered the company to comply immediately with the complainant's request to exercise his right to access and information regarding his personal data stored in a PC owned by the company;

b) ordered the company to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR within 1 month starting from the receipt of this decision;

c)ordered the company comply with the Article 5(1)(a) GDPR and Article 5(2) GDPR, as well as with the rest provisions of Article 5(1) GDPR and

d) issued a fine EUR 15,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

There is no available machine translated decision. Please refer to the Greek original decision for details.
Retrieved from "https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_43/2019&oldid=24199"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki