HDPA (Greece) - 1/2022: Difference between revisions
No edit summary |
m (Lwr moved page HDPA (Greece) - 1/2021 to HDPA (Greece) - 1/2022) |
||
| (One intermediate revision by one other user not shown) | |||
| Line 47: | Line 47: | ||
}} | }} | ||
The | The Hellenic DPA fined a Greek company €1000 for violating [[Article 15 GDPR]] and [[Article 12 GDPR#3|Article 12(3) GDPR]] by not granting a data subject their right of access in due time. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
In 2019 a data subject submitted a complaint to the | In 2019 a data subject submitted a complaint to the Hellenic DPA (HDPA) against a Greek company "Egnatia Odos S.A." for its refusal to provide the complainant with a photographic material and a copy from a Book of Recorded Events in relation to a non-payment of a toll fee they were charged with. | ||
The company stated that it was unable to provide such information to third parties without any procedural order. The HDPA informed the company that according to | The company stated that it was unable to provide such information to third parties without any procedural order. The HDPA informed the company that according to [[Article 15 GDPR]], the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. The HDPA also noted that, the controller had a time limit in order to respond to the data subject's request according to Article 12(3) GDPR. | ||
The company then only provided the claimant with a copy of the Book of the Recorded Events, since the photographic material of that day did not exist because of a technical problem. | The company then only provided the claimant with a copy of the Book of the Recorded Events, since the photographic material of that day did not exist because of a technical problem. | ||
| Line 63: | Line 63: | ||
The HDPA held that the company not only refused to answer the data subject's request, but also tried to mislead the subject by stating that it was not required to provide data to third parties without a procedural order. | The HDPA held that the company not only refused to answer the data subject's request, but also tried to mislead the subject by stating that it was not required to provide data to third parties without a procedural order. | ||
The HDPA held that it had previously informed the company about its right of access obligations in a recommendation regarding a similar incident that took place before the GDPR entered into force, and that these requirements had not changed substantially since GDPR entered into force. | The HDPA held that it had previously informed the company about its right of access obligations in a recommendation regarding a similar incident that took place before the GDPR entered into force, and that these requirements had not changed substantially since the GDPR entered into force. | ||
The HDPA also highlighted that the data subject should not be considered a third party, and that under [[Article 15 GDPR]] it is irrelevant for what purpose the subject exercises the right of access, as this provision doesn't lay down any conditions | The HDPA also highlighted that the data subject should have not be considered a third party, and that under [[Article 15 GDPR]] it is irrelevant for what purpose the subject exercises the right of access, as this provision doesn't lay down any conditions in this regard. | ||
The HDPA fined the company €1000 for violations of [[Article 15 GDPR]] and [[Article 12 GDPR#3|Article 12(3)]] by not granting the data subject their right of access in due time. | The HDPA fined the company €1000 for violations of [[Article 15 GDPR]] and [[Article 12 GDPR#3|Article 12(3)]] by not granting the data subject their right of access in due time. | ||
== Comment == | == Comment == | ||
Latest revision as of 07:35, 4 August 2023
| HDPA (Greece) - 1/2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 12(3) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 06.10.2021 |
| Published: | 05.01.2022 |
| Fine: | 1000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 1/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Anastasia.Tsermenidou |
The Hellenic DPA fined a Greek company €1000 for violating Article 15 GDPR and Article 12(3) GDPR by not granting a data subject their right of access in due time.
English Summary
Facts
In 2019 a data subject submitted a complaint to the Hellenic DPA (HDPA) against a Greek company "Egnatia Odos S.A." for its refusal to provide the complainant with a photographic material and a copy from a Book of Recorded Events in relation to a non-payment of a toll fee they were charged with.
The company stated that it was unable to provide such information to third parties without any procedural order. The HDPA informed the company that according to Article 15 GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. The HDPA also noted that, the controller had a time limit in order to respond to the data subject's request according to Article 12(3) GDPR.
The company then only provided the claimant with a copy of the Book of the Recorded Events, since the photographic material of that day did not exist because of a technical problem.
The HDPA called the company to express its opinions concerning the incident. The company stated that it had communicated constantly with the data subject, and had sent them the copy from the Book of the Recorded Events which according to them was sufficient in order to prove a violation of a toll fee payment.
Holding
The HDPA held that the company not only refused to answer the data subject's request, but also tried to mislead the subject by stating that it was not required to provide data to third parties without a procedural order.
The HDPA held that it had previously informed the company about its right of access obligations in a recommendation regarding a similar incident that took place before the GDPR entered into force, and that these requirements had not changed substantially since the GDPR entered into force.
The HDPA also highlighted that the data subject should have not be considered a third party, and that under Article 15 GDPR it is irrelevant for what purpose the subject exercises the right of access, as this provision doesn't lay down any conditions in this regard.
The HDPA fined the company €1000 for violations of Article 15 GDPR and Article 12(3) by not granting the data subject their right of access in due time.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Category
Decision
Date
05/01/2022
Transaction number
1
Thematic unit
15. Video surveillance
16. Other
Applicable provisions
Article 12.3: Deadline for responding to a right
Summary
A toll management company operates a video surveillance system in order to detect violations of non-payment of tolls. After being informed about a fine imposed on him, a car owner. exercised the right of access to the company in order to obtain photographic material and a copy of the incident book in connection with the imputation of the infringement. The company initially replied that the crossing had been recorded by the toll station crossing system, but could only provide information by order of the Prosecutor and with the relevant permission of the Authority. Following the intervention of the Authority, the company provided the available data, which did not include visual material. The Authority, which had informed the company as early as 2017 that such requests constitute an exercise of the right of access, which it must satisfy, imposed a fine of 1,000 euros due to delayed satisfaction of the right.
PDF Decision
1_2022 anonym.pdf270.25 KB
Category
Decision
Date
05/01/2022
Transaction number
1
Thematic unit
15. Video surveillance
16. Other
Applicable provisions
Article 12.3: Deadline for responding to a right
Summary
A toll management company operates a video surveillance system in order to detect violations of non-payment of tolls. After being informed about a fine imposed on him, a car owner. exercised the right of access to the company in order to obtain photographic material and a copy of the incident book in connection with the imputation of the infringement. The company initially replied that the crossing had been recorded by the toll station crossing system, but could only provide information by order of the Prosecutor and with the relevant permission of the Authority. Following the intervention of the Authority, the company provided the available data, which did not include visual material. The Authority, which had informed the company as early as 2017 that such requests constitute an exercise of the right of access, which it must satisfy, imposed a fine of 1,000 euros due to delayed satisfaction of the right.
PDF Decision
1_2022 anonym.pdf270.25 KB
