HDPA (Greece) - 41/2024

HDPA - 41/2024
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 12(1) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 31 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	16.12.2022
Decided:	26.10.2023
Published:	04.11.2024
Fine:	3000 EUR
Parties:	Parent of a minor (data subject) Private tutorial centre (controller)
National Case Number/Name:	41/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Hellenic DPA (in EL)
Initial Contributor:	Vasiliki Kalantzi

The DPA fined a private tutoring centre €3,000 for failing to provide information on tax receipts and non-cooperation with the supervisory authority.

English Summary

Facts

On 16 December 2022 the parent of an underage boy (data subject), filed a complaint with the DPA for the fact that the data subject's private tutoring centre (the controller) wouldn't respond to his repeated requests, via phone calls and SMS, for access to the personal data of the data subject. In particular, the controller had failed to provide the tax receipts corresponding to the lessons attended by the data subject at the tutoring centre for the academic years 2021-2022.

The DPA requested from the controller clarifications on whether the parent had indeed requested access to the data subjects personal data, if the relevant information had been provided and what response was given.

On 8 March 2023, the controller replied to the DPA that the student had not attended classes for the academic year 2022-2023, but as the controller's reply was deemed irrelevant, the DPA repeated its request, to which on 6 September 2023 the controller replied that they had already provided answers.

On 26 October 2023 the DPA convened a hearing by means of a teleconference which the controller failed to attend, despite being duly invited.

Holding

The Hellenic DPA held that according to Articles 15 and 12 GDPR:

a) Data subjects have the right to know whether personal data concerning them are being processed, and to obtain knowledge of it, without the need to invoke their legitimate interest as a legal basis for their request.

b) Controllers are not exempted from their obligation to inform data subjects on the sole ground that the requested data do not exist in a file held by them.

Furthermore, according to the DPA's established case law, a person who has parental responsibility for their child, has in principle as a legal representative, the right of access to the data relating to their minor child, as referred to in Article 15 GDPR, unless otherwise provided for by a Court decision.

Finally, the DPA held that by showing indifference and failing to provide adequate clarifications regarding the complaint concerning the controller, the controller showed absolutely no willingness to cooperate with the DPA, thus infringing Article 31 GDPR.

For these reasons the DPA imposed a total fine of €3,000 and in particular:

€1,000 for violation of Articles 15(1)(b) and 12(1), (3), (4) GDPR. 

€2,000 for violation of Article 31 GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Athens, 04-11-2024 No. Prot.:3038 Decision 41/2024 (One-person Body) The President of the Authority, as a one-person body according to article 17 par. 1 of n. 4624/2019 (Government Gazette A΄ 137), within the framework of the powers provided for in articles 4 par. 3 and 10 par. 4 of the Regulation of Operation of the Authority (Government Gazette B΄879/25.02.2022), held a meeting via teleconference on 26-10-2023 in order to consider the case mentioned below in the history of this decision. Present without the right to vote was Kyriaki Karakasi, legal auditor-lawyer, as well as Irini Papageorgopoulou, an employee of the administrative affairs department, as secretary. The Authority took into account the following: Submitted to the Data Protection Authority no. first C/EIS/12619/16-12-2022 complaint of A, with which the latter complains about the non-response of the tutoring school under the name "GRIVAS CHARALAMPOS - MOUTZOURI ANASTASIA O.E." through his common-law partner, B, to the right of access to his minor child's personal data which he exercised through written electronic messages (sms). In particular, on 03-05-2022 the complainant sent to the above-mentioned general partner, B, following a relevant telephone conversation with him, an electronic message (sms) requesting the service receipts issued for the courses he attended at the latter's tutoring school his minor child. In view of the fact that, according to his claims, the above request was not satisfied, the complainant came back with the 09-12-2022 and 14-12-2022 electronic L. Kifissias 1-3, 11523 Athens, Tel: 210 6475600, Fax: 210 6475628, contact@dpa.gr / www.dpa.gr, requesting the tax documents for both the year 2021 and those issued until December 2022 as well as information on the educational course of the minor child of. According to the complaint, and despite the fact that B assured the complainant by email that he has sent the requested information, the latter has not received it. The Authority, in the context of examining the above complaint, with no. first C/EX/463/23-02-2023 her document, requested from the complained-about tutoring school, and specifically from the above general partner, B, clarifications pointing out 1 in this regard the established jurisprudence of the Authority, by virtue of which the person exercising parental care of the minor of his child (articles 128 and 1510 Civil Code) he has in principle as legitimate representative of the right of access, according to article 15 of the GDPR, to the data related to his minor child, unless otherwise provided by a court decision (such as a decision designating the other parent as exercising parental care or a decision to prohibit communication with the child). In particular, the Authority requested clarification if the complainant submitted, as he claims, a right of access to data concerning his minor child and to which ones in particular, as well as if and in what way the complainant responded to the above requests or for what reason, if any the requested information was provided in a timely manner, but also if B has actually provided the complainant with copies of the issued tax documents and, in the opposite case, for the reasons non-granting thereof by specifying, in addition, in which name the requested tax documents were issued and exactly what data are included in them. It was requested with the above document of the Authority that all the relevant documents be attached to document the requested clarifications. Following this, the complained-about school sent letter no. first C/EIS/1752/08-03-2023 his response to the Authority, according to which the complainant's son did not attend classes during the academic year 2022-2023 and therefore the collaboration with the latter's ex-wife did not continue with which was communicated by the complained-about school about the minor's progress. Due to the fact that none of the specific 1 See relevant decisions 24/2009, 21, 22 and 53/2010, 130/2013, 18/2018, 4/2020, 26/2021 of the Authority, published on the website of www.dpa.gr 2 questions raised by the Authority with the initial no. first C/EXE/463/23-02-2023 her document, was sent to the complainant and the one with no. first C/ΕΜΕ/1449/07-06-2023 document, after which a new one was summoned as soon as possible to provide the requested clarifications, while at the same time the Authority reminded the complainant of the obligation arising from the GDPR of each data controller to cooperate with the latter (see Article 31 GDPR), otherwise there is a threat of administrative sanctions fine (see article 83 par. 4 a' GDPR). Subsequently, due to the complainant's non-response, the Authority sent the letter with no. first C/EXE/2246/06-09-2023 reminder e-mail message to the complained educational institution, to which we replied with no. first C/EIS/6272/06-09-2023 his message the following: "DEAR MADAM, I HAVE ALREADY SENT ANSWERS AS WELL AS THE CORRESPONDING PROOFS". Following this, the Authority called for a hearing before the President of the Authority as a one-person body via teleconference on 10-26-2023, with the no. Prot. C/EXE/2594/17-10-2023 Summons the complained training school and with no. first C/EXE/2585/17-10-2023 Summons the complainant. In the aforementioned meeting via video conference, the complained tutor did not attend until he received the call and assured the Secretariat of the Authority, which on its initiative also contacted him by phone, that he would appear before the President of the Authority. The complainant appeared in person and supported the content of his complaint pointing out that the contested right of access that he exercised before the complainant as data controller was never satisfied. After the aforementioned hearing, the aforementioned complainant was granted a deadline until 10-30-2023 to provide additional information, in particular with regard to proof of non-deprivation of parental care of his minor child on whose behalf the contested right of access was exercised. Subsequently, the complainant timely submitted the documents with no. first C/EIS/7629, 7630, 7632 and 7645/27-10-2023 additional documents, i.e. his Responsible Declaration from 26-10-2023 that he is the body exercising parental care of his minor child, the screenshot from "SOLON" electronic court case monitoring system, from which it appears that legal aid that had been filed against the complainant with the object of the temporary regulation of the situation was rejected, accompanying the relevant documents a note to the Authority that he was the body exercising parental care both during the period for which he requested the disputed data of his minor child and in the present tense as well as the complainant's out-of-court response from 02-10-2023 to the former his wife, served with no. ... service report of the Judicial Commissioner of the Court of First Instance of Athens, C, in which reference is made to no. ... Decision of the Single Member Court of First Instance of Athens, according to which, as the complainant states, the request of his opponent to be deprived of the parental care he exercises over his minor child was rejected. The Authority, after taking into account the above, THINKS IN ACCORDANCE WITH THE LAW 1. Because of the provisions of articles 51 and 55 of the General Data Protection Regulation (Regulation (EU) 2016/679 – hereinafter, GDPR) and article 9 of Law 4624/2019 (FEKA΄137) it follows that the Authority has the competence to supervise the implementation of the provisions of the GDPR, this law and other regulations concerning the protection of the individual from the processing of personal data. With article 5 par. 1 of the GDPR sets out the principles that must govern a processing. In accordance with the principle of accountability introduced by the said article, it is stated in paragraph 2 thereof that the controller "bears the responsibility and is able to demonstrate 2 compliance with paragraph 1 ("accountability")". As the Authority has judged, a new model of compliance was adopted with the GDPR, the central point of which is the principle of accountability in the context of which the data controller is obliged to plan, implement and generally take the necessary measures and policies, in order for the processing of data to be in accordance with the relevant legislative provisions. In addition, the controller is burdened with the further duty to prove himself and at all times his compliance with the principles of article 5 par. 1 GDPR. 2 See Authority decision 26/2019, paragraph 8, available on its website. 42. Because according to article 15 par. 1, 3 and 4 of the GDPR "1. The data subject has the right to receive from the controller confirmation as to whether or not the personal data concerning him is being processed and, if this is the case, the right to access the personal data and the following information: a) the purposes of the processing, b) the relevant categories of personal data, c) the recipients or categories recipients to whom the personal data have been disclosed or are to be disclosed, in particular recipients in third countries or international organizations, d) if possible, the period for which the personal data will be stored or, when this is impossible, the criteria that determine the period in question, e) the existence of a right to submit a request to the controller for correction or deletion of personal data or restriction of the processing of personal data concerning data subject or right to object to said processing, f) the right to submit a complaint to a supervisory authority, g) when personal data is not collected from the data subject, any available information about its origin, h) the existence of automated decision-making , including profiling, provided for in Article 22 paragraphs 1 and 4 and, at least in these cases, important information about the logic followed, as well as the meaning and foreseeable consequences of said processing for the data subject.  2. […] 3. The controller shall provide a copy of the personal data being processed. […] If the data subject submits the request by electronic means and unless the data subject requests otherwise, the information shall be provided in an electronic format commonly used.4. The right to copy referred to in paragraph 3 does not adversely affect the rights and freedoms of others." These provisions establish the subject's right of access to his personal data. In the context of this right, the subject must have access to personal data that has been collected and concerns him, in order to gain knowledge and be sure of the accuracy and nature of the processing of his data and to verify the legality of the processing, and on the other hand to be able to exercise this right 5 freely and at reasonable intervals . The data controller must provide the possibility of remote access to a secure system through which the 4 data subject obtains direct access to the data concerning him. Furthermore, the Authority firmly accepts that the data subject has the right to know whether personal data concerning him is being processed, as well as to receive knowledge of them, without the need for this to invoke a legitimate interest since this exists and forms the basis of the right of access, that is, the right of the data subject to receive information concerning him and which have been registered in a file kept by the data controller, so that the basic principle of the law for the protection of personal data, which consists in the transparency of the processing as a condition of any further control by the subject of its legality. Similarly, it is not required to invoke the reasons why the data subject wishes to exercise the right of access. Besides, the obligation to satisfy the right of access is universal, i.e. it concerns all the information concerning the subject of the data and furthermore, it does not depend on the invocation of reasons 8 for exercising the right. Consequently, the satisfaction of the right does not depend on a previous judgment of the controller as to whether or not the exercise of the right is justified. 9 Furthermore, according to the correct interpretation and application of par. 1 of article 15 GDPR, the controller is not released from his notification obligation 3 See Recital 63 of the GDPR 4 See also recital 63 of the GDPR and Decision of the Authority 23/2020. 5 Bl. in particular, decisions of the Authority 32/2019, 144/2017 195/2014 193/2014 and 75/2011, available on the website of the Authority. 6 See indicative Decisions of the Authority 2/2020, 23/2020, 16/2017, 98/2014, 149/2014, 72/2013 and 71/2013. 7 See EDPB, Guidelines 01/2022 on data subjects' rights – Right of access, Version 2.0, adopted on 28 March 2023, Ch. 61, par. 167, p 52, https://edpb.europa.eu/system/files/2023-84/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf. See Decision of the Authority 16/2017. 9 See regarding Authority Decision 1/2005, by which it was judged that the data controller must respond to the data subject's access request without vagueness and evasion citing reasons unrelated to the satisfaction of the right of access. See also Authority Decision 16/2017. 6 against the data subject for the sole reason that the disputed data does not exist in a file kept by him.0 3. Because according to article 12 GDPR "1. The controller shall take appropriate measures to provide the data subject […] with any communication under Articles 15 […] 2. The controller shall facilitate the exercise of the data subjects’ rights provided for in Articles 15 […] 3 The controller shall provide the data subject with information on the action taken pursuant to articles 15 to 22 without delay and in any case within one month of receipt of the request. This deadline may be extended by a further two months if necessary, taking into account the complexity of the request and the number of requests. The data controller shall inform the data subject of said extension within one month of receipt of the request, as well as of the reasons for the delay. […] 4. If the data controller does not act on the data subject's request, the data controller shall inform the data subject, without delay and at the latest within one month of receipt of the request, of the reasons for not acting and for the possibility of submitting a complaint to a supervisory authority and bringing legal action." 4. Because according to the provision of article 31 of the GDPR it is provided that "The controller and the processor and, as the case may be, their representatives cooperate, upon request, with the supervisory authority for the exercise of its duties". 5. Because article 1510AK on parental care states, among other things, that "Care for the minor child is the duty and right of the parents (Parental care), who exercise it jointly and equally. Parental care includes the custody of the person, the administration of the property and the representation of the child in any case or legal action concerning the person or his property...". Besides, article 1513A states, among other things, the following: "In cases of divorce or annulment of the marriage or dissolution or annulment of the cohabitation agreement or interruption of the cohabitation of the 10 See SC 2627/2017, sk. 7. See in this regard and those with no. 37/2022, s. 8, 61/2021, 2/2020, sc. 1 and 43/2019 Decisions of the Authority, available on its website www.dpa.gr. 7 spouses or the parties to the cohabitation agreement and as long as both parents are alive, they continue to exercise joint and equal parental responsibility. The parent with whom the child resides, attempts the actions provided for in the first paragraph of article 1516, after prior information of the other parent." 11 6. Because according to the established jurisprudence of the Authority, as mentioned above, the person exercising parental care of his minor child (articles 128 and 1510 AK) has in principle as his legal representative the right of access to the data referred to his minor child according to the above article 15, unless otherwise provided by judicial decision (such as a decision defining as exercising parental care the other parent or a decision to prohibit contact with the child). In particular, in the case under consideration, the complainant as exercising parental care of his minor child jointly and equally with his wife, has the right to access the data of the latter, i.e. the requested tax documents that have been issued as well as other information on the minor's educational course of a child, as results from the combination of the provisions of articles 1510 and 1513 of the Civil Code and 15 of GDPR, without, in fact, requiring further assistance on the part of the specific legal interest. This is because the complainant as exercising parental care of his minor child is identified with the subject of the specific data. Therefore, the complainant, as a controller, is obliged, in the context of the provision of services concerning him, to satisfy through his legal representative the relevant rights of access exercised by the father who exercises parental care of the minor child. 7. Because in this case, the complainant exercised the right of access on behalf of his minor child before the complained controller, in his capacity as exercising parental care, as stated above, which did not result in his having been removed. In particular, the complainant requested from the complained tutoring school and in particular by the general partner, and therefore his legal representative, B, as he obtains access to tax documents concerning the provision of services to his minor child as well as information 11 See indicatively relevant APD decisions 24/2009, 21, 22 and 53/2010, 130/2013, 18/2018, 4/2020, 26/2021, 37/2022. 8 for the educational course of the latter. Besides, the complainant proceeded to exercise the contested right of access in a clear way through written messages including full details of both himself and his child as a student of the complained-about school. From the messages in question, which were presented before the Authority, it also indisputably follows that the complainant's right of access was exercised in all respects. Besides, as explained in paragraph 2 of this article with reference to the jurisprudence of the Authority, in order to satisfy the right of access it is not necessary to invoke a legal interest, since it is considered a given that the legal interest (even if moral) of the subject to obtain knowledge of information, which concerns him and which has been registered in a file he keeps the person in charge processing, so that the basic principle of the law for the protection of personal data is carried out, which consists in the transparency of the processing as a condition for any further control of its legality by the data subject. In any case, the exercise of the right of access is not required to take place in a specific way or solemnly, e.g. by invoking the provisions of the GDPR or by explicitly referring to an exercise of which have been sent to B's mobile phone, as detailed above, it does not appear from the information in the file that they were satisfied by the person in charge processing, as long as there is no response regarding them. And the report of the complainant in no. first  C/EIS/6272/06-09-2023 his answer that "he has sent the corresponding proofs", in addition to being completely vague, in any case it is not proven by presenting the relevant answer to the complainant, while the latter maintains that until the day of the meeting before the Authority, he had not satisfy his relevant request. Therefore, according to what is set out in paragraphs 2 and 3, the accused should have responded through his legal representative and already by the deadline by sending the requested details of the minor child he had and/or informing him even only of the fact that he does not have any file data concerning his minor child, i.e. for the 2022-2023 school year. However, of the actual 12 See Decision of the Authority 26/2021, sc. 11 as well as 36/2021, s. 7 available on its website www.dpa.gr. 9 incidents and the evidence brought to the attention of the Authority did not prove that the complained of adequately responded to the complainant. With these data, if it is not proven that the right of access has been satisfied, and especially within the deadlines provided by the GDPR, or the justified non-satisfaction thereof, according to the provisions, a violation of Article 15 of the GDPR is established in combination with the provision of article 12 par. 3 and 4 GDPR. 8. Furthermore, from the above facts, it emerges that the data controller showed absolutely no willingness to cooperate with the Authority by providing clarifications regarding the complaint he was referring to. In particular, he was indifferent and did not make sure to answer clearly the specific questions first raised by the Authority with no. first C/EXE/463/23-02-2023 her document, while no response was sent by the complainant to no. first C/EXE/1449/07-06-2023 document of the Authority. Only about three (3) months after receiving the second above-mentioned document and after the Authority sent another reminder message (see document no. prot. C/EXE/2246/06-09-2023), it replied that it had sent the corresponding proofs without attaching any document that proves the above claim and without providing any other answer to the questions addressed by the firstly the Authority to crystallize the facts of the case under consideration. And to the question submitted by the Authority, in the context of the exercise of its investigative-auditing powers, regarding the name, in which the tax documents related to the provision of services to the minor child of the complainant were issued and the data included in them 13 14 , the reported educational institution received no response. In this way, the accused, as a data controller, violated his obligation arising from the above-mentioned article 31 of the GDPR, which is 13 Cf. in this regard APD 4/2020, sc. 8-9. 14 See sc. 10 of with no. 26/2021 of the Authority's Decision. 10 self-contained and its violation entails the imposition of the administrative fine of 15 article 83 par. 4 pc. 1 GDPR. 9. Because, according to the previous considerations, despite the intervention of the Authority that received the complaint in question, and especially after the lapse of approximately eight months from this intervention, the right of access of the complainant from the complained of foreign language school has not yet been fulfilled, as detailed above. With these data, a violation of the right of access of article 15 par. 1 of the GDPR, combined with the provisions of paragraphs 1, 3 and 4 of article 12 of the GDPR. In addition, the violation of the independent obligation of the complainant as data controller as he cooperates with the supervisory authority as defined in article 31 of the GDPR is also established. 10. Because according to the GDPR (App. Sk. 148) in order to strengthen the enforcement of the rules of this Regulation, sanctions, including administrative fines, should be imposed for any violation of the Regulation, in addition to or instead of the appropriate measures imposed by the supervisory authority in accordance with this Regulation. Based on the above, the Authority considers that there is a case to exercise the powers according to article 58 par. 2 of the GDPR its corrective powers in relation to the identified violations and to impose, pursuant to the provision of article 58 par. 2 pcs. i of the GDPR effective, proportionate and dissuasive administrative fine according to article 83 of the GDPR both to restore compliance and to punish illegal behavior. 17 11. Because the violation of the rights of the data subjects provided for in articles 12-22 of the GDPR entails the imposition of sanctions according to article 83 par. 5 pcs. b) of the GDPR, while the violation of the obligations of the controller provided for in articles 25 to 39, among others, entails the imposition of sanctions according to article 83 par. 4 pc. a' of the GDPR. Furthermore, the Authority took into account the measurement criteria of 15. Indicatively, it is noted that the Authority with decision 33/2021 imposed an administrative fine for the independent violation of the provision of Article 31 GDPR. The same with no. 37/2022 its decision. 16 Cf. APD 37/2015 and 71/2015, especially sc. 5. See and APD 26/2021. 17 See OE 29, Guidelines for the application and determination of administrative fines for the purposes of Regulation 2016/679 WP253, p. 6. 11 fines defined in article 83 par. 2 of the GDPR, the aforementioned paragraph 5 approx. b' of the same article, according to which the violation of the provisions regarding the rights of data subjects falls under the highest prescribed category of the system of classification of administrative fines as well as the also mentioned above paragraph 4 approx. a' of the above article regarding the obligation of the Data Controller arising from article 31, among other things, of the GDPR, which are applicable in this case, the Guidelines for the implementation and determination of administrative fines for the purposes of Regulation 2016/ 679 issued on 03-10-2017 by the Article 29 Working Group (WP 253), the Guidelines of the European Data Protection Board for the calculation of administrative fines under GDPR 18 as well as the actual data of the case under consideration and in particular: A. For the violation of the provision of article 15 par. 1 in combination with paragraphs 1, 3 and 4 of article 12 of the GDPR in terms of the complained of non-satisfaction of the complainant's right of access according to the above in detail, the Authority, weighing the criteria of the aforementioned no. 148 recital of the GDPR, took into account the following: i. The fact that the violation of the provisions regarding the rights of the subjects falls under, in accordance with the provisions of article 83 par. 5 sec. 2nd GDPR, in the highest prescribed category of the classification system of administrative fines. ii. The fact that the complainant deprived the complainant of the possibility to obtain information concerning his minor child. iii. The fact that the complainant did not satisfy the right of access exercised by the complainant according to article 15 par. 1 GDPR. iv. The fact of the long period of non-satisfaction of the right of access despite the intervention of the Authority. 18 See EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1, adopted on 24 May 2023, where it is stated among others (see pages 3 and 6) that they are applied in addition to the aforementioned Guidelines for the application and determination of administrative fines for the purposes of the 2016 Regulation /679, WP253. 12 v. The fact that the infringement in this case affected one (1) natural person as a subject of personal data in relation to the satisfaction of the right of access. vi. The fact that the violation of the right of access is attributed to the negligence of the complainant due to ignorance of the provisions of the GDPR and therefore not taking relevant compliance measures. vii. The fact that the violation of the right of access concerns simple personal data of the minor child of the complainant. viii. The absence of any actions that the complainant could have taken and did not take in order to mitigate the damage suffered by the data subject and namely the possibility to satisfy, even if late, the right of access or to inform about the possible non-existence of relevant data in his file. ix. The absence of previous established violations of the complainant, as a relevant audit shows that no administrative sanction has been imposed on him by the Authority to date. x. The fact that from the data brought to the attention of the Authority and on the basis of which it established the violation of the GDPR, the data controller did not obtain a financial benefit, nor did it cause material damage to the complainant. xi. The fact that the alleged data controller is organized under the corporate type of Partnership. B. For the violation of the obligation to cooperate with the Authority according to Article 31 of the GDPR, which falls under the category of approx. a' of paragraph 4 of article 83 of the GDPR as to the grading system of administrative fines: i. The continuing nature of the non-cooperation of the complainant through his legal representative, B, with the Authority, as described in detail above. ii. The difficulty caused to the Authority in investigating the merits of the complaint related to a violation of the right of access. iii. The fact that, however, this specific violation constitutes an isolated case, to the extent that no other relevant complaint against the person complained of has been brought before the Authority. 13 iv. The fact that the alleged data processor is organized under the corporate type of the General Partnership. 12. Based on the above, the Authority decides that the administrative sanctions referred to in the ordinance must be imposed on the person complained of as a data controller, which are deemed to be proportional to the gravity of the violations, while in addition, they are effective measures in the direction of compliance with the provisions on the protection of personal data deterrent to avoid further violations of the relevant legislation on the part of the complainant. FOR THESE REASONS, the Authority Imposes on the complained foreign language tutoring school with the name "GRIVAS CHARALAMPOS - MOUTZOURI ANASTASIA O.E." as controller, the effective, proportionate and dissuasive administrative fine that is appropriate in this particular case, according to its special circumstances, in the amount of one thousand (1,000) euros for the above found violation of articles 15 par. 1 GDPR and 12 par. 1, 3 and 4 GDPR, according to articles 58 par. 2 pc. i and 83 par. 5 pcs. b' GDPR and in the amount of two thousand (2,000) euros for the above found violation of article 31 GDPR, in accordance with articles 58 par. 2 pc. i and 83 par. 4 pc. 1 GDPR. The President The Secretary Konstantinos Menudakos Irini Papageorgopoulou14