HDPA (Greece) - 43/2019: Difference between revisions
(Removed redirect to HDPA - 41/2019) Tag: Removed redirect |
No edit summary |
||
| Line 10: | Line 10: | ||
[[Category: Greece]] | [[Category: Greece]] | ||
|- | |- | ||
|Relevant Law:||[[Article | |Relevant Law:||[[Article 5 GDPR#1a|Article 5(1)(a) GDPR]] | ||
[[Category:Article | [[Category:Article 5(1)(a) GDPR]] | ||
[[Article | [[Article 5 GDPR#2|Article 5(2) GDPR]] | ||
[[Category:Article | [[Category:Article 5(2) GDPR]] | ||
[[Article | [[Article 58 GDPR#2c|Article 58(2)(c) GDPR]] | ||
[[Category:Article | [[Category:Article 58(2)(c) GDPR]] | ||
[[Article | [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]] | ||
[[Category:Article | [[Category:Article 58(2)(d) GDPR]] | ||
[[Article | [[Article 58 GDPR#2i|Article 58(2)(i) GDPR]] | ||
[[Category:Article | [[Category:Article 58(2)(i) GDPR]] | ||
[[Article | [[Article 83 GDPR#2|Article 83(2) GDPR]] | ||
[[Category:Article | [[Category:Article 83(2) GDPR]] | ||
|- | |- | ||
|Type:||Complaint | |Type:||Complaint | ||
| Line 32: | Line 32: | ||
|Outcome:||Upheld | |Outcome:||Upheld | ||
|- | |- | ||
|Decided:|| | |Decided:||n/a | ||
[[Category:2019]] | [[Category:2019]] | ||
|- | |- | ||
|Published:|| | |Published:||13. 1. 2020 | ||
|- | |- | ||
|Fine:|| | |Fine:||EUR 15,000 | ||
|- | |- | ||
|Parties:|| | |Parties:||[https://www.allseas.gr/en ALLSEAS MARINE S.A.] | ||
|- | |- | ||
|National Case Number:||43/2019 | |National Case Number:||43/2019 | ||
| Line 51: | Line 51: | ||
Greek | Greek | ||
|- | |- | ||
|Original Source:||[https://www.dpa.gr/portal/page?_pageid=33 | |Original Source:||[https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2019&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7 HDPA (GR)] | ||
|} | |} | ||
The HDPA issued | The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR. The HDPA also issued a fine EUR 15,000 for violation of the data subject’s right to access and of the principles relating to data processing as foreseen under [[Article 5 GDPR#1|Article 5(1) GDPR]]. | ||
==English Summary== | ==English Summary== | ||
===Facts=== | ===Facts=== | ||
The Complainant was | The Complainant was General Manager and DPO of the company ALLSEAS MARINE S.A., which according to his complaint processed without any prior notification and keeps processing his and his family's personal data, including sensitive data, infringing this way his right as employee to personal data. With his complaint he asked the HDPA to order the company to cease the processing of personal data, to give back to him all his personal data in digital form or hard copies and to impose an adequate fine. The personal data was mainly collected via a video surveillance system. | ||
===Dispute=== | ===Dispute=== | ||
The DPA had to assess whether the stored data was personal and whether any exceptions shall apply due to the employment relationship and context. | |||
===Holding=== | ===Holding=== | ||
The | The HDPA found that the controller, acting as data controller in this case, failed to prove the lawfulness of installation and operation of the video surveillance system. The company did not provide technical information about that system and had not notified the HDPA for its installation as was provided for in Article 19(4)(a) of L. 2471/1997 which was in force until GDPR came into force. It, thus, violated the principle of accountability according to [[Article 5 GDPR#2|Article 5(2) GDPR]] and [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. The HDPA found that given these violations there is no reason to further examine whether there is a proper legal basis for the processing. It stressed, however, that even if the complainant had given his consent prior to the installation, the consent wouldn't be valid due to the imbalance of power between employer and employee. The HDPA finally: | ||
a) ordered the company to comply immediately with the complainant's request to exercise his right to access and information regarding his personal data stored in a PC owned by the company; | |||
b) ordered the company to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR within 1 month starting from the receipt of this decision; | |||
c)ordered the company comply with the [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]] and [[Article 5 GDPR#2|Article 5(2) GDPR]], as well as with the rest provisions of [[Article 5 GDPR#1|Article 5(1) GDPR]] and | |||
d) issued a fine EUR 15,000. | |||
==Comment== | ==Comment== | ||
Revision as of 16:07, 30 January 2020
| HDPA - 43/2019 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(a) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Decided: | n/a |
| Published: | 13. 1. 2020 |
| Fine: | EUR 15,000 |
| Parties: | ALLSEAS MARINE S.A. |
| National Case Number: | 43/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language: |
Greek |
| Original Source: | HDPA (GR) |
The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR. The HDPA also issued a fine EUR 15,000 for violation of the data subject’s right to access and of the principles relating to data processing as foreseen under Article 5(1) GDPR.
English Summary
Facts
The Complainant was General Manager and DPO of the company ALLSEAS MARINE S.A., which according to his complaint processed without any prior notification and keeps processing his and his family's personal data, including sensitive data, infringing this way his right as employee to personal data. With his complaint he asked the HDPA to order the company to cease the processing of personal data, to give back to him all his personal data in digital form or hard copies and to impose an adequate fine. The personal data was mainly collected via a video surveillance system.
Dispute
The DPA had to assess whether the stored data was personal and whether any exceptions shall apply due to the employment relationship and context.
Holding
The HDPA found that the controller, acting as data controller in this case, failed to prove the lawfulness of installation and operation of the video surveillance system. The company did not provide technical information about that system and had not notified the HDPA for its installation as was provided for in Article 19(4)(a) of L. 2471/1997 which was in force until GDPR came into force. It, thus, violated the principle of accountability according to Article 5(2) GDPR and Article 5(1)(a) GDPR. The HDPA found that given these violations there is no reason to further examine whether there is a proper legal basis for the processing. It stressed, however, that even if the complainant had given his consent prior to the installation, the consent wouldn't be valid due to the imbalance of power between employer and employee. The HDPA finally:
a) ordered the company to comply immediately with the complainant's request to exercise his right to access and information regarding his personal data stored in a PC owned by the company;
b) ordered the company to bring its processing operations with regard to the video surveillance it employed into compliance with the GDPR within 1 month starting from the receipt of this decision;
c)ordered the company comply with the Article 5(1)(a) GDPR and Article 5(2) GDPR, as well as with the rest provisions of Article 5(1) GDPR and
d) issued a fine EUR 15,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
There is no available machine translated decision. Please refer to the Greek original decision for details.
